diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index b4717dc18..8c1dcd419 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -3,11 +3,11 @@ PLEASE READ THIS MESSAGE.
 
 Documentation:
 - for Traefik v2: use branch v2.11 (fixes only)
-- for Traefik v3: use branch v3.5
+- for Traefik v3: use branch v3.6
 
 Bug:
 - for Traefik v2: use branch v2.11 (security fixes only)
-- for Traefik v3: use branch v3.5
+- for Traefik v3: use branch v3.6
 
 Enhancements:
 - use branch master
diff --git a/.github/workflows/check_doc.yaml b/.github/workflows/check_doc.yaml
new file mode 100644
index 000000000..5fea9809c
--- /dev/null
+++ b/.github/workflows/check_doc.yaml
@@ -0,0 +1,63 @@
+name: Check Documentation
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - '.github/workflows/check_doc.yaml'
+      - 'docs/**'
+
+jobs:
+
+  docs:
+    name: lint, build and verify
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Install markdownlint
+        run: |
+          npm install --global markdownlint@0.29.0 markdownlint-cli@0.35.0
+
+      - name: Lint
+        run: ./docs/scripts/lint.sh docs
+
+      - name: Setup python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: "./docs/requirements.txt"
+
+      - name: Build documentation
+        working-directory: ./docs
+        run: |
+          pip install -r requirements.txt
+          mkdocs build --strict
+
+      - name: Setup ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+
+      - name: Install html-proofer
+        run: |
+          gem install nokogiri --version 1.18.6 --no-document -- --use-system-libraries
+          gem install html-proofer --version 5.0.10 --no-document -- --use-system-libraries
+        env:
+          NOKOGIRI_USE_SYSTEM_LIBRARIES: "true"
+
+      # Comes from https://github.com/gjtorikian/html-proofer?tab=readme-ov-file#caching-with-continuous-integration
+      - name: Cache HTMLProofer
+        uses: actions/cache@v4
+        with:
+          path: tmp/.htmlproofer
+          key: ${{ runner.os }}-htmlproofer
+
+      - name: Verify
+        run: ./docs/scripts/verify.sh docs/site
diff --git a/.github/workflows/check_doc.yml b/.github/workflows/check_doc.yml
deleted file mode 100644
index 48afa3298..000000000
--- a/.github/workflows/check_doc.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Check Documentation
-
-on:
-  pull_request:
-    branches:
-      - '*'
-
-jobs:
-
-  docs:
-    name: Check, verify and build documentation
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Check documentation
-        run: make docs-pull-images docs
-        env:
-          # These variables are not passed to workflows that are triggered by a pull request from a fork.
-          DOCS_VERIFY_SKIP: ${{ vars.DOCS_VERIFY_SKIP }}
-          DOCS_LINT_SKIP: ${{ vars.DOCS_LINT_SKIP }}
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yaml
similarity index 100%
rename from .github/workflows/documentation.yml
rename to .github/workflows/documentation.yaml
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index db2c59183..03d864762 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,7 +10,7 @@ env:
   CGO_ENABLED: 0
   VERSION: ${{ github.ref_name }}
   TRAEFIKER_EMAIL: "traefiker@traefik.io"
-  CODENAME: chabichou
+  CODENAME: ramequin
 
 jobs:
 
@@ -24,7 +24,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [ linux-amd64, linux-386, linux-arm, linux-arm64, linux-ppc64le, linux-s390x, linux-riscv64, darwin, windows-amd64, windows-arm64, windows-386, freebsd, openbsd ]
+        os: [ linux-amd64, linux-386, linux-arm, linux-arm64, linux-ppc64le, linux-s390x, linux-riscv64, darwin-amd64, darwin-arm64, windows-amd64, windows-arm64, windows-386, freebsd-amd64, freebsd-386, openbsd-amd64, openbsd-386, openbsd-riscv64 ]
     needs:
       - build-webui
 
@@ -130,7 +130,7 @@ jobs:
             --exclude dist .
           
           chown -R "$(id -u)":"$(id -g)" dist/
-          gh release create ${VERSION} ./dist/**/traefik*.{zip,tar.gz} ./dist/traefik*.{tar.gz,txt} --repo traefik/traefik --title ${VERSION} --notes ${VERSION} --latest=true
+          gh release create ${VERSION} ./dist/**/traefik*.{zip,tar.gz} ./dist/traefik*.{tar.gz,txt} --repo traefik/traefik --title ${VERSION} --notes ${VERSION} --latest=false
           
           ./script/deploy.sh
 
diff --git a/.github/workflows/template-webui.yaml b/.github/workflows/template-webui.yaml
index b841c90f5..16af7d1e4 100644
--- a/.github/workflows/template-webui.yaml
+++ b/.github/workflows/template-webui.yaml
@@ -1,6 +1,8 @@
 name: Build Web UI
 on:
   workflow_call: {}
+env:
+  SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 360  # 15 days
 jobs:
 
   build-webui:
@@ -22,6 +24,12 @@ jobs:
           cache: yarn
           cache-dependency-path: webui/yarn.lock
 
+      - name: Setup safe-chain
+        working-directory: ./webui
+        run: |
+          npm i -g @aikidosec/safe-chain
+          safe-chain setup-ci
+
       - name: Build webui
         working-directory: ./webui
         run: |
diff --git a/.github/workflows/test-conformance.yaml b/.github/workflows/test-gateway-api-conformance.yaml
similarity index 56%
rename from .github/workflows/test-conformance.yaml
rename to .github/workflows/test-gateway-api-conformance.yaml
index 6373d8f92..fbeae3d27 100644
--- a/.github/workflows/test-conformance.yaml
+++ b/.github/workflows/test-gateway-api-conformance.yaml
@@ -5,18 +5,19 @@ on:
     branches:
       - '*'
     paths:
-      - '.github/workflows/test-conformance.yaml'
+      - '.github/workflows/test-gateway-api-conformance.yaml'
       - 'pkg/provider/kubernetes/gateway/**'
-      - 'integration/fixtures/k8s-conformance/**'
-      - 'integration/k8s_conformance_test.go'
+      - 'integration/fixtures/gateway-api-conformance/**'
+      - 'integration/gateway_api_conformance_test.go'
+      - 'integration/integration_test.go'
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.24'
   CGO_ENABLED: 0
 
 jobs:
 
-  test-conformance:
+  test-gateway-api-conformance:
     runs-on: ubuntu-latest
 
     steps:
@@ -30,7 +31,11 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
-      - name: K8s Gateway API conformance test and report
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
+      - name: Gateway API conformance test and report
         run: |
           make test-gateway-api-conformance
           git diff --exit-code
diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 0f7504c06..5125d19c6 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -30,6 +30,10 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
 
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
       - name: Build binary
         run: make binary-linux-amd64
 
diff --git a/.github/workflows/test-knative-conformance.yaml b/.github/workflows/test-knative-conformance.yaml
new file mode 100644
index 000000000..4e7b8be6a
--- /dev/null
+++ b/.github/workflows/test-knative-conformance.yaml
@@ -0,0 +1,51 @@
+name: Test Knative conformance
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - '.github/workflows/test-knative-conformance.yaml'
+      - 'pkg/provider/kubernetes/knative/**'
+      - 'integration/fixtures/knative/**'
+      - 'integration/knative_conformance_test.go'
+      - 'integration/integration_test.go'
+
+env:
+  GO_VERSION: '1.24'
+  CGO_ENABLED: 0
+
+jobs:
+
+  test-knative-conformance:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go ${{ env.GO_VERSION }}
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Set up KO
+        uses: ko-build/setup-ko@v0.6
+        env:
+          KO_DOCKER_REPO: ko.local
+
+      - name: Upload Test Images
+        run: |
+          # Download the test image templates.
+          go mod vendor
+          ./integration/fixtures/knative/upload-test-images.sh
+
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
+      - name: Knative conformance test
+        run: |
+          make test-knative-conformance
diff --git a/.github/workflows/test-unit.yaml b/.github/workflows/test-unit.yaml
index d8d612a51..d60e359f0 100644
--- a/.github/workflows/test-unit.yaml
+++ b/.github/workflows/test-unit.yaml
@@ -79,6 +79,11 @@ jobs:
           cache: 'yarn'
           cache-dependency-path: webui/yarn.lock
 
+      - name: Setup safe-chain
+        run: |
+          npm i -g @aikidosec/safe-chain
+          safe-chain setup-ci
+
       - name: UI unit tests
         working-directory: ./webui
         env:
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 470816bd5..ed46d1599 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -8,7 +8,7 @@ on:
 env:
   GO_VERSION: '1.24'
   GOLANGCI_LINT_VERSION: v2.0.2
-  MISSPELL_VERSION: v0.6.0
+  MISSPELL_VERSION: v0.7.0
 
 jobs:
 
diff --git a/.gitignore b/.gitignore
index 1754b1c70..741873dc9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,4 +19,4 @@ plugins-storage/
 plugins-local/
 traefik_changelog.md
 integration/tailscale.secret
-integration/conformance-reports/**/experimental-dev-default-report.yaml
+integration/gateway-api-conformance-reports/**/experimental-dev-default-report.yaml
diff --git a/.golangci.yml b/.golangci.yml
index 25de20ba1..50afac812 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -318,6 +318,12 @@ linters:
           - recvcheck
       - path: pkg/proxy/httputil/bufferpool.go
         text: 'SA6002: argument should be pointer-like to avoid allocations'
+      - path: integration/integration_test.go
+        text: 'var (gatewayAPIConformanceRunTest|traefikVersion) is unused'
+      - path: pkg/server/router/router.go
+        text: 'appendAssign: append result not assigned to the same slice'
+        linters:
+          - gocritic
     paths:
       - pkg/provider/kubernetes/crd/generated/
 
diff --git a/.goreleaser.yml.tmpl b/.goreleaser.yml.tmpl
index fbd27891b..6a0e9e878 100644
--- a/.goreleaser.yml.tmpl
+++ b/.goreleaser.yml.tmpl
@@ -54,10 +54,12 @@ changelog:
 archives:
   - id: traefik
     name_template: '{{ .ProjectName }}_v{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
-    format: tar.gz
+    formats:
+      - tar.gz
     format_overrides:
       - goos: windows
-        format: zip
+        formats:
+          - zip
     files:
       - LICENSE.md
       - CHANGELOG.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf46d9ae7..135a288b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,276 @@
+## [v3.6.7](https://github.com/traefik/traefik/tree/v3.6.7) (2026-01-14)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.6...v3.6.7)
+
+**Bug fixes:**
+- **[acme]** Bump github.com/go-acme/lego/v4 to v4.31.0 ([#12529](https://github.com/traefik/traefik/pull/12529) by [ldez](https://github.com/ldez))
+- **[acme]** Add missing renew options ([#12467](https://github.com/traefik/traefik/pull/12467) by [ldez](https://github.com/ldez))
+- **[acme]** Replace hardcoded references to LetsEncrypt in log messages ([#12464](https://github.com/traefik/traefik/pull/12464) by [schildbach](https://github.com/schildbach))
+- **[k8s/ingress-nginx]** Fix use-regex nginx annotation ([#12531](https://github.com/traefik/traefik/pull/12531) by [LBF38](https://github.com/LBF38))
+- **[k8s/ingress-nginx]** Prevent Ingress Nginx provider http router to attach to an entrypoint with TLS ([#12528](https://github.com/traefik/traefik/pull/12528) by [rtribotte](https://github.com/rtribotte))
+- **[k8s/ingress]** Fix panic for empty defaultBackend and defaultBackend without resources ([#12509](https://github.com/traefik/traefik/pull/12509) by [gndz07](https://github.com/gndz07))
+- **[k8s]** Fix condition used for serving and fenced endpoints ([#12521](https://github.com/traefik/traefik/pull/12521) by [LBF38](https://github.com/LBF38))
+- **[webui]** Validate X-Forwarded-Prefix value for dashboard redirect ([#12514](https://github.com/traefik/traefik/pull/12514) by [LBF38](https://github.com/LBF38))
+- **[acme]** Add timeout to ACME-TLS/1 challenge handshake ([#12516](https://github.com/traefik/traefik/pull/12516) by [LBF38](https://github.com/LBF38))
+- **[server]** Make encoded character options opt-in ([#12540](https://github.com/traefik/traefik/pull/12540) by [gndz07](https://github.com/gndz07))
+
+**Documentation:**
+- **[docker/swarm]** Update swarm.md traefik version ([#12508](https://github.com/traefik/traefik/pull/12508) by [DBouraoui](https://github.com/DBouraoui))
+- **[k8s/ingress-nginx]** Fix ingress-nginx annotations documentation ([#12510](https://github.com/traefik/traefik/pull/12510) by [nmengin](https://github.com/nmengin))
+- **[k8s]** Fix Kubernetes reference yml file ([#12406](https://github.com/traefik/traefik/pull/12406) by [mmatur](https://github.com/mmatur))
+- Fix code copy button positioning ([#12520](https://github.com/traefik/traefik/pull/12520) by [AnuragEkkati](https://github.com/AnuragEkkati))
+- Fix typo in kubernetes.md ([#12515](https://github.com/traefik/traefik/pull/12515) by [EdwardSalkeld](https://github.com/EdwardSalkeld))
+- Bring back security section on API & Dashboard documentation page ([#12507](https://github.com/traefik/traefik/pull/12507) by [gndz07](https://github.com/gndz07))
+- Fix link description in Traefik Proxy documentation ([#12488](https://github.com/traefik/traefik/pull/12488) by [schaerfo](https://github.com/schaerfo))
+- Add product comparison matrix and features page ([#12037](https://github.com/traefik/traefik/pull/12037) by [sheddy-traefik](https://github.com/sheddy-traefik))
+
+**Misc:**
+- Merge branch v2.11 into v3.6 ([#12552](https://github.com/traefik/traefik/pull/12552) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v2.11 into v3.6 ([#12533](https://github.com/traefik/traefik/pull/12533) by [mmatur](https://github.com/mmatur))
+- Merge branch v2.11 into v3.6 ([#12497](https://github.com/traefik/traefik/pull/12497) by [mmatur](https://github.com/mmatur))
+
+## [v2.11.35](https://github.com/traefik/traefik/tree/v2.11.35) (2026-01-14)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.34...v2.11.35)
+
+**Bug fixes:**
+- **[acme]** Add timeout to ACME-TLS/1 challenge handshake ([#12516](https://github.com/traefik/traefik/pull/12516) by [LBF38](https://github.com/LBF38))
+- **[server]** Make encoded character options opt-in ([#12540](https://github.com/traefik/traefik/pull/12540) by [gndz07](https://github.com/gndz07))
+
+## [v3.6.6](https://github.com/traefik/traefik/tree/v3.6.6) (2025-12-29)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.5...v3.6.6)
+
+**Bug fixes:**
+- **[acme]** Bump github.com/go-acme/lego/v4 to v4.30.1 ([#12432](https://github.com/traefik/traefik/pull/12432) by [ldez](https://github.com/ldez))
+- **[http3]** Bump github.com/quic-go/quic-go to v0.58.0 ([#12448](https://github.com/traefik/traefik/pull/12448) by [GreyXor](https://github.com/GreyXor))
+- **[redis]** Fix mutually exclusive verification for Redis ([#12442](https://github.com/traefik/traefik/pull/12442) by [juliens](https://github.com/juliens))
+- **[server]** Fix deny encoded characters ([#12454](https://github.com/traefik/traefik/pull/12454) by [rtribotte](https://github.com/rtribotte))
+
+**Documentation:**
+- **[k8s/ingress,k8s]** Fix Kubernetes Ingress provider documentation ([#12443](https://github.com/traefik/traefik/pull/12443) by [nmengin](https://github.com/nmengin))
+- **[k8s/ingress-nginx]** Add RBAC documentation for Ingress NGINX provider ([#12445](https://github.com/traefik/traefik/pull/12445) by [nmn3m](https://github.com/nmn3m))
+- **[k8s]** Improve the K8S multi-tenancy security note ([#12444](https://github.com/traefik/traefik/pull/12444) by [nmengin](https://github.com/nmengin))
+- Restore documentation on http.maxHeaderBytes ([#12440](https://github.com/traefik/traefik/pull/12440) by [mloiseleur](https://github.com/mloiseleur))
+- Fix Menu Item Naming ([#12431](https://github.com/traefik/traefik/pull/12431) by [sheddy-traefik](https://github.com/sheddy-traefik))
+
+**Misc:**
+- Merge branch v2.11 into v3.6 ([#12475](https://github.com/traefik/traefik/pull/12475) by [mmatur](https://github.com/mmatur))
+- Merge branch v2.11 into v3.6 ([#12438](https://github.com/traefik/traefik/pull/12438) by [kevinpollet](https://github.com/kevinpollet))
+
+## [v2.11.34](https://github.com/traefik/traefik/tree/v2.11.34) (2025-12-23)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.33...v2.11.34)
+
+**Bug fixes:**
+- **[server]** Fix deny encoded characters ([#12457](https://github.com/traefik/traefik/pull/12457) by [rtribotte](https://github.com/rtribotte))
+
+## [v2.11.33](https://github.com/traefik/traefik/tree/v2.11.33) (2025-12-17)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.32...v2.11.33)
+
+**Bug fixes:**
+- **[server]** Print access logs for rejected requests and warn about new behavior ([#12426](https://github.com/traefik/traefik/pull/12426) by [rtribotte](https://github.com/rtribotte))
+
+**Documentation:**
+- Clarify doc about encoded characters rejection ([#12391](https://github.com/traefik/traefik/pull/12391) by [rtribotte](https://github.com/rtribotte))
+- Fix encoded characters entryPoint option documentation ([#12384](https://github.com/traefik/traefik/pull/12384) by [rtribotte](https://github.com/rtribotte))
+- Fix encoded characters option documentation ([#12373](https://github.com/traefik/traefik/pull/12373) by [kevinpollet](https://github.com/kevinpollet))
+
+## [v3.6.5](https://github.com/traefik/traefik/tree/v3.6.5) (2025-12-16)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.4...v3.6.5)
+
+**Bug fixes:**
+- **[k8s/ingress-nginx]** Fix NGINX sslredirect annotation support ([#12387](https://github.com/traefik/traefik/pull/12387) by [rtribotte](https://github.com/rtribotte))
+- **[server]** Print access logs for rejected requests and warn about new behavior ([#12424](https://github.com/traefik/traefik/pull/12424) by [kevinpollet](https://github.com/kevinpollet))
+
+**Documentation:**
+- **[k8s/ingress-nginx]** Add auth-signin to unsupported nginx annotations list ([#12370](https://github.com/traefik/traefik/pull/12370) by [fibsifan](https://github.com/fibsifan))
+- Add a Breaking change note to the changelog ([#12398](https://github.com/traefik/traefik/pull/12398) by [nmengin](https://github.com/nmengin))
+- Fix encodedCharacters entryPoint option documentation ([#12385](https://github.com/traefik/traefik/pull/12385) by [rtribotte](https://github.com/rtribotte))
+
+## [v3.6.4](https://github.com/traefik/traefik/tree/v3.6.4) (2025-12-05)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.2...v3.6.4)
+
+**CVE's fixed:**
+- [CVE-2025-66490](https://nvd.nist.gov/vuln/detail/CVE-2025-66490) (Advisory [GHSA-gm3x-23wp-hc2c](https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c)): **Breaking Change** please read the [migration guide](https://doc.traefik.io/traefik/v3.6/migrate/v3/#v364).
+- [CVE-2025-66491](https://nvd.nist.gov/vuln/detail/CVE-2025-66491) (Advisory [GHSA-7vww-mvcr-x6vj](https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj))
+
+**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.6/migrate/v3/#v364).
+
+**Bug fixes:**
+- **[server]** Reject suspicious encoded characters ([#12360](https://github.com/traefik/traefik/pull/12360) by [rtribotte](https://github.com/rtribotte))
+- **[plugins]** Validate plugin module name ([#12291](https://github.com/traefik/traefik/pull/12291) by [kevinpollet](https://github.com/kevinpollet))
+- **[http3]** Bump github.com/quic-go/quic-go to v0.57.1 ([#12319](https://github.com/traefik/traefik/pull/12319) by [GreyXor](https://github.com/GreyXor))
+- **[http3]** Bump github.com/quic-go/quic-go to v0.57.0 ([#12308](https://github.com/traefik/traefik/pull/12308) by [GreyXor](https://github.com/GreyXor))
+- **[server]** Bump golang.org/x/crypto to v0.45.0 ([#12296](https://github.com/traefik/traefik/pull/12296) by [kevinpollet](https://github.com/kevinpollet))
+- **[acme]** Bump github.com/go-acme/lego/v4 to v4.29.0 ([#12333](https://github.com/traefik/traefik/pull/12333) by [ldez](https://github.com/ldez))
+- **[k8s/ingress-nginx]** Fix SSL redirect to match NGINX behavior ([#12361](https://github.com/traefik/traefik/pull/12361) by [mmatur](https://github.com/mmatur))
+- **[k8s/ingress-nginx]** Fix the service name for ingress-nginx provider ([#12352](https://github.com/traefik/traefik/pull/12352) by [mmatur](https://github.com/mmatur))
+- **[k8s/ingress-nginx]** Fix nginx.ingress.kubernetes.io/proxy-ssl-verify annotation support ([#12351](https://github.com/traefik/traefik/pull/12351) by [rtribotte](https://github.com/rtribotte))
+- **[middleware,authentication]** Change ForwardAuth error log level from DEBUG to ERROR ([#12324](https://github.com/traefik/traefik/pull/12324) by [murataslan1](https://github.com/murataslan1))
+
+**Documentation:**
+- **[api]** Fix typo in API dashboard configuration instructions ([#12335](https://github.com/traefik/traefik/pull/12335) by [NAICOLAS](https://github.com/NAICOLAS))
+- **[docker]** Add documentation for loadbalancer.server.url in Docker and Swarm providers ([#12289](https://github.com/traefik/traefik/pull/12289) by [webash](https://github.com/webash))
+- **[k8s/gatewayapi]** Fix links of Helm chart values reference to providers.kubernetesGateway.enabled ([#12315](https://github.com/traefik/traefik/pull/12315) by [shouhei](https://github.com/shouhei))
+- **[k8s/ingress-nginx]** Fix default value of ingress-nginx provider in documentation ([#12328](https://github.com/traefik/traefik/pull/12328) by [mloiseleur](https://github.com/mloiseleur))
+- **[k8s/ingress-nginx]** NGINX Ingress Controller to Traefik Migration Guide ([#12318](https://github.com/traefik/traefik/pull/12318) by [sheddy-traefik](https://github.com/sheddy-traefik))
+- **[k8s/ingress-nginx]** Improve the configuration options display of the Kubernetes ingress-nginx provider ([#12297](https://github.com/traefik/traefik/pull/12297) by [mloiseleur](https://github.com/mloiseleur))
+- **[k8s/ingress-nginx]** Improve ingress-nginx provider documentation ([#12288](https://github.com/traefik/traefik/pull/12288) by [sheddy-traefik](https://github.com/sheddy-traefik))
+- **[service]** Fix loadbalancer doc for highest random weight ([#12283](https://github.com/traefik/traefik/pull/12283) by [ozon2](https://github.com/ozon2))
+- Correctly Format the HTTP Service Documentation ([#12311](https://github.com/traefik/traefik/pull/12311) by [sheddy-traefik](https://github.com/sheddy-traefik))
+- Add documentation about checkNewVersion ([#12298](https://github.com/traefik/traefik/pull/12298) by [darkweaver87](https://github.com/darkweaver87))
+
+**Misc:**
+- Merge branch v2.11 into v3.6 ([#12364](https://github.com/traefik/traefik/pull/12364) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v2.11 into v3.6 ([#12341](https://github.com/traefik/traefik/pull/12341) by [mmatur](https://github.com/mmatur))
+- Merge branch v2.11 into v3.6 ([#12368](https://github.com/traefik/traefik/pull/12368) by [mmatur](https://github.com/mmatur))
+
+## [v3.6.3](https://github.com/traefik/traefik/tree/v3.6.3) (2025-12-04)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.2...v3.6.3)
+
+Release canceled.
+
+## [v2.11.32](https://github.com/traefik/traefik/tree/v2.11.32) (2025-12-04)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.31...v2.11.32)
+
+**Bug fixes:**
+- **[server]** Reject suspicious encoded characters ([#12360](https://github.com/traefik/traefik/pull/12360) by [rtribotte](https://github.com/rtribotte))
+- **[plugins]** Validate plugin module name ([#12291](https://github.com/traefik/traefik/pull/12291) by [kevinpollet](https://github.com/kevinpollet))
+- **[http3]** Bump github.com/quic-go/quic-go to v0.57.1 ([#12319](https://github.com/traefik/traefik/pull/12319) by [GreyXor](https://github.com/GreyXor))
+- **[http3]** Bump github.com/quic-go/quic-go to v0.57.0 ([#12308](https://github.com/traefik/traefik/pull/12308) by [GreyXor](https://github.com/GreyXor))
+- **[server]** Bump golang.org/x/crypto to v0.45.0 ([#12296](https://github.com/traefik/traefik/pull/12296) by [kevinpollet](https://github.com/kevinpollet))
+
+**Documentation:**
+- Update SECURITY.md to streamline information ([#12310](https://github.com/traefik/traefik/pull/12310) by [emilevauge](https://github.com/emilevauge))
+- Update SECURITY.md ([#12304](https://github.com/traefik/traefik/pull/12304) by [cwayne18](https://github.com/cwayne18))
+
+## [v3.6.2](https://github.com/traefik/traefik/tree/v3.6.2) (2025-11-18)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.1...v3.6.2)
+
+**Bug fixes:**
+- **[k8s/ingress-nginx]** Deprecate Kubernetes Ingress NGINX provider experimental flag ([#12286](https://github.com/traefik/traefik/pull/12286) by [rtribotte](https://github.com/rtribotte))
+
+## [v3.6.1](https://github.com/traefik/traefik/tree/v3.6.1) (2025-11-13)
+[All Commits](https://github.com/traefik/traefik/compare/v3.6.0...v3.6.1)
+
+**Bug fixes:**
+- **[docker]** Auto-negotiate Docker API Version ([#12256](https://github.com/traefik/traefik/pull/12256) by [felixbuenemann](https://github.com/felixbuenemann))
+- **[server]** Fix multi-layer routing with models ([#12258](https://github.com/traefik/traefik/pull/12258) by [juliens](https://github.com/juliens))
+- **[udp]** Revert "Avoid allocations in readLoop by using sync.Pool" ([#12267](https://github.com/traefik/traefik/pull/12267) by [kevinpollet](https://github.com/kevinpollet))
+- **[webui]** Fix blocked navigation on Safari ([#12231](https://github.com/traefik/traefik/pull/12231) by [gndz07](https://github.com/gndz07))
+- **[webui]** Restore remote Upgrade to Hub button web component ([#12219](https://github.com/traefik/traefik/pull/12219) by [gndz07](https://github.com/gndz07))
+
+**Documentation:**
+- **[k8s]** Fix Nginx provider documentation ([#12266](https://github.com/traefik/traefik/pull/12266) by [nmengin](https://github.com/nmengin))
+- **[k8s]** Fix Gateway API version and the list of features supported ([#12254](https://github.com/traefik/traefik/pull/12254) by [nmengin](https://github.com/nmengin))
+
+## [v2.11.31](https://github.com/traefik/traefik/tree/v2.11.31) (2025-11-13)
+[All Commits](https://github.com/traefik/traefik/compare/v2.11.30...v2.11.31)
+
+**Bug fixes:**
+- **[docker,docker/swarm]** Auto-negotiate Docker API version ([#12262](https://github.com/traefik/traefik/pull/12262) by [kevinpollet](https://github.com/kevinpollet))
+
+## [v3.6.0](https://github.com/traefik/traefik/tree/v3.6.0) (2025-11-07)
+[All Commits](https://github.com/traefik/traefik/compare/v3.5.0-rc1...v3.6.0)
+
+**Enhancements:**
+- **[acme]** Add new certificatesresolvers options ([#11977](https://github.com/traefik/traefik/pull/11977) by [ldez](https://github.com/ldez))
+- **[consul,consulcatalog,nomad]** Log provider namespace during startup ([#12002](https://github.com/traefik/traefik/pull/12002) by [shreealt](https://github.com/shreealt))
+- **[docker]** Allow discovering non-running Docker containers  ([#10645](https://github.com/traefik/traefik/pull/10645) by [acouvreur](https://github.com/acouvreur))
+- **[ecs]** AWS ECS IPv6 Support ([#12179](https://github.com/traefik/traefik/pull/12179) by [wizbit](https://github.com/wizbit))
+- **[file,k8s/crd,service]** Add least time load balancing strategy ([#12167](https://github.com/traefik/traefik/pull/12167) by [sdelicata](https://github.com/sdelicata))
+- **[healthcheck,tcp]** Add TCP Healthcheck ([#11238](https://github.com/traefik/traefik/pull/11238) by [ddtmachado](https://github.com/ddtmachado))
+- **[healthcheck]** Add passive health checks ([#11351](https://github.com/traefik/traefik/pull/11351) by [Nelwhix](https://github.com/Nelwhix))
+- **[k8s/crd]** Add highest random weight in Kubernetes CRD ([#12061](https://github.com/traefik/traefik/pull/12061) by [lbenguigui](https://github.com/lbenguigui))
+- **[k8s/gatewayapi]** Bump sigs.k8s.io/gateway-api to v1.4.0 ([#12140](https://github.com/traefik/traefik/pull/12140) by [kevinpollet](https://github.com/kevinpollet))
+- **[k8s/ingress]** Allow publishing services with type ExternalName ([#12065](https://github.com/traefik/traefik/pull/12065) by [james-callahan](https://github.com/james-callahan))
+- **[k8s]** Add Knative provider ([#11448](https://github.com/traefik/traefik/pull/11448) by [idurgakalyan](https://github.com/idurgakalyan))
+- **[middleware,authentication]** Add warning when maxBodySize is not set ([#12085](https://github.com/traefik/traefik/pull/12085) by [kianelbo](https://github.com/kianelbo))
+- **[middleware,server]** Multi-layer routing ([#12130](https://github.com/traefik/traefik/pull/12130) by [sdelicata](https://github.com/sdelicata))
+- **[plugins]** Support syscall ([#11939](https://github.com/traefik/traefik/pull/11939) by [david-garcia-garcia](https://github.com/david-garcia-garcia))
+- **[server]** Implement HTTP2 HPACK table size options ([#12050](https://github.com/traefik/traefik/pull/12050) by [GCHQDeveloper548](https://github.com/GCHQDeveloper548))
+- **[service,udp]** Avoid allocations in readLoop by using sync.Pool ([#12029](https://github.com/traefik/traefik/pull/12029) by [arturmelanchyk](https://github.com/arturmelanchyk))
+- **[service]** Add HighestRandomWeight load balancing algorithm ([#9946](https://github.com/traefik/traefik/pull/9946) by [mathieuHa](https://github.com/mathieuHa))
+- **[webui]** Add Traefik Hub demo in dashboard ([#12193](https://github.com/traefik/traefik/pull/12193) by [gndz07](https://github.com/gndz07))
+- **[webui]** Reduce vertical padding in dashboard table rows for more compact layout ([#12145](https://github.com/traefik/traefik/pull/12145) by [leccelecce](https://github.com/leccelecce))
+
+**Bug fixes:**
+- **[server]** Make the aggregator compute provider namespace for router's parentRefs ([#12235](https://github.com/traefik/traefik/pull/12235) by [rtribotte](https://github.com/rtribotte))
+
+**Documentation:**
+- Prepare release v3.6.0-rc1 ([#12211](https://github.com/traefik/traefik/pull/12211) by [kevinpollet](https://github.com/kevinpollet))
+- Fix broken link to migration guide on readme ([#12021](https://github.com/traefik/traefik/pull/12021) by [0slb](https://github.com/0slb))
+- Fix broken links in TCP Service and HTTP Router documentation ([#12215](https://github.com/traefik/traefik/pull/12215) by [sheddy-traefik](https://github.com/sheddy-traefik))
+- Fix typo in v3.6 migration guide ([#12212](https://github.com/traefik/traefik/pull/12212) by [jnoordsij](https://github.com/jnoordsij))
+
+**Misc:**
+- Merge branch v3.5 into master ([#12210](https://github.com/traefik/traefik/pull/12210) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12191](https://github.com/traefik/traefik/pull/12191) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12188](https://github.com/traefik/traefik/pull/12188) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12160](https://github.com/traefik/traefik/pull/12160) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12136](https://github.com/traefik/traefik/pull/12136) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#12120](https://github.com/traefik/traefik/pull/12120) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12095](https://github.com/traefik/traefik/pull/12095) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#12051](https://github.com/traefik/traefik/pull/12051) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#11976](https://github.com/traefik/traefik/pull/11976) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#11940](https://github.com/traefik/traefik/pull/11940) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#11900](https://github.com/traefik/traefik/pull/11900) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into v3.6 ([#12242](https://github.com/traefik/traefik/pull/12242) by [kevinpollet](https://github.com/kevinpollet))
+
+## [v3.5.6](https://github.com/traefik/traefik/tree/v3.5.6) (2025-11-07)
+[All Commits](https://github.com/traefik/traefik/compare/v3.5.4...v3.5.6)
+
+**Bug fixes:**
+- **[acme]** Bump github.com/go-acme/lego/v4 to v4.28.0 ([#12218](https://github.com/traefik/traefik/pull/12218) by [ldez](https://github.com/ldez))
+- **[server]** Filter unknown nodes with file and env for the deprecation loader ([#12227](https://github.com/traefik/traefik/pull/12227) by [rtribotte](https://github.com/rtribotte))
+
+**Documentation:**
+- **[acme]** Add missing ACME options and clean up table for more visibility ([#12208](https://github.com/traefik/traefik/pull/12208) by [sheddy-traefik](https://github.com/sheddy-traefik))
+- **[middleware]** Fix default encodings in compress middleware ([#12216](https://github.com/traefik/traefik/pull/12216) by [Belphemur](https://github.com/Belphemur))
+- Update Configuration Overview Page ([#12202](https://github.com/traefik/traefik/pull/12202) by [sheddy-traefik](https://github.com/sheddy-traefik))
+
+## [v3.5.5](https://github.com/traefik/traefik/tree/v3.5.5) (2025-11-07)
+[All Commits](https://github.com/traefik/traefik/compare/v3.5.4...v3.5.5)
+
+Release canceled.
+
+## [v3.6.0-rc1](https://github.com/traefik/traefik/tree/v3.6.0-rc1) (2025-10-28)
+[All Commits](https://github.com/traefik/traefik/compare/v3.5.0-rc1...v3.6.0-rc1)
+
+**Enhancements:**
+- **[acme]** Add new certificatesresolvers options ([#11977](https://github.com/traefik/traefik/pull/11977) by [ldez](https://github.com/ldez))
+- **[consul,consulcatalog,nomad]** Log provider namespace during startup ([#12002](https://github.com/traefik/traefik/pull/12002) by [shreealt](https://github.com/shreealt))
+- **[docker]** Allow discovering non-running Docker containers  ([#10645](https://github.com/traefik/traefik/pull/10645) by [acouvreur](https://github.com/acouvreur))
+- **[ecs]** AWS ECS IPv6 Support ([#12179](https://github.com/traefik/traefik/pull/12179) by [wizbit](https://github.com/wizbit))
+- **[file,k8s/crd,service]** Add least time load balancing strategy ([#12167](https://github.com/traefik/traefik/pull/12167) by [sdelicata](https://github.com/sdelicata))
+- **[healthcheck,tcp]** Add TCP Healthcheck ([#11238](https://github.com/traefik/traefik/pull/11238) by [ddtmachado](https://github.com/ddtmachado))
+- **[healthcheck]** Add passive health checks ([#11351](https://github.com/traefik/traefik/pull/11351) by [Nelwhix](https://github.com/Nelwhix))
+- **[k8s/crd]** Add highest random weight in Kubernetes CRD ([#12061](https://github.com/traefik/traefik/pull/12061) by [lbenguigui](https://github.com/lbenguigui))
+- **[k8s/gatewayapi]** Bump sigs.k8s.io/gateway-api to v1.4.0 ([#12140](https://github.com/traefik/traefik/pull/12140) by [kevinpollet](https://github.com/kevinpollet))
+- **[k8s/ingress]** Allow publishing services with type ExternalName ([#12065](https://github.com/traefik/traefik/pull/12065) by [james-callahan](https://github.com/james-callahan))
+- **[k8s]** Add Knative provider ([#11448](https://github.com/traefik/traefik/pull/11448) by [idurgakalyan](https://github.com/idurgakalyan))
+- **[middleware,authentication]** Add warning when maxBodySize is not set ([#12085](https://github.com/traefik/traefik/pull/12085) by [kianelbo](https://github.com/kianelbo))
+- **[middleware,server]** Multi-layer routing ([#12130](https://github.com/traefik/traefik/pull/12130) by [sdelicata](https://github.com/sdelicata))
+- **[plugins]** Support syscall ([#11939](https://github.com/traefik/traefik/pull/11939) by [david-garcia-garcia](https://github.com/david-garcia-garcia))
+- **[server]** Implement HTTP2 HPACK table size options ([#12050](https://github.com/traefik/traefik/pull/12050) by [GCHQDeveloper548](https://github.com/GCHQDeveloper548))
+- **[service,udp]** Avoid allocations in readLoop by using sync.Pool ([#12029](https://github.com/traefik/traefik/pull/12029) by [arturmelanchyk](https://github.com/arturmelanchyk))
+- **[service]** Add HighestRandomWeight load balancing algorithm ([#9946](https://github.com/traefik/traefik/pull/9946) by [mathieuHa](https://github.com/mathieuHa))
+- **[webui]** Add Traefik Hub demo in dashboard ([#12193](https://github.com/traefik/traefik/pull/12193) by [gndz07](https://github.com/gndz07))
+- **[webui]** Reduce vertical padding in dashboard table rows for more compact layout ([#12145](https://github.com/traefik/traefik/pull/12145) by [leccelecce](https://github.com/leccelecce))
+
+**Documentation:**
+- Fix broken link to migration guide on readme ([#12021](https://github.com/traefik/traefik/pull/12021) by [0slb](https://github.com/0slb))
+
+**Misc:**
+- Merge branch v3.5 into master ([#12210](https://github.com/traefik/traefik/pull/12210) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12191](https://github.com/traefik/traefik/pull/12191) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12188](https://github.com/traefik/traefik/pull/12188) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12160](https://github.com/traefik/traefik/pull/12160) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12136](https://github.com/traefik/traefik/pull/12136) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#12120](https://github.com/traefik/traefik/pull/12120) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#12095](https://github.com/traefik/traefik/pull/12095) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#12051](https://github.com/traefik/traefik/pull/12051) by [rtribotte](https://github.com/rtribotte))
+- Merge branch v3.5 into master ([#11976](https://github.com/traefik/traefik/pull/11976) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#11940](https://github.com/traefik/traefik/pull/11940) by [kevinpollet](https://github.com/kevinpollet))
+- Merge branch v3.5 into master ([#11900](https://github.com/traefik/traefik/pull/11900) by [kevinpollet](https://github.com/kevinpollet))
+
 ## [v3.5.4](https://github.com/traefik/traefik/tree/v3.5.4) (2025-10-28)
 [All Commits](https://github.com/traefik/traefik/compare/v3.5.3...v3.5.4)
 
diff --git a/Dockerfile b/Dockerfile
index 10ee5e2b5..0d64f6209 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.2
-FROM alpine:3.22
+FROM alpine:3.23
 
 RUN apk add --no-cache --no-progress ca-certificates tzdata
 
diff --git a/Makefile b/Makefile
index 470b5c3e8..7f361cfb2 100644
--- a/Makefile
+++ b/Makefile
@@ -100,10 +100,15 @@ test-integration:
 	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration -test.timeout=20m -failfast -v $(TESTFLAGS)
 
 .PHONY: test-gateway-api-conformance
-#? test-gateway-api-conformance: Run the conformance tests
+#? test-gateway-api-conformance: Run the Gateway API conformance tests
 test-gateway-api-conformance: build-image-dirty
-	# In case of a new Minor/Major version, the k8sConformanceTraefikVersion needs to be updated.
-	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration -v -test.run K8sConformanceSuite -k8sConformance -k8sConformanceTraefikVersion="v3.5" $(TESTFLAGS)
+	# In case of a new Minor/Major version, the traefikVersion needs to be updated.
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration -v -tags gatewayAPIConformance -test.run GatewayAPIConformanceSuite -traefikVersion="v3.6" $(TESTFLAGS)
+
+.PHONY: test-knative-conformance
+#? test-knative-conformance: Run the Knative conformance tests
+test-knative-conformance: build-image-dirty
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration/integration_test.go ./integration/knative_conformance_test.go -v -tags knativeConformance -test.run KnativeConformanceSuite
 
 .PHONY: test-ui-unit
 #? test-ui-unit: Run the unit tests for the webui
diff --git a/README.md b/README.md
index 472057a3a..8cd3df7d0 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ Pointing Traefik at your orchestrator should be the _only_ configuration step yo
 
 ---
 
-:warning: When migrating to a new major version of Traefik, please refer to the [migration guide](https://doc.traefik.io/traefik/migration/v2-to-v3/) to ensure a smooth transition and to be aware of any breaking changes.
+:warning: When migrating to a new major version of Traefik, please refer to the [migration guide](https://doc.traefik.io/traefik/migrate/v2-to-v3/) to ensure a smooth transition and to be aware of any breaking changes.
 
 
 ## Overview
diff --git a/SECURITY.md b/SECURITY.md
index c9a2670f6..240fba79b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,10 +1,5 @@
 # Security Policy
 
-You can join our security mailing list to be aware of the latest announcements from our security team.
-You can subscribe by sending an email to security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security).
-
-Reported vulnerabilities can be found on [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik).
-
 ## Supported Versions
 
 - We usually release 3/4 new versions (e.g. 1.1.0, 1.2.0, 1.3.0) per year.
@@ -17,10 +12,10 @@ We use [Semantic Versioning](https://semver.org/).
 
 | Version   | Supported          |
 |-----------|--------------------|
-| `2.2.x`   | :white_check_mark: |
-| `< 2.2.x` | :x:                |
-| `1.7.x`   | :white_check_mark: |
-| `< 1.7.x` | :x:                |
+| `3.6.x`   | :white_check_mark: |
+| `< 3.6.x` | :x:                |
+| `2.11.x`   | :white_check_mark: |
+| `< 2.11.x` | :x:                |
 
 ## Reporting a Vulnerability
 
@@ -28,3 +23,5 @@ We want to keep Traefik safe for everyone.
 If you've discovered a security vulnerability in Traefik,
 we appreciate your help in disclosing it to us in a responsible manner,
 by creating a [security advisory](https://github.com/traefik/traefik/security/advisories).
+
+Reported vulnerabilities can be found on [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik).
diff --git a/cmd/traefik/traefik.go b/cmd/traefik/traefik.go
index 3f35b280f..88b316c21 100644
--- a/cmd/traefik/traefik.go
+++ b/cmd/traefik/traefik.go
@@ -98,6 +98,11 @@ func runCmd(staticConfiguration *static.Configuration) error {
 		return fmt.Errorf("setting up logger: %w", err)
 	}
 
+	log.Warn().Msg("Traefik can reject some encoded characters in the request path." +
+		"When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986)," +
+		"it is recommended to set these options to `false` to avoid split-view situation." +
+		"Refer to the documentation for more details: https://doc.traefik.io/traefik/v3.6/migrate/v3/#encoded-characters-configuration-default-values")
+
 	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment
 
 	staticConfiguration.SetEffectiveConfiguration()
@@ -115,9 +120,7 @@ func runCmd(staticConfiguration *static.Configuration) error {
 		log.Debug().RawJSON("staticConfiguration", []byte(redactedStaticConfiguration)).Msg("Static configuration loaded [json]")
 	}
 
-	if staticConfiguration.Global.CheckNewVersion {
-		checkNewVersion()
-	}
+	checkNewVersion(staticConfiguration)
 
 	stats(staticConfiguration)
 
@@ -620,13 +623,28 @@ func setupTracing(ctx context.Context, conf *static.Tracing) (*tracing.Tracer, i
 	return tracer, closer
 }
 
-func checkNewVersion() {
-	ticker := time.Tick(24 * time.Hour)
-	safe.Go(func() {
-		for time.Sleep(10 * time.Minute); ; <-ticker {
-			version.CheckNewVersion()
-		}
-	})
+func checkNewVersion(staticConfiguration *static.Configuration) {
+	logger := log.With().Logger()
+
+	if staticConfiguration.Global.CheckNewVersion {
+		logger.Info().Msg(`Version check is enabled.`)
+		logger.Info().Msg(`Traefik checks for new releases to notify you if your version is out of date.`)
+		logger.Info().Msg(`It also collects usage data during this process.`)
+		logger.Info().Msg(`Check the documentation to get more info: https://doc.traefik.io/traefik/contributing/data-collection/`)
+
+		ticker := time.Tick(24 * time.Hour)
+		safe.Go(func() {
+			for time.Sleep(10 * time.Minute); ; <-ticker {
+				version.CheckNewVersion()
+			}
+		})
+	} else {
+		logger.Info().Msg(`
+Version check is disabled.
+You will not be notified if a new version is available.
+More details: https://doc.traefik.io/traefik/contributing/data-collection/
+`)
+	}
 }
 
 func stats(staticConfiguration *static.Configuration) {
diff --git a/docs/check.Dockerfile b/docs/check.Dockerfile
index 2a03cf8af..d89f9efa9 100644
--- a/docs/check.Dockerfile
+++ b/docs/check.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.22
+FROM alpine:3.23
 
 RUN apk --no-cache --no-progress add \
     build-base \
@@ -34,6 +34,7 @@ RUN apk --no-cache --no-progress add \
 
 COPY ./scripts/verify.sh /verify.sh
 COPY ./scripts/lint.sh /lint.sh
+COPY ./scripts/lint-yaml.sh /lint-yaml.sh
 
 WORKDIR /app
 VOLUME ["/tmp","/app"]
diff --git a/docs/content/assets/css/code-copy.css b/docs/content/assets/css/code-copy.css
new file mode 100644
index 000000000..3273b0ec2
--- /dev/null
+++ b/docs/content/assets/css/code-copy.css
@@ -0,0 +1,18 @@
+/* Fix positioning of the built-in clipboard button for code blocks.
+ * In this theme, the button can end up positioned relative to <body>,
+ * so anchor it to the code block container instead.
+ */
+
+.md-typeset pre.highlight {
+  position: relative;
+}
+
+.md-typeset pre.highlight > button.md-clipboard {
+  position: absolute;
+  top: .25rem;
+  right: .25rem;
+  z-index: 10;
+  opacity: 1;
+  visibility: visible;
+}
+
diff --git a/docs/content/assets/js/extra.js b/docs/content/assets/js/extra.js
index eb0cc12ff..be5a62105 100644
--- a/docs/content/assets/js/extra.js
+++ b/docs/content/assets/js/extra.js
@@ -1,4 +1,14 @@
 /* Highlight */
 (function(hljs) {
     hljs.initHighlightingOnLoad();
-})(hljs);
\ No newline at end of file
+})(hljs);
+
+/* Scarf Analytics - cookieless, anonymous company-level intelligence */
+(function() {
+    var img = document.createElement('img');
+    img.src = 'https://static.scarf.sh/a.png?x-pxid=1a49232a-b165-4015-8ed2-a1092f1f0d83';
+    img.referrerPolicy = 'no-referrer-when-downgrade';
+    img.loading = 'eager';
+    img.style.cssText = 'visibility:hidden;position:absolute;width:1px;height:1px;';
+    document.body.appendChild(img);
+})();
\ No newline at end of file
diff --git a/docs/content/contributing/data-collection.md b/docs/content/contributing/data-collection.md
index 645170b58..5153b038c 100644
--- a/docs/content/contributing/data-collection.md
+++ b/docs/content/contributing/data-collection.md
@@ -1,17 +1,72 @@
 ---
 title: "Traefik Data Collection Documentation"
-description: "To learn more about how Traefik is being used and improve it, we collect anonymous usage statistics from running instances. Read the technical documentation."
+description: "Learn what data Traefik shares, how it is used, and how you can control it. This documentation explains both version check and anonymous usage statistics data. Read the technical documentation."
 ---
 
 # Data Collection
 
-Understanding How Traefik is Being Used
+Understanding the data Traefik shares and how it is used
 {: .subtitle }
 
-## Configuration Example
+## Introduction
 
-Understanding how you use Traefik is very important to us: it helps us improve the solution in many different ways.
-For this very reason, the sendAnonymousUsage option is mandatory: we want you to take time to consider whether or not you wish to share anonymous data with us, so we can benefit from your experience and use cases.
+Protecting user privacy is essential to Traefik Labs, and we design every data-sharing mechanism with transparency and minimalism in mind.
+This page describes the two types of data exchanged by Traefik and how to configure them.
+
+For more details on how your data is handled, please refer to our [Privacy and Cookie Policy](https://traefik.io/legal/privacy-and-cookie-policy).
+
+## Configuration Overview
+
+Traefik provides two independent mechanisms:
+
+- `checkNewVersion`, enabled by default. You may disable it at any time.
+- `sendAnonymousUsage`, which requires explicit opt‑in.
+
+Examples below show how to activate or deactivate both of them.
+
+```yaml tab="YAML"
+global:
+  checkNewVersion: true      # set to false to disable
+  sendAnonymousUsage: false  # set to true to enable
+```
+
+```toml tab="TOML"
+[global]
+  checkNewVersion = true      # set to false to disable
+  sendAnonymousUsage = false  # set to true to enable
+```
+
+```bash tab="CLI"
+--global.checkNewVersion=true      # set to false to disable
+--global.sendAnonymousUsage=false  # set to true to enable
+```
+
+A log message at startup clearly indicates whether each of those options are enabled or disabled.
+
+## Version Check (`checkNewVersion`) – Opt-out
+
+Traefik periodically contacts `update.traefik.io` to determine whether a newer version is available.
+When this request is made, Traefik shares the **running version** and the **public IP** of the instance.
+The IP is used to build global usage statistics and does not influence the version comparison.
+
+This mechanism helps you stay informed about updates and provides TraefikLabs with a broad view of which versions are deployed in the wild.
+
+The collected IP addresses are also used for marketing purposes, specifically to detect companies running Traefik and offer them adapted support contracts, enterprise features, and tailored services.
+
+If you want to explore the implementation, you can read the version check source code: [version.go](https://github.com/traefik/traefik/blob/master/pkg/version/version.go)
+
+## Anonymous Usage Data (`sendAnonymousUsage`) – Opt‑in
+
+Traefik can also collect anonymous usage statistics once per day, starting 10 minutes after it starts running.  
+These statistics include:
+
+- the Traefik version,
+- a hash of the configuration,
+- an anonymized version of the static configuration (all sensitive fields removed: tokens, passwords, URLs, IP addresses, domains, emails, etc.).
+
+This feature comes from this [public proposal](https://github.com/traefik/traefik/issues/2369).
+
+This information helps TraefikLabs understand how Traefik is used in general and prioritize features and provider support accordingly. Dynamic configuration (routers and services) is never collected.
 
 !!! example "Enabling Data Collection"
 
@@ -32,21 +87,6 @@ For this very reason, the sendAnonymousUsage option is mandatory: we want you to
     --global.sendAnonymousUsage
     ```
 
-## Collected Data
-
-This feature comes from this [public proposal](https://github.com/traefik/traefik/issues/2369).
-
-In order to help us learn more about how Traefik is being used and improve it, we collect anonymous usage statistics from running instances.
-Those data help us prioritize our developments and focus on what's important for our users (for example, which provider is popular, and which is not).
-
-### What's collected / when ?
-
-Once a day (the first call begins 10 minutes after the start of Traefik), we collect:
-
-- the Traefik version number
-- a hash of the configuration
-- an **anonymized version** of the static configuration (token, username, password, URL, IP, domain, email, etc., are removed).
-
 !!! info
 
     - We do not collect the dynamic configuration information (routers & services).
@@ -93,8 +133,9 @@ providers:
       insecureSkipVerify: true
 ```
 
-## The Code for Data Collection
+### The Code for Anonymous Usage Collection
 
-If you want to dig into more details, here is the source code of the collecting system: [collector.go](https://github.com/traefik/traefik/blob/master/pkg/collector/collector.go)
+If you want to explore the implementation, you can read the collector source code:
+[collector.go](https://github.com/traefik/traefik/blob/master/pkg/collector/collector.go)
 
-By default, we anonymize all configuration fields, except fields tagged with `export=true`.
+Traefik anonymizes all configuration fields by default, except those explicitly marked with `export=true`.
diff --git a/docs/content/deprecation/releases.md b/docs/content/deprecation/releases.md
index c3ec3336a..1f3617fe8 100644
--- a/docs/content/deprecation/releases.md
+++ b/docs/content/deprecation/releases.md
@@ -6,25 +6,14 @@ Below is a non-exhaustive list of versions and their maintenance status:
 
 | Version | Release Date | Active Support     | Security Support  |
 |---------|--------------|--------------------|-------------------|
-| 3.5     | Jul 23, 2025 | Yes                | Yes               |
+| 3.6     | Nov 07, 2025 | Yes                | Yes               |
+| 3.5     | Jul 23, 2025 | Ended Nov 07, 2025 | No                |
 | 3.4     | May 05, 2025 | Ended Jul 23, 2025 | No                |
 | 3.3     | Jan 06, 2025 | Ended May 05, 2025 | No                |
 | 3.2     | Oct 28, 2024 | Ended Jan 06, 2025 | No                |
 | 3.1     | Jul 15, 2024 | Ended Oct 28, 2024 | No                |
 | 3.0     | Apr 29, 2024 | Ended Jul 15, 2024 | No                |
 | 2.11    | Feb 12, 2024 | Ended Apr 29, 2025 | Ends Feb 01, 2026 |
-| 2.10    | Apr 24, 2023 | Ended Feb 12, 2024 | No                |
-| 2.9     | Oct 03, 2022 | Ended Apr 24, 2023 | No                |
-| 2.8     | Jun 29, 2022 | Ended Oct 03, 2022 | No                |
-| 2.7     | May 24, 2022 | Ended Jun 29, 2022 | No                |
-| 2.6     | Jan 24, 2022 | Ended May 24, 2022 | No                |
-| 2.5     | Aug 17, 2021 | Ended Jan 24, 2022 | No                |
-| 2.4     | Jan 19, 2021 | Ended Aug 17, 2021 | No                |
-| 2.3     | Sep 23, 2020 | Ended Jan 19, 2021 | No                |
-| 2.2     | Mar 25, 2020 | Ended Sep 23, 2020 | No                |
-| 2.1     | Dec 11, 2019 | Ended Mar 25, 2020 | No                |
-| 2.0     | Sep 16, 2019 | Ended Dec 11, 2019 | No                |
-| 1.7     | Sep 24, 2018 | Ended Dec 31, 2021 | No                |
 
 ??? example "Active Support / Security Support"
 
diff --git a/docs/content/features/index.md b/docs/content/features/index.md
new file mode 100644
index 000000000..335b7408f
--- /dev/null
+++ b/docs/content/features/index.md
@@ -0,0 +1,148 @@
+---
+title: "Traefik Product Features Comparison"
+description: "Compare features across Traefik Proxy, Traefik Hub API Gateway (including AI Gateway capabilities), and Traefik Hub API Management to choose the right solution for your needs."
+---
+
+# Traefik Product Features Comparison
+
+The Traefik ecosystem offers multiple products designed to meet different requirements, from basic reverse proxy functionality to comprehensive API management and AI gateway capabilities. This comparison matrix helps you understand the features available in each product and choose the right solution for your use case.
+
+## Product Overview
+
+- **Traefik Proxy** is the open-source application proxy that serves as the foundation for all Traefik products. It provides essential reverse proxy, load balancing, and service discovery capabilities.
+
+- **[Traefik Hub API Gateway](https://traefik.io/solutions/api-gateway/)** builds on Traefik Proxy with enterprise-grade security, distributed features, and advanced access control for cloud-native API gateway scenarios. It includes **AI Gateway capabilities** that transform any AI endpoint into a managed API.
+
+- **[Traefik Hub API Management](https://traefik.io/solutions/api-management/)** adds comprehensive API lifecycle management, developer portals, and organizational features for teams managing multiple APIs across environments.
+
+- **[Traefik AI Gateway](https://traefik.io/solutions/ai-gateway/)** transforms any AI endpoint into a managed API with unified access to multiple LLMs, centralized credential management, semantic caching, local inferencing, and comprehensive AI governance features.
+
+- **[Traefik MCP Gateway](https://traefik.io/solutions/mcp-gateway/)** provides secure, governed access to Model Context Protocol (MCP) servers for AI agents with task-based access control (TBAC), session-smart routing, and comprehensive audit capabilities for enterprise AI workflows.
+
+## Features Matrix
+
+| Feature | Traefik Proxy | Traefik Hub API Gateway | Traefik Hub API Management |
+|---------|---------------|------------------------|---------------------------|
+| **Core Networking** | | | | 
+| Services Auto-Discovery | ✓ | ✓ | ✓ |
+| Graceful Configuration Reload | ✓ | ✓ | ✓ |
+| Websockets, HTTP/2, HTTP/3, TCP, UDP, GRPC | ✓ | ✓ | ✓ |
+| Real-time Logs, Access Logs, Metrics & Distributed Tracing | ✓ | ✓ | ✓ |
+| Canary Deployments | ✓ | ✓ | ✓ |
+| Let's Encrypt | ✓ | ✓ | ✓ |
+| **Plugin Ecosystem** | | | |
+| [Plugin Support](https://plugins.traefik.io/plugins) ([Go](https://github.com/traefik/yaegi), [WASM](https://webassembly.org/)) | ✓ | ✓ | ✓ |
+| **Deployment & Operations** | | | |
+| Hybrid cloud, multi-cloud & on-prem compatible | ✓ | ✓ | ✓ |
+| Per-cluster dashboard | ✓ | ✓ | ✓ |
+| GitOps-native declarative configuration | ✓ | ✓ | ✓ |
+| **Authentication & Authorization** | | | |
+| JWT Authentication | ✗ | ✓ | ✓ |
+| OAuth 2.0 Token Introspection Authentication | ✗ | ✓ | ✓ |
+| OAuth 2.0 Client Credentials Authentication | ✗ | ✓ | ✓ |
+| OpenID Connect Authentication | ✗ | ✓ | ✓ |
+| Lightweight Directory Access Protocol (LDAP) | ✗ | ✓ | ✓ |
+| API Key Authentication | ✗ | ✓ | ✓ |
+| **Security & Policy** | | | |
+| Open Policy Agent | ✗ | ✓ | ✓ |
+| Native Coraza Web Application Firewall (WAF) | ✗ | ✓ | ✓ |
+| HashiCorp Vault Integration | ✗ | ✓ | ✓ |
+| **Distributed Features** | | | |
+| Distributed Let's Encrypt | ✗ | ✓ | ✓ |
+| Distributed Rate Limit | ✗ | ✓ | ✓ |
+| HTTP Caching | ✗ | ✓ | ✓ |
+| **Compliance** | | | |
+| FIPS 140-2 Compliance (Linux & Windows) | ✗ | ✓ | ✓ |
+| **AI Gateway Capabilities** | | | |
+| Unified Multi-LLM API Access | ✗ | ✓ | ✓ |
+| Centralized AI Credential Management | ✗ | ✓ | ✓ |
+| AI Provider Flexibility (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, etc.) | ✗ | ✓ | ✓ |
+| Semantic Caching for AI Responses | ✗ | ✓ | ✓ |
+| Content Guard & PII Protection | ✗ | ✓ | ✓ |
+| AI-specific Observability & OpenTelemetry Integration | ✗ | ✓ | ✓ |
+| Support for Local/Self-hosted LLMs & Inference (Ollama, Mistral, etc.) | ✗ | ✓ | ✓ |
+| **MCP Gateway Capabilities** | | | |
+| Task-Based Access Control (TBAC) for AI Agents | ✗ | ✓ | ✓ |
+| MCP Servers Governance | ✗ | ✓ | ✓ |
+| Session-Smart Load Balancing for Agent Workflows | ✗ | ✓ | ✓ |
+| OAuth 2.1 / 2.0 Resource Server for MCP | ✗ | ✓ | ✓ |
+| Fine-grained Policy Enforcement for AI Tools | ✗ | ✓ | ✓ |
+| Audit-ready Observability for Agent Interactions | ✗ | ✓ | ✓ |
+| **API Management** | | | |
+| Flexible API grouping and versioning | ✗ | ✗ | ✓ |
+| API Developer Portal | ✗ | ✗ | ✓ |
+| OpenAPI Specifications Support | ✗ | ✗ | ✓ |
+| Multi-cluster dashboard | ✗ | ✗ | ✓ |
+| Built-in identity provider (or use your own) | ✗ | ✗ | ✓ |
+| Configuration linter & change impact analysis | ✗ | ✗ | ✓ |
+| Pre-built Grafana dashboards | ✗ | ✗ | ✓ |
+| Event correlation for quick incident mitigation | ✗ | ✗ | ✓ |
+| Traffic debugger  | ✗ | ✓ | ✓ |
+| **Support** | | | |
+| Built-In Commercial Support | Add-on | ✓ | ✓ |
+
+## Choosing the Right Product
+
+### Start with Traefik Proxy
+
+Traefik Proxy is the ideal starting point for organizations looking for a reliable, open-source application proxy with essential networking capabilities. Deploy it as your default ingress tier if you need:
+
+- Basic reverse proxy and load balancing
+- Service discovery for containerized applications
+- Simple TLS termination and Let's Encrypt integration
+- Cost-effective solution with community support (can upgrade to Traefik Hub for more features)
+
+### Upgrade to Traefik Hub API Gateway
+
+Traefik Hub API Gateway layers enterprise security, distributed coordination, and AI Gateway capabilities on top of Traefik Proxy. Upgrade to it when you need:
+
+- Enterprise security requirements (JWT, OIDC, LDAP)
+- Distributed deployments across multiple clusters
+- Advanced rate limiting and caching
+- WAF and policy enforcement
+- AI Gateway capabilities
+- Commercial support
+
+### Consider Traefik AI Gateway
+
+Traefik AI Gateway unifies hosted and self-hosted LLM access under centralized control and observability. Consider it if you have:
+
+- Multi-LLM applications requiring unified API access
+- Organizations using multiple AI providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, etc.)
+- Local/self-hosted LLM deployments (Ollama, Mistral)
+- Centralized AI credential and security management
+- Cost optimization through semantic caching
+- PII protection and content filtering for AI interactions
+- Comprehensive AI observability and compliance requirements
+
+### Choose Traefik MCP Gateway
+
+Traefik MCP Gateway governs how AI agents interact with Model Context Protocol servers through task-aware policies and session-smart routing. Choose it if you need:
+
+- AI agent deployments requiring secure access to MCP servers
+- Task-based access control (TBAC) for AI workflows
+- Governance of Model Context Protocol interactions
+- Session-smart routing for long-running agent conversations
+- OAuth 2.1 / 2.0 compliant MCP server protection
+- Audit-ready observability for AI agent activities
+- Fine-grained policy enforcement for AI tools and resources
+
+### Choose Traefik Hub API Management
+
+Traefik Hub API Management extends the gateway foundation with API lifecycle tooling, developer experience features, and governance workflows. Choose it when you have:
+
+- Multiple APIs requiring centralized management
+- Developer teams needing self-service portals
+- Complex API versioning and lifecycle requirements
+- Multi-cluster environments requiring unified dashboards
+- Compliance and governance needs
+
+## Migration Path
+
+The Traefik ecosystem is designed for seamless upgrades. You can start with Traefik Proxy and add capabilities as your requirements grow:
+
+1. **Traefik Proxy** → **Hub API Gateway**: Add enterprise security, distributed features, and AI Gateway capabilities
+2. **Hub API Gateway** → **Hub API Management**: Add comprehensive API management and governance features
+3. **MCP Gateway**: Specialized solution for AI agent governance and Model Context Protocol management
+
+All products share the same core configuration concepts, making migration straightforward while preserving your existing configurations and operational knowledge.
diff --git a/docs/content/getting-started/concepts.md b/docs/content/getting-started/concepts.md
index 21e1817f7..a2bd774f8 100644
--- a/docs/content/getting-started/concepts.md
+++ b/docs/content/getting-started/concepts.md
@@ -57,4 +57,4 @@ You no longer need to create and synchronize configuration files cluttered with
     Traefik is able to use your cluster API to discover the services and read the attached information.
     In Traefik, these connectors are called [providers](../providers/overview.md "Link to overview about Traefik providers") because they *provide* the configuration to Traefik.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/getting-started/configuration-overview.md b/docs/content/getting-started/configuration-overview.md
index 728004225..6aa4a7928 100644
--- a/docs/content/getting-started/configuration-overview.md
+++ b/docs/content/getting-started/configuration-overview.md
@@ -1,6 +1,6 @@
 ---
 title: "Traefik Configuration Documentation"
-description: "Get started with Traefik Proxy. This page will introduce you to the dynamic routing and startup configurations. Read the technical documentation."
+description: "Get started with Traefik Proxy. This page will introduce you to the routing and install configurations. Read the technical documentation."
 ---
 
 # Configuration Introduction
@@ -8,39 +8,37 @@ description: "Get started with Traefik Proxy. This page will introduce you to th
 How the Magic Happens
 {: .subtitle }
 
-![Configuration](../assets/img/static-dynamic-configuration.png)
-
 Configuration in Traefik can refer to two different things:
 
-- The fully dynamic routing configuration (referred to as the _routing configuration_, formerly known as the _dynamic configuration_)
-- The startup configuration (referred to as the _install configuration_, formerly known as the _static configuration_)
+- The install (startup) configuration (formerly known as the _static configuration_)
+- The routing configuration (formerly known as the _dynamic configuration_)
 
-Elements in the install configuration_ set up connections to [providers](../providers/overview.md) and define the [entrypoints](../routing/entrypoints.md) Traefik will listen to (these elements don't change often).
+Elements in the _install configuration_ set up connections to [providers](../providers/overview.md) and define the [entrypoints](../routing/entrypoints.md) Traefik will listen to (these elements don't change often).
 
-The _dynamic configuration_ contains everything that defines how the requests are handled by your system.
+The _routing configuration_ contains everything that defines how the requests are handled by your system.
 This configuration can change and is seamlessly hot-reloaded, without any request interruption or connection loss.
 
 !!! warning "Incompatible Configuration"
     Please be aware that the old configurations for Traefik v1.x are NOT compatible with the v2.x config as of now.
     If you are running v2, please ensure you are using a v2 configuration.
 
-## The Dynamic Configuration
+## The Routing Configuration
 
-Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): whether an orchestrator, a service registry, or a plain old configuration file.
+Traefik gets its _routing configuration_ from [providers](../providers/overview.md): whether an orchestrator, a service registry, or a plain old configuration file.
 
 Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../routing/overview.md).
 
 !!! info ""
 
-    In the [Quick Start example](../getting-started/quick-start.md), the routing configuration comes from docker in the form of labels attached to your containers.
+    In the [Quick Start example](../getting-started/docker.md), the whoami application routing configuration comes from docker in the form of a label attached to the whoami container.
 
 !!! info "HTTPS Certificates also belong to the routing configuration."
 
     You can add / update / remove them without restarting your Traefik instance.
 
-## The Static Configuration
+## The Install Configuration
 
-There are three different, **mutually exclusive** (i.e. you can use only one at the same time), ways to define static configuration options in Traefik:
+There are three different, **mutually exclusive** (i.e. you can use only one at the same time), ways to define install configuration options in Traefik:
 
 1. In a configuration file
 1. In the command-line arguments
@@ -56,7 +54,7 @@ Once positioned, this option sets (and resets) all the default values of the sub
 
 ### Configuration File
 
-At startup, Traefik searches for static configuration in a file named `traefik.yml` (or `traefik.yaml` or `traefik.toml`) in:
+At startup, Traefik searches for install configuration in a file named `traefik.yml` (or `traefik.yaml` or `traefik.toml`) in:
 
 - `/etc/traefik/`
 - `$XDG_CONFIG_HOME/`
@@ -79,14 +77,14 @@ traefik --help
 # or
 
 docker run traefik[:version] --help
-# ex: docker run traefik:v3.5 --help
+# ex: docker run traefik:v3.6 --help
 ```
 
 Check the [CLI reference](../reference/install-configuration/configuration-options.md "Link to CLI reference overview") for an overview about all available arguments.
 
 ### Environment Variables
 
-All available environment variables can be found in the [static configuration environment overview](../reference/install-configuration/configuration-options.md).
+All available environment variables can be found in the [install configuration environment overview](../reference/install-configuration/configuration-options.md).
 
 ## Available Configuration Options
 
@@ -94,4 +92,4 @@ All the configuration options are documented in their related section.
 
 You can browse the available features in the menu, the [providers](../providers/overview.md), or the [routing section](../routing/overview.md) to see them in action.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/getting-started/docker.md b/docs/content/getting-started/docker.md
index 6cd151b32..028fb9670 100644
--- a/docs/content/getting-started/docker.md
+++ b/docs/content/getting-started/docker.md
@@ -36,7 +36,7 @@ This configuration:
 # docker-compose.yml
 services:
   traefik:
-    image: traefik:v3.5
+    image: traefik:v3.6
     command:
       - "--api.insecure=true"
       - "--providers.docker=true"
@@ -84,7 +84,7 @@ docker run -d \
   -p 8080:8080 \
   -v $PWD/traefik.yml:/etc/traefik/traefik.yml \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  traefik:v3.5
+  traefik:v3.6
 ```
 
 ## Expose the Dashboard
@@ -159,4 +159,4 @@ That's it! You've successfully deployed Traefik and configured routing in Docker
 - [Enable Metrics](../reference/install-configuration/observability/metrics.md)
 - [Learn more about Docker provider](../reference/install-configuration/providers/docker.md)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/getting-started/faq.md b/docs/content/getting-started/faq.md
index a64e04186..e808c4211 100644
--- a/docs/content/getting-started/faq.md
+++ b/docs/content/getting-started/faq.md
@@ -252,4 +252,4 @@ In which case, you should make sure your infrastructure is properly set up for a
 LEGO_DISABLE_CNAME_SUPPORT=true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/getting-started/install-traefik.md b/docs/content/getting-started/install-traefik.md
index 920db9530..54d3edad5 100644
--- a/docs/content/getting-started/install-traefik.md
+++ b/docs/content/getting-started/install-traefik.md
@@ -16,12 +16,12 @@ You can install Traefik with the following flavors:
 
 Choose one of the [official Docker images](https://hub.docker.com/_/traefik) and run it with one sample configuration file:
 
-* [YAML](https://raw.githubusercontent.com/traefik/traefik/v3.5/traefik.sample.yml)
-* [TOML](https://raw.githubusercontent.com/traefik/traefik/v3.5/traefik.sample.toml)
+* [YAML](https://raw.githubusercontent.com/traefik/traefik/v3.6/traefik.sample.yml)
+* [TOML](https://raw.githubusercontent.com/traefik/traefik/v3.6/traefik.sample.toml)
 
 ```shell
 docker run -d -p 8080:8080 -p 80:80 \
-    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v3.5
+    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v3.6
 ```
 
 For more details, go to the [Docker provider documentation](../providers/docker.md)
@@ -29,7 +29,7 @@ For more details, go to the [Docker provider documentation](../providers/docker.
 !!! tip
 
     * Prefer a fixed version than the latest that could be an unexpected version.
-    ex: `traefik:v3.5`
+    ex: `traefik:v3.6`
     * Docker images are based from the [Alpine Linux Official image](https://hub.docker.com/_/alpine).
     * Any orchestrator using docker images can fetch the official Traefik docker image.
 
@@ -144,4 +144,4 @@ And run it:
 
 All the details are available in the [Contributing Guide](../contributing/building-testing.md)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/getting-started/kubernetes.md b/docs/content/getting-started/kubernetes.md
index 1c85e6d12..882360547 100644
--- a/docs/content/getting-started/kubernetes.md
+++ b/docs/content/getting-started/kubernetes.md
@@ -331,4 +331,4 @@ That's it! You've successfully deployed Traefik and configured routing in a Kube
 - [Learn more about Kubernetes CRD provider](../reference/install-configuration/providers/kubernetes/kubernetes-crd.md)
 - [Learn more about Kubernetes Gateway API provider](../reference/install-configuration/providers/kubernetes/kubernetes-gateway.md)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/https/acme.md b/docs/content/https/acme.md
index 63680ea68..aa3b8ecec 100644
--- a/docs/content/https/acme.md
+++ b/docs/content/https/acme.md
@@ -201,6 +201,36 @@ when using the `TLS-ALPN-01` challenge, Traefik must be reachable by Let's Encry
     --certificatesresolvers.myresolver.acme.tlschallenge=true
     ```
 
+#### `Delay`
+
+_Optional, Default=0_
+
+The delay between the creation of the challenge and the validation.
+A value lower than or equal to zero means no delay.
+
+```yaml tab="File (YAML)"
+certificatesResolvers:
+  myresolver:
+    acme:
+      # ...
+      tlsChallenge:
+        # ...
+        delay: 12
+```
+
+```toml tab="File (TOML)"
+[certificatesResolvers.myresolver.acme]
+  # ...
+  [certificatesResolvers.myresolver.acme.tlsChallenge]
+    # ...
+    delay = 12
+```
+
+```bash tab="CLI"
+# ...
+--certificatesresolvers.myresolver.acme.tlschallenge.delay=12
+```
+
 ### `httpChallenge`
 
 Use the `HTTP-01` challenge to generate and renew ACME certificates by provisioning an HTTP resource under a well-known URI.
@@ -252,6 +282,8 @@ when using the `HTTP-01` challenge, `certificatesresolvers.myresolver.acme.httpc
 
 #### `Delay`
 
+_Optional, Default=0_
+
 The delay between the creation of the challenge and the validation.
 A value lower than or equal to zero means no delay.
 
@@ -1004,6 +1036,39 @@ certificatesResolvers:
 # ...
 ```
 
+### `disableCommonName`
+
+_Optional, Default=false_
+
+Disable common name inside CSR and certificates.
+
+It's recommended to disable the common name and required to get a certificate for IP.
+
+- https://letsencrypt.org/docs/profiles/#certificate-common-name
+- https://community.letsencrypt.org/t/ip-san-error-csr-contains-ip-address-in-common-name/239012/7
+
+```yaml tab="File (YAML)"
+certificatesResolvers:
+  myresolver:
+    acme:
+      # ...
+      disableCommonName: true
+      # ...
+```
+
+```toml tab="File (TOML)"
+[certificatesResolvers.myresolver.acme]
+  # ...
+  disableCommonName = true
+  # ...
+```
+
+```bash tab="CLI"
+# ...
+--certificatesresolvers.myresolver.acme.disableCommonName=true
+# ...
+```
+
 ### `keyType`
 
 _Optional, Default="RSA4096"_
@@ -1146,4 +1211,4 @@ If Let's Encrypt is not reachable, the following certificates will apply:
 !!! important
     For new (sub)domains which need Let's Encrypt authentication, the default Traefik certificate will be used until Traefik is restarted.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/https/overview.md b/docs/content/https/overview.md
index 9261d0db8..ae07504d9 100644
--- a/docs/content/https/overview.md
+++ b/docs/content/https/overview.md
@@ -20,4 +20,4 @@ That is to say, how to obtain [TLS certificates](./tls.md#certificates-definitio
 either through a definition in the dynamic configuration, or through [Let's Encrypt](./acme.md) (ACME).
 And how to configure [TLS options](./tls.md#tls-options), and [certificates stores](./tls.md#certificates-stores).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/https/tls.md b/docs/content/https/tls.md
index 6b48e8e46..abda2dd93 100644
--- a/docs/content/https/tls.md
+++ b/docs/content/https/tls.md
@@ -587,4 +587,4 @@ spec:
   disableSessionTickets: true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/index.md b/docs/content/index.md
index de8516356..e8ebfc818 100644
--- a/docs/content/index.md
+++ b/docs/content/index.md
@@ -11,6 +11,8 @@ Traefik is an [open-source](https://github.com/traefik/traefik) Application Prox
 
 If you start with Traefik for service discovery and routing, you can seamlessly add [API management](https://traefik.io/solutions/api-management/), [API gateway](https://traefik.io/solutions/api-gateway/), [AI gateway](https://traefik.io/solutions/ai-gateway/), and [API mocking](https://traefik.io/solutions/api-mocking/) capabilities as needed.
 
+For a detailed comparison of all Traefik products and their capabilities, see our [Product Features Comparison](./features/).
+
 With 3.3 billion downloads and over 55k stars on GitHub, Traefik is used globally across hybrid cloud, multi-cloud, on prem, and bare metal environments running Kubernetes, Docker Swarm, AWS, [the list goes on](https://doc.traefik.io/traefik/reference/install-configuration/providers/overview/).
 
 Here’s how it works—Traefik receives requests on behalf of your system, identifies which components are responsible for handling them, and routes them securely. It automatically discovers the right configuration for your services by inspecting your infrastructure to identify relevant information and which service serves which request.
diff --git a/docs/content/middlewares/http/basicauth.md b/docs/content/middlewares/http/basicauth.md
index 75d3a9a0c..f7017842e 100644
--- a/docs/content/middlewares/http/basicauth.md
+++ b/docs/content/middlewares/http/basicauth.md
@@ -340,4 +340,4 @@ http:
     removeHeader = true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/http/forwardauth.md b/docs/content/middlewares/http/forwardauth.md
index 5f60cd138..81bbcedd5 100644
--- a/docs/content/middlewares/http/forwardauth.md
+++ b/docs/content/middlewares/http/forwardauth.md
@@ -785,4 +785,4 @@ http:
   preserveRequestMethod = true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/http/headers.md b/docs/content/middlewares/http/headers.md
index 419642391..a302d6231 100644
--- a/docs/content/middlewares/http/headers.md
+++ b/docs/content/middlewares/http/headers.md
@@ -422,4 +422,4 @@ Set `isDevelopment` to `true` when developing to mitigate the unwanted effects o
 Usually testing takes place using HTTP, not HTTPS, and on `localhost`, not your production domain.
 If you would like your development environment to mimic production with complete Host blocking, SSL redirects, and STS headers, leave this as `false`.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/http/overview.md b/docs/content/middlewares/http/overview.md
index cb40c56b4..27f0d4fd2 100644
--- a/docs/content/middlewares/http/overview.md
+++ b/docs/content/middlewares/http/overview.md
@@ -127,4 +127,4 @@ http:
 
 Please take a look at the community-contributed plugins in the [plugin catalog](https://plugins.traefik.io/plugins).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/http/redirectregex.md b/docs/content/middlewares/http/redirectregex.md
index 5488117db..a28fa0ada 100644
--- a/docs/content/middlewares/http/redirectregex.md
+++ b/docs/content/middlewares/http/redirectregex.md
@@ -85,4 +85,4 @@ The `replacement` option defines how to modify the URL to have the new target UR
 
     Care should be taken when defining replacement expand variables: `$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/http/stripprefix.md b/docs/content/middlewares/http/stripprefix.md
index 5c985b243..a68e813fc 100644
--- a/docs/content/middlewares/http/stripprefix.md
+++ b/docs/content/middlewares/http/stripprefix.md
@@ -146,4 +146,4 @@ http:
     forceSlash = false
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/middlewares/overview.md b/docs/content/middlewares/overview.md
index 92be4ecda..5a2971791 100644
--- a/docs/content/middlewares/overview.md
+++ b/docs/content/middlewares/overview.md
@@ -112,4 +112,4 @@ A list of HTTP middlewares can be found [here](http/overview.md).
 
 A list of TCP middlewares can be found [here](tcp/overview.md).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/migrate/nginx-to-traefik.md b/docs/content/migrate/nginx-to-traefik.md
new file mode 100644
index 000000000..a91c862c8
--- /dev/null
+++ b/docs/content/migrate/nginx-to-traefik.md
@@ -0,0 +1,678 @@
+---
+title: "Migrate from Ingress NGINX Controller to Traefik"
+description: "Step-by-step guide to migrate from Kubernetes Ingress NGINX Controller to Traefik with zero downtime and annotation compatibility."
+---
+
+# Migrate from Ingress NGINX Controller to Traefik
+
+How to migrate from Ingress NGINX Controller to Traefik with zero downtime.
+{: .subtitle }
+
+---
+
+!!! danger "Ingress NGINX Controller Retirement"
+
+    The Kubernetes Ingress NGINX Controller project has announced its retirement in **March 2026**. After this date:
+
+    - No new releases or updates
+    - No security patches
+    - No bug fixes
+
+    For more information, see the [official Kubernetes blog announcement](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement).
+
+## What You Will Achieve
+
+By completing this migration, your existing Ingress resources will work with Traefik without any modifications. The Traefik Kubernetes Ingress NGINX Provider automatically translates NGINX annotations into Traefik configuration:
+
+```yaml tab="Your Existing Ingress (No Changes Needed)"
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: myapp
+  annotations:
+    # These NGINX annotations are automatically translated by Traefik
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: "https://example.com"
+    nginx.ingress.kubernetes.io/affinity: "cookie"
+    nginx.ingress.kubernetes.io/session-cookie-name: "route"
+spec:
+  ingressClassName: nginx  # ← Traefik will watch this class
+  rules:
+    - host: myapp.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  number: 80
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whoami
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: traefik/whoami
+          ports:
+            - containerPort: 80
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+spec:
+  selector:
+    app: whoami
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+```
+
+For a complete list of supported annotations and behavioral differences, see the [Ingress NGINX Routing Configuration](../reference/routing-configuration/kubernetes/ingress-nginx.md) documentation.
+
+!!! info "Traefik Version Requirement"
+
+    The Kubernetes Ingress NGINX provider requires **Traefik v3.6.2 or later**.
+
+---
+
+## Prerequisites
+
+Before starting the migration, ensure you have:
+
+- **Existing Ingress NGINX Controller** running in your Kubernetes cluster
+- **Kubernetes cluster access** with `kubectl` configured 
+- **Cluster support for running multiple LoadBalancer services** on ports 80/443 simultaneously
+- **Helm**
+- **Cluster admin permissions** to create RBAC resources
+- **Backup of critical configurations** (Ingress resources, ConfigMaps, Secrets)
+
+!!! tip "Backup Recommendations"
+
+    ```bash
+    # Export all Ingress resources
+    kubectl get ingress --all-namespaces -o yaml > ingress-backup.yaml
+
+    # Export NGINX ConfigMaps
+    kubectl get configmap --all-namespaces -l app.kubernetes.io/name=ingress-nginx -o yaml > nginx-configmaps.yaml
+    ```
+
+---
+
+## Migration Strategy Overview
+
+This migration achieves **zero downtime** by running Traefik alongside NGINX. Both controllers serve the same Ingress resources simultaneously, allowing you to progressively shift traffic before removing NGINX.
+
+```text
+Current:     DNS → LoadBalancer → NGINX → Your Services
+
+Migration:   DNS → LoadBalancer → NGINX  → Your Services
+                 → LoadBalancer → Traefik → Your Services
+
+Final:       DNS → LoadBalancer → Traefik → Your Services
+```
+
+**Migration Flow:**
+
+1. Install Traefik alongside NGINX (both serving traffic in parallel)
+2. Add Traefik LoadBalancer to DNS (if you choose DNS option; cf. step 3)
+3. Progressively shift traffic from NGINX to Traefik
+4. Remove NGINX from DNS, preserve the IngressClass, and uninstall
+
+---
+
+## Step 1: Install Traefik Alongside NGINX
+
+??? info "Install Ingress NGINX Controller"
+
+    If you have not installed Ingress NGINX Controller yet, you can set up a fresh Ingress NGINX Controller installation following the instructions below:
+
+    ### Install Ingress NGINX Controller
+
+    ```bash
+    helm upgrade --install ingress-nginx ingress-nginx \
+      --repo https://kubernetes.github.io/ingress-nginx \
+      --namespace ingress-nginx --create-namespace
+    ```
+Install Traefik with the Kubernetes Ingress NGINX provider enabled. Both controllers will serve the same Ingress resources simultaneously.
+
+### Add Traefik Helm Repository
+
+```bash
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+```
+
+### Install Traefik
+
+```bash
+helm upgrade --install traefik traefik/traefik \
+  --namespace traefik --create-namespace \
+  --set providers.kubernetesIngressNginx.enabled=true
+```
+
+Or using a [values file](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/VALUES.md) for more configuration:
+
+```yaml tab="traefik-values.yaml"
+...
+providers:
+  kubernetesIngressNginx:
+    enabled: true
+ ...
+```
+
+```bash
+helm upgrade --install traefik traefik/traefik \
+  --namespace traefik --create-namespace \
+  --values traefik-values.yaml
+```
+
+### Verify Both Controllers Are Running
+
+```bash
+# Check NGINX pods
+kubectl get pods -n ingress-nginx
+
+# Check Traefik pods
+kubectl get pods -n traefik
+
+# Check both services have LoadBalancer IPs
+kubectl get svc -n ingress-nginx ingress-nginx-controller
+kubectl get svc -n traefik traefik
+```
+
+At this point, both NGINX and Traefik are running and can serve the same Ingress resources. Traffic is still flowing only through NGINX since DNS points to the NGINX LoadBalancer.
+
+---
+
+## Step 2: Verify Traefik Is Handling Traffic
+
+Before adding Traefik to DNS, verify it correctly serves your Ingress resources.
+
+### Test via Traefik's LoadBalancer IP
+
+Get Traefik's LoadBalancer IP and use `--resolve` to test without changing DNS:
+
+```bash
+# Get LoadBalancer IPs
+NGINX_IP=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ $ing := index .status.loadBalancer.ingress 0 }}{{ if $ing.ip }}{{ $ing.ip }}{{ else }}{{ $ing.hostname }}{{ end }}')
+TRAEFIK_IP=$(kubectl get svc -n traefik traefik -o go-template='{{ $ing := index .status.loadBalancer.ingress 0 }}{{ if $ing.ip }}{{ $ing.ip }}{{ else }}{{ $ing.hostname }}{{ end }}')
+echo -e "Nginx IP: $NGINX_IP\nTraefik IP: $TRAEFIK_IP"
+
+# Test HTTP for both
+FQDN=myapp.example.com
+# Observe HTTPS redirections:
+curl --connect-to "${FQDN}:80:${NGINX_IP}:80" "http://${FQDN}" -D -
+curl --connect-to "${FQDN}:80:${TRAEFIK_IP}:80" "http://${FQDN}" -D - # note X-Forwarded-Server which should be traefik
+
+# Test HTTPS
+curl --connect-to "${FQDN}:443:${NGINX_IP}:443" "https://${FQDN}"
+curl --connect-to "${FQDN}:443:${TRAEFIK_IP}:443" "https://${FQDN}"
+```
+
+!!! warning "TLS Certificates During Migration"
+
+    Both NGINX and Traefik must serve valid TLS certificates for HTTPS tests to succeed. Since Traefik is not publicly exposed during this verification phase, **Let's Encrypt HTTP challenge will not work**.
+
+    Your options for TLS certificates during migration:
+
+    - **Existing certificates via `tls.secretName`** - If you use cert-manager or another external tool, your existing TLS secrets referenced in `spec.tls` will work with both controllers
+    - **Let's Encrypt DNS challenge** - Configure Traefik's [ACME DNS challenge](../reference/install-configuration/tls/certificate-resolvers/acme.md#dnschallenge) to obtain certificates without public exposure
+
+    Avoid using `curl -k` (skip certificate verification) as this masks TLS configuration issues that could cause problems after migration.
+
+### Verify Ingress Discovery
+
+Check Traefik logs to confirm it discovered your Ingress resources:
+
+```bash
+kubectl logs -n traefik deployment/traefik | grep -i "ingress"
+```
+
+---
+
+## Step 3: Shift Traffic to Traefik
+
+With both controllers running and verified, progressively shift traffic from NGINX to Traefik.
+
+### Option A: DNS-Based Migration
+
+Add the Traefik LoadBalancer IP to your DNS records alongside NGINX. This allows both controllers to receive traffic.
+
+**Get LoadBalancer addresses:**
+
+```bash
+# NGINX LoadBalancer
+echo $(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ $ing := index .status.loadBalancer.ingress 0 }}{{ if $ing.ip }}{{ $ing.ip }}{{ else }}{{ $ing.hostname }}{{ end }}')
+
+# Traefik LoadBalancer
+echo $(kubectl get svc -n traefik traefik -o go-template='{{ $ing := index .status.loadBalancer.ingress 0 }}{{ if $ing.ip }}{{ $ing.ip }}{{ else }}{{ $ing.hostname }}{{ end }}')
+```
+
+**Progressive DNS migration:**
+
+1. **Add Traefik to DNS** - Add the Traefik LoadBalancer IP to your DNS records (both IPs now receive traffic via round-robin)
+2. **Monitor** - Observe traffic patterns on both controllers
+3. **Remove NGINX from DNS** - Once confident, remove the NGINX LoadBalancer IP from DNS
+4. **Wait for DNS propagation** - Allow time for DNS caches to expire
+5. **Uninstall NGINX** - Proceed to [Step 4](#step-4-uninstall-ingress-nginx-controller)
+
+!!! warning "DNS TTL May Not Be Respected"
+
+    Some ISPs ignore DNS TTL values to reduce traffic costs, caching records longer than specified. After removing NGINX from DNS, keep NGINX running for at least 24-48 hours before uninstalling to avoid dropping traffic from users whose ISPs have stale DNS caches.
+
+??? info "ExternalDNS Users"
+
+    If you use [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) to automatically manage DNS records based on Ingress status, both NGINX and Traefik will compete to update the Ingress status with their LoadBalancer IPs when `publishService` is enabled. Traefik typically wins because it updates faster, which can cause unexpected traffic shifts.
+
+    **Recommended approach for ExternalDNS:**
+
+    1. **[Install Traefik](#step-1-install-traefik-alongside-nginx) with `publishService` disabled**:
+
+        ```yaml
+        # traefik-values.yaml
+        providers:
+          kubernetesIngressNginx:
+            enabled: true
+            publishService:
+              enabled: false  # Disable to prevent status updates
+        ```
+
+    2. **Test Traefik** using [port-forward](#step-2-verify-traefik-is-handling-traffic) or a separate test hostname
+
+    3. **Switch DNS via NGINX** - Configure NGINX to publish Traefik's service address:
+
+        ```yaml
+        # nginx-values.yaml
+        controller:
+          publishService:
+            pathOverride: "traefik/traefik"  # Points to Traefik's service
+        ```
+
+        This makes NGINX update the Ingress status with Traefik's LoadBalancer IP, causing ExternalDNS to point traffic to Traefik.
+
+    4. **Verify traffic flows through Traefik** - At this point, you can still rollback by removing the `pathOverride`
+
+    5. **[Enable `publishService` on Traefik](#step-1-install-traefik-alongside-nginx)** and [uninstall NGINX](#step-5-uninstall-nginx-ingress-controller)
+
+### Option B: External Load Balancer with Weighted Traffic
+
+For more control over traffic distribution, use an external load balancer (like Traefik, Cloudflare, AWS ALB, or a dedicated load balancer) in front of both Kubernetes LoadBalancers.
+
+!!! note "Infrastructure Prerequisite"
+
+    This option assumes you already have an external load balancer in your infrastructure, or are willing to set one up **before** starting the migration. Adding an external load balancer is a significant infrastructure change that should be planned and tested separately from the ingress controller migration.
+
+**Setup:**
+
+1. Create an external load balancer pointing to the NGINX Kubernetes LoadBalancer
+2. Update DNS to point to the external load balancer
+3. Add the Traefik Kubernetes LoadBalancer to the external load balancer with a low weight (e.g., 10%)
+4. Gradually increase Traefik's weight while decreasing NGINX's weight
+5. Once NGINX receives no traffic, uninstall it
+
+**Example weight progression:**
+
+| Phase | NGINX Weight | Traefik Weight | Duration |
+|-------|-------------|----------------|----------|
+| Initial | 100% | 0% | - |
+| Start | 90% | 10% | 1 hour |
+| Increase | 50% | 50% | 2 hour |
+| Near-complete | 10% | 90% | 4 hour |
+| Final | 0% | 100% | - |
+
+!!! tip "External Load Balancer Options"
+
+    - **Cloudflare Load Balancing** - Traffic steering with health checks
+    - **AWS Global Accelerator** - Weighted routing across endpoints
+    - **Google Cloud Load Balancing** - Traffic splitting
+    - **Traefik / HAProxy / NGINX (external)** - Self-hosted option with weighted backends
+    - ...
+
+### LoadBalancer IP Retention
+
+If you want Traefik to eventually use the same LoadBalancer IP as NGINX (to simplify DNS management), you can transfer the IP after the migration. Since Traefik is already running with its own LoadBalancer, this can be done with zero downtime.
+
+**Zero-downtime IP transfer process:**
+
+1. Traefik is already running with its own LoadBalancer IP (from Step 1)
+2. Add Traefik's LoadBalancer IP to DNS (traffic now goes to both NGINX and Traefik)
+3. Remove NGINX's IP from DNS and wait for propagation
+4. Delete NGINX's LoadBalancer service to release the IP
+5. Upgrade Traefik to claim the released IP
+6. (Optional) Remove Traefik's old IP from DNS once the new IP is active
+
+This way, traffic is always flowing to Traefik during the IP transfer.
+
+**Get your current NGINX LoadBalancer IP:**
+
+```bash
+kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ $ing := index .status.loadBalancer.ingress 0 }}{{ if $ing.ip }}{{ $ing.ip }}{{ else }}{{ $ing.hostname }}{{ end }}'
+```
+
+??? note "AWS (Network Load Balancer with Elastic IPs)"
+
+    AWS does not support static IPs for Classic Load Balancers. Use Network Load Balancers (NLB) with Elastic IPs instead. This requires the [AWS Load Balancer Controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller/) to be installed in your cluster.
+
+    **Pre-allocate Elastic IPs (one per availability zone):**
+
+    ```bash
+    aws ec2 allocate-address --domain vpc --region <your-region>
+    # Note the AllocationId (eipalloc-xxx) for each EIP
+    ```
+
+    **Update `traefik-values.yaml`:**
+
+    ```yaml
+    service:
+      type: LoadBalancer
+      loadBalancerClass: service.k8s.aws/nlb  # Requires AWS Load Balancer Controller
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-type: "external"
+        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
+        service.beta.kubernetes.io/aws-load-balancer-eip-allocations: "eipalloc-xxx,eipalloc-yyy"
+    ```
+
+    For more details, see the [AWS Load Balancer Controller annotations documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/).
+
+??? note "Azure"
+
+    Azure supports static public IPs for Load Balancers.
+
+    **Identify existing public IP:**
+
+    ```bash
+    az network public-ip list --resource-group <your-resource-group> \
+      --query "[?ipAddress=='<your-ip>'].name" -o tsv
+    ```
+
+    **Update `traefik-values.yaml`:**
+
+    ```yaml
+    service:
+      type: LoadBalancer
+      annotations:
+        # Only needed if the public IP is in a different resource group than the AKS cluster
+        service.beta.kubernetes.io/azure-load-balancer-resource-group: "<public-ip-resource-group>"
+      spec:
+        loadBalancerIP: "<your-existing-ip>"
+    ```
+
+    For more details, see the [Azure AKS static IP documentation](https://learn.microsoft.com/en-us/azure/aks/static-ip).
+
+??? note "GCP"
+
+    GCP supports static IPs through reserved regional IP addresses.
+
+    **Reserve or identify existing IP:**
+
+    ```bash
+    # List existing static IPs
+    gcloud compute addresses list
+
+    # Or reserve a new regional static IP (must be in the same region as your GKE cluster)
+    gcloud compute addresses create traefik-ip --region <your-cluster-region>
+    ```
+
+    **Update `traefik-values.yaml`:**
+
+    ```yaml
+    service:
+      type: LoadBalancer
+      spec:
+        loadBalancerIP: "<your-static-ip>"
+    ```
+
+    For more details, see the [GKE LoadBalancer Service parameters documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/service-load-balancer-parameters).
+
+??? note "Other Cloud Providers"
+
+    - **DigitalOcean:** Supports `loadBalancerIP` with floating IPs
+    - **Linode:** Supports `loadBalancerIP` specification
+    - **Bare Metal (MetalLB):** Use IP address pools
+
+**Transfer the IP:**
+
+Once DNS is pointing to Traefik and your values are configured with the target IP:
+
+```bash
+# Ensure Traefik is already receiving traffic via its current LoadBalancer
+kubectl get svc -n traefik traefik
+
+# Delete NGINX LoadBalancer service to release the IP
+kubectl delete svc -n ingress-nginx ingress-nginx-controller
+
+# Upgrade Traefik to claim the released IP
+helm upgrade traefik traefik/traefik \
+  --namespace traefik \
+  --values traefik-values.yaml
+
+# Verify Traefik now has the old NGINX IP
+kubectl get svc -n traefik traefik
+```
+
+!!! tip "Zero Downtime During Helm Upgrade"
+
+    The Helm upgrade only restarts the Traefik pod, not the LoadBalancer service. Traefik uses a `RollingUpdate` deployment strategy by default, so the new pod starts before the old one terminates. For additional safety, configure high availability:
+
+    ```yaml
+    # In traefik-values.yaml
+    deployment:
+      replicas: 2
+
+    # Spread pods across nodes to survive node failures
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: traefik
+                app.kubernetes.io/instance: traefik
+            topologyKey: kubernetes.io/hostname
+
+    # Ensure at least one pod is always available during disruptions
+    podDisruptionBudget:
+      enabled: true
+      minAvailable: 1
+    ```
+
+    With multiple replicas spread across nodes and a PodDisruptionBudget, at least one pod is always running during upgrades and node maintenance.
+
+---
+
+## Step 4: Uninstall Ingress NGINX Controller
+
+Once NGINX is no longer receiving traffic, remove it from your cluster. Before uninstalling, you must ensure the `nginx` IngressClass is preserved. Traefik needs it to continue discovering your Ingresses.
+
+### Preserve the IngressClass
+
+??? note "If NGINX Was Installed via Helm"
+
+    Add the `helm.sh/resource-policy: keep` annotation to tell Helm to preserve the IngressClass:
+
+    ```bash
+    # Add the required annotation
+    helm upgrade ingress-nginx ingress-nginx \
+      --repo https://kubernetes.github.io/ingress-nginx \
+      --namespace ingress-nginx \
+      --reuse-values \
+      --set-json 'controller.ingressClassResource.annotations={"helm.sh/resource-policy": "keep"}'
+    # Check that the annotation is really here
+    kubectl describe ingressclass nginx
+    ```
+
+    The `--reuse-values` flag is critical - it preserves all your existing NGINX configuration. Without it, Helm would reset everything to defaults, potentially breaking your setup.
+
+    !!! info "kubectl annotate/patch/edit does not work"
+
+        Adding the annotation via `kubectl annotate`, `kubectl patch`, or `kubectl edit` will not preserve the IngressClass. Helm stores its release state internally and checks annotations from its internal manifest, not the live cluster state. Only `helm upgrade` updates Helm's internal state.
+
+??? note "If NGINX Was Installed via GitOps (ArgoCD, Flux)"
+
+    Ensure the `nginx` IngressClass is defined as a standalone resource in your Git repository, separate from the NGINX Helm release:
+
+    ```yaml
+    # ingressclass.yaml
+    apiVersion: networking.k8s.io/v1
+    kind: IngressClass
+    metadata:
+      name: nginx
+    spec:
+      controller: k8s.io/ingress-nginx
+    ```
+
+??? note "If NGINX Was Installed Manually"
+
+    Create the IngressClass as a standalone resource:
+
+    ```bash
+    kubectl apply -f - <<EOF
+    apiVersion: networking.k8s.io/v1
+    kind: IngressClass
+    metadata:
+      name: nginx
+    spec:
+      controller: k8s.io/ingress-nginx
+    EOF
+    ```
+
+### Delete NGINX Admission Webhook
+
+You should delete the admission webhook to avoid issues with Ingress modifications after NGINX is removed:
+
+```bash
+kubectl delete validatingwebhookconfiguration ingress-nginx-admission
+kubectl delete mutatingwebhookconfiguration ingress-nginx-admission --ignore-not-found
+```
+
+### Uninstall NGINX
+
+```bash
+helm uninstall ingress-nginx -n ingress-nginx
+```
+
+If you added the `helm.sh/resource-policy: keep` annotation, you should see:
+
+```text
+These resources were kept due to the resource policy:
+[IngressClass] nginx
+
+release "ingress-nginx" uninstalled
+```
+
+### Verify IngressClass Exists
+
+```bash
+kubectl get ingressclass nginx
+```
+
+In case, the ingressClass is somehow deleted, you can recreate it using the commands in [Preserve the IngressClass](#preserve-the-ingressclass).
+
+### Clean Up NGINX Namespace
+
+```bash
+kubectl delete namespace ingress-nginx
+```
+
+!!! success "Migration Complete"
+
+    Congratulations! You have successfully migrated from Ingress NGINX Controller to Traefik with zero downtime. Your existing Ingresses with `ingressClassName: nginx` continue to work, now served by Traefik.
+
+---
+
+## Troubleshooting
+
+There is a dashboard available in Traefik that can help to understand what's going on.
+Refer to the [dedicated documentation](../reference/install-configuration/api-dashboard.md#configuration-example) to enable it.
+
+??? note "Ingresses Not Discovered by Traefik"
+
+    ```bash
+    # Verify IngressClass exists
+    kubectl get ingressclass nginx
+
+    # Check Traefik provider configuration
+    kubectl logs -n traefik deployment/traefik | grep -i "nginx\|ingress"
+
+    # Verify Ingress has correct ingressClassName
+    kubectl get ingress <name> -o yaml | grep ingressClassName
+    ```
+
+??? note "Annotation Not Working as Expected"
+
+    Some NGINX annotations have behavioral differences in Traefik. Check the [limitations documentation](../reference/routing-configuration/kubernetes/ingress-nginx.md#limitations) for details.
+
+??? note "TLS Certificates Not Working"
+
+    Existing TLS configurations continue to work with Traefik:
+
+    - Keep `spec.tls` entries exactly as-is; Traefik terminates TLS using the referenced secrets
+    - TLS secrets must stay in the same namespace as the Ingress
+    - NGINX `ssl-redirect` / `force-ssl-redirect` annotations are honored
+
+    ```bash
+        # Verify TLS secret exists in the same namespace as Ingress
+    kubectl get secrets -n <namespace>
+
+        # Check secret format
+    kubectl get secret <tls-secret-name> -n <namespace> -o yaml
+    ```
+
+??? note "LoadBalancer IP Not Assigned"
+
+    ```bash
+      # Check service status
+      kubectl describe svc -n traefik traefik
+
+      # Check for events
+      kubectl get events -n traefik --sort-by='.lastTimestamp'
+    ```
+
+---
+
+## Next Steps
+
+**Learn More About Traefik:**
+
+- [Kubernetes Ingress NGINX Install Configuration](../reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md) - Detailed provider configuration
+- [Kubernetes Ingress NGINX Routing Configuration](../reference/routing-configuration/kubernetes/ingress-nginx.md) - Routing rules and annotation support
+- [HTTP Middlewares](../reference/routing-configuration/http/middlewares/overview.md) - Extend functionality beyond NGINX annotations
+- [TLS Configuration](../reference/routing-configuration/http/tls/overview.md) - Advanced TLS and certificate management
+
+**Enhance Your Setup:**
+
+- Enable [metrics](../reference/install-configuration/observability/metrics.md) and [tracing](../reference/install-configuration/observability/tracing.md)
+- Configure [access logs](../reference/install-configuration/observability/logs-and-accesslogs.md) for observability
+- Explore [Traefik Middlewares](../reference/routing-configuration/http/middlewares/overview.md) for advanced traffic management
+- Migrate from Nginx-based config to Traefik [IngressRoute](../reference/routing-configuration/kubernetes/crd/http/ingressroute.md) or [Kubernetes Gateway API](../reference/routing-configuration/kubernetes/gateway-api.md)
+- Consider [Traefik Hub](https://traefik.io/traefik-hub/) for enterprise features like AI & API Gateway, API Management, and advanced security
+
+---
+
+## Feedback and Support
+
+If you encounter issues during migration or have suggestions for improving this guide:
+
+- **Report Issues:** [GitHub Issues](https://github.com/traefik/traefik/issues)
+- **Community Support:** [Traefik Community Forum](https://community.traefik.io/)
+- **Enterprise Support:** [Traefik Labs Commercial Support](https://traefik.io/pricing/)
+
+We welcome contributions to improve this migration guide. See our [contribution guidelines](../contributing/submitting-pull-requests.md) to get started.
diff --git a/docs/content/migrate/v2-to-v3.md b/docs/content/migrate/v2-to-v3.md
index 175f36921..2c09f86f9 100644
--- a/docs/content/migrate/v2-to-v3.md
+++ b/docs/content/migrate/v2-to-v3.md
@@ -158,4 +158,4 @@ core:
 - ✅ All applications functioning correctly
 - ✅ Performance metrics stable
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/migrate/v3.md b/docs/content/migrate/v3.md
index 657dac8d6..d947af7b7 100644
--- a/docs/content/migrate/v3.md
+++ b/docs/content/migrate/v3.md
@@ -496,3 +496,110 @@ kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/con
 
 Starting with `v3.5.4`, and when using OpenTelemetry, the `traefik_tls_certs_not_after_milliseconds` metric is renamed to `traefik_tls_certs_not_after_seconds`.
 This change aligns the metric name with its real unit precision, which is in seconds. 
+
+## v3.6.0
+
+### Kubernetes Gateway API Provider
+
+Starting with `v3.6.0`, the Kubernetes Gateway API provider only supports version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the specification,
+which requires the Gateway API CRDs to be updated.
+
+**Apply Updated CRDs:**
+
+```shell
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
+```
+
+For the experimental channel:
+
+```shell
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/experimental-install.yaml
+```
+
+### Kubernetes CRD Provider
+
+To use the new `leasttime` load-balancer algorithm with the Kubernetes CRD provider, you need to update your CRDs.
+
+**Apply Updated CRDs:**
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+```
+
+## v3.6.2
+
+### Ingress NGINX Provider
+
+The KubernetesIngressNGINX Provider is no longer experimental in v3.6.2 and can be enabled without the `experimental.kubernetesIngressNGINX` option.
+
+**Deprecated Configuration:**
+
+??? example "Experimental kubernetesIngressNGINX option (deprecated)"
+
+    ```yaml tab="File (YAML)"
+    experimental:
+      kubernetesIngressNGINX: true
+    ```
+
+    ```toml tab="File (TOML)"
+    [experimental]
+        kubernetesIngressNGINX=true
+    ```
+
+    ```bash tab="CLI"
+    --experimental.kubernetesIngressNGINX=true
+    ```
+
+**Migration Steps:**
+
+1. Remove the `kubernetesIngressNGINX` option from the experimental section
+2. Configure the provider using the [kubernetesIngressNGINX Provider documentation](../reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md)
+
+## v3.6.4
+
+### Encoded Characters in Request Path
+
+Starting with `v3.6.4`, for security reasons, Traefik now rejects requests with a path containing a specific set of encoded characters by default.
+
+When such a request is received, Traefik responds with a `400 Bad Request` status code.
+
+Here is the list of the encoded characters that are rejected by default, along with the corresponding configuration option to allow them:
+
+| Encoded Character | Character               | Config option to allow the encoded character                                         |
+|-------------------|-------------------------|--------------------------------------------------------------------------------------|
+| `%2f` or `%2F`    | `/` (slash)             | `entryPoints.<name>`<br/>`.http.encodedCharacters`<br/>`.allowEncodedSlash`          |
+| `%5c` or `%5C`    | `\` (backslash)         | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedBackSlash`     |
+| `%00`             | `NULL` (null character) | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedNullCharacter` |
+| `%3b` or `%3B`    | `;` (semicolon)         | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedSemicolon`     |
+| `%25`             | `%` (percent)           | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedPercent`       |
+| `%3f` or `%3F`    | `?` (question mark)     | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedQuestionMark`  |
+| `%23`             | `#` (hash)              | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedHash`          |
+
+Please check out the entrypoint [encodedCharacters option](../reference/install-configuration/entrypoints.md#opt-http-encodedCharacters) documentation for more details.
+
+## v3.6.7
+
+### Encoded Characters Configuration Default Values
+
+Since `v3.6.7`, the options for encoded characters now have a `true` default value.
+This means that Traefik will not reject requests with a path containing a specific set of encoded characters by default.
+It is now up to the users to configure the security hardening of encoded characters.
+
+Here is the list of the encoded characters that can be configured to `false` to disallow them:
+
+| Encoded Character | Character               | Config options                                                                       | Default value |
+|-------------------|-------------------------|--------------------------------------------------------------------------------------|---------------|
+| `%2f` or `%2F`    | `/` (slash)             | `entryPoints.<name>`<br/>`.http.encodedCharacters`<br/>`.allowEncodedSlash`          | `true`        |
+| `%5c` or `%5C`    | `\` (backslash)         | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedBackSlash`     | `true`        |
+| `%00`             | `NULL` (null character) | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedNullCharacter` | `true`        |
+| `%3b` or `%3B`    | `;` (semicolon)         | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedSemicolon`     | `true`        |
+| `%25`             | `%` (percent)           | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedPercent`       | `true`        |
+| `%3f` or `%3F`    | `?` (question mark)     | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedQuestionMark`  | `true`        |
+| `%23`             | `#` (hash)              | `entryPoints.<name>.`<br/>`.http.encodedCharacters`<br/>`.allowEncodedHash`          | `true`        |
+
+Note: This check is not done against query parameters,
+but only against the request path as defined
+in [RFC3986 section-3](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
+
+Please check out the entrypoint [encodedCharacters option](../routing/entrypoints.md#encoded-characters) documentation
+for more details.
diff --git a/docs/content/observability/access-logs.md b/docs/content/observability/access-logs.md
index 3091df45e..4b5ce0b36 100644
--- a/docs/content/observability/access-logs.md
+++ b/docs/content/observability/access-logs.md
@@ -306,7 +306,7 @@ Example utilizing Docker Compose:
 ```yaml
 services:
   traefik:
-    image: traefik:v3.5
+    image: traefik:v3.6
     environment:
       - TZ=US/Alaska
     command:
@@ -780,4 +780,4 @@ accesslog:
 --accesslog.otlp.grpc.tls.insecureSkipVerify=true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/observability/logs.md b/docs/content/observability/logs.md
index 8f82e9936..8c39edc04 100644
--- a/docs/content/observability/logs.md
+++ b/docs/content/observability/logs.md
@@ -644,4 +644,4 @@ log:
 --log.otlp.grpc.tls.insecureSkipVerify=true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/observe/overview.md b/docs/content/observe/overview.md
index e5e822221..c7dc2279a 100644
--- a/docs/content/observe/overview.md
+++ b/docs/content/observe/overview.md
@@ -77,4 +77,4 @@ additionalArguments:
 !!! note
     A router with its own observability configuration will override the global default.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/operations/api.md b/docs/content/operations/api.md
index 8e867bdad..f4fcb03e2 100644
--- a/docs/content/operations/api.md
+++ b/docs/content/operations/api.md
@@ -176,4 +176,4 @@ All the following endpoints must be accessed with a `GET` HTTP request.
 | `/debug/pprof/symbol`          | See the [pprof Symbol](https://golang.org/pkg/net/http/pprof/#Symbol) Go documentation.             |
 | `/debug/pprof/trace`           | See the [pprof Trace](https://golang.org/pkg/net/http/pprof/#Trace) Go documentation.               |
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/operations/dashboard.md b/docs/content/operations/dashboard.md
index c3776a369..6b086a272 100644
--- a/docs/content/operations/dashboard.md
+++ b/docs/content/operations/dashboard.md
@@ -168,4 +168,4 @@ api:
 --api.dashboard=false
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/plugins/index.md b/docs/content/plugins/index.md
index 9cd3662f8..b3172a9a8 100644
--- a/docs/content/plugins/index.md
+++ b/docs/content/plugins/index.md
@@ -31,4 +31,4 @@ The experience of implementing a Traefik plugin is comparable to writing a web b
 
 To learn more about Traefik plugin creation, please refer to the [developer documentation](https://plugins.traefik.io/create).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/docker.md b/docs/content/providers/docker.md
index 75840998d..24136bd67 100644
--- a/docs/content/providers/docker.md
+++ b/docs/content/providers/docker.md
@@ -163,7 +163,7 @@ See the [Docker API Access](#docker-api-access) section for more information.
     ```yaml
     services:
       traefik:
-         image: traefik:v3.5 # The official v3 Traefik docker image
+         image: traefik:v3.6 # The official v3 Traefik docker image
          ports:
            - "80:80"
          volumes:
@@ -702,4 +702,4 @@ providers:
 --providers.docker.allowEmptyServices=true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/file.md b/docs/content/providers/file.md
index c1f328e32..1fbab2b99 100644
--- a/docs/content/providers/file.md
+++ b/docs/content/providers/file.md
@@ -292,4 +292,4 @@ To illustrate, it is possible to easily define multiple routers, services, and T
     {{ end }}
     ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/kubernetes-crd.md b/docs/content/providers/kubernetes-crd.md
index f00b5c68e..18f56f039 100644
--- a/docs/content/providers/kubernetes-crd.md
+++ b/docs/content/providers/kubernetes-crd.md
@@ -16,7 +16,7 @@ the Traefik engineering team developed a [Custom Resource Definition](https://ku
 
 ## Requirements
 
-{!kubernetes-requirements.md!}
+{% include-markdown "includes/kubernetes-requirements.md" %}
 
 !!! tip "All Steps for a Successful Deployment"
 
@@ -31,10 +31,10 @@ the Traefik engineering team developed a [Custom Resource Definition](https://ku
 
     ```bash
     # Install Traefik Resource Definitions:
-    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
     
     # Install RBAC for Traefik:
-    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
     ```
 
 ## Resource Configuration
@@ -365,4 +365,4 @@ providers:
 
 For additional information, refer to the [full example](../user-guides/crd-acme/index.md) with Let's Encrypt.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/kubernetes-gateway.md b/docs/content/providers/kubernetes-gateway.md
index 22158dfb0..7842bb721 100644
--- a/docs/content/providers/kubernetes-gateway.md
+++ b/docs/content/providers/kubernetes-gateway.md
@@ -8,33 +8,33 @@ description: "Learn how to use the Kubernetes Gateway API as a provider for conf
 The Kubernetes Gateway provider is a Traefik implementation of the [Gateway API](https://gateway-api.sigs.k8s.io/)
 specification from the Kubernetes Special Interest Groups (SIGs).
 
-This provider supports Standard version [v1.3.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0) of the Gateway API specification. 
+This provider supports Standard version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the Gateway API specification. 
 
 It fully supports all HTTP core and some extended features, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels).
 
-For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.3.0/traefik-traefik).
+For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik).
 
 ## Requirements
 
-{!kubernetes-requirements.md!}
+{% include-markdown "includes/kubernetes-requirements.md" %}
 
 !!! info "Helm Chart"
 
     When using the Traefik [Helm Chart](../getting-started/install-traefik.md#use-the-helm-chart), the CRDs (Custom Resource Definitions) and RBAC (Role-Based Access Control) are automatically managed for you.
-    The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L130).
+    The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L323).
 
 1. Install/update the Kubernetes Gateway API CRDs.
 
     ```bash
     # Install Gateway API CRDs from the Standard channel.
-    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
+    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
     ```
 
 2. Install the additional Traefik RBAC required for Gateway API.
 
     ```bash
     # Install Traefik RBACs.
-    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
     ```
 
 3. Deploy Traefik and enable the `kubernetesGateway` provider in the static configuration as detailed below:
@@ -275,7 +275,7 @@ providers:
 
     ```bash
     # Install Gateway API CRDs from the Experimental channel.
-    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/experimental-install.yaml
+    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/experimental-install.yaml
     ```
 
 ### `labelselector`
@@ -357,4 +357,4 @@ providers:
 --providers.kubernetesgateway.throttleDuration=10s
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/kubernetes-ingress.md b/docs/content/providers/kubernetes-ingress.md
index ce9276480..bf148867b 100644
--- a/docs/content/providers/kubernetes-ingress.md
+++ b/docs/content/providers/kubernetes-ingress.md
@@ -13,7 +13,7 @@ it manages access to cluster services by supporting the [Ingress](https://kubern
 
 ## Requirements
 
-{!kubernetes-requirements.md!}
+{% include-markdown "includes/kubernetes-requirements.md" %}
 
 ## Routing Configuration
 
@@ -555,6 +555,6 @@ providers:
 ### Further
 
 To learn more about the various aspects of the Ingress specification that Traefik supports,
-many examples of Ingresses definitions are located in the test [examples](https://github.com/traefik/traefik/tree/v3.5/pkg/provider/kubernetes/ingress/fixtures) of the Traefik repository.
+many examples of Ingresses definitions are located in the test [examples](https://github.com/traefik/traefik/tree/v3.6/pkg/provider/kubernetes/ingress/fixtures) of the Traefik repository.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/overview.md b/docs/content/providers/overview.md
index 7ee8ad75c..8723f58a7 100644
--- a/docs/content/providers/overview.md
+++ b/docs/content/providers/overview.md
@@ -227,4 +227,4 @@ List of providers that support constraints:
 - [Kubernetes Ingress](./kubernetes-ingress.md#labelselector)
 - [Kubernetes Gateway](./kubernetes-gateway.md#labelselector)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/providers/swarm.md b/docs/content/providers/swarm.md
index e82e1d518..26a2c7e97 100644
--- a/docs/content/providers/swarm.md
+++ b/docs/content/providers/swarm.md
@@ -769,4 +769,4 @@ providers:
 --providers.swarm.allowEmptyServices=true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/dynamic-configuration/docker-labels.yml b/docs/content/reference/dynamic-configuration/docker-labels.yml
index 3399c2762..b2881a594 100644
--- a/docs/content/reference/dynamic-configuration/docker-labels.yml
+++ b/docs/content/reference/dynamic-configuration/docker-labels.yml
@@ -199,37 +199,39 @@
 - "traefik.http.routers.router1.tls.domains[1].main=foobar"
 - "traefik.http.routers.router1.tls.domains[1].sans=foobar, foobar"
 - "traefik.http.routers.router1.tls.options=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.followredirects=true"
-- "traefik.http.services.service02.loadbalancer.healthcheck.headers.name0=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.headers.name1=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.hostname=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.interval=42s"
-- "traefik.http.services.service02.loadbalancer.healthcheck.method=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.mode=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.path=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.port=42"
-- "traefik.http.services.service02.loadbalancer.healthcheck.scheme=foobar"
-- "traefik.http.services.service02.loadbalancer.healthcheck.status=42"
-- "traefik.http.services.service02.loadbalancer.healthcheck.timeout=42s"
-- "traefik.http.services.service02.loadbalancer.healthcheck.unhealthyinterval=42s"
-- "traefik.http.services.service02.loadbalancer.passhostheader=true"
-- "traefik.http.services.service02.loadbalancer.responseforwarding.flushinterval=42s"
-- "traefik.http.services.service02.loadbalancer.serverstransport=foobar"
-- "traefik.http.services.service02.loadbalancer.sticky=true"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie=true"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.domain=foobar"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.httponly=true"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.maxage=42"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.name=foobar"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.path=foobar"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.samesite=foobar"
-- "traefik.http.services.service02.loadbalancer.sticky.cookie.secure=true"
-- "traefik.http.services.service02.loadbalancer.strategy=foobar"
-- "traefik.http.services.service02.loadbalancer.server.port=foobar"
-- "traefik.http.services.service02.loadbalancer.server.preservepath=true"
-- "traefik.http.services.service02.loadbalancer.server.scheme=foobar"
-- "traefik.http.services.service02.loadbalancer.server.url=foobar"
-- "traefik.http.services.service02.loadbalancer.server.weight=42"
+- "traefik.http.services.service03.loadbalancer.healthcheck.followredirects=true"
+- "traefik.http.services.service03.loadbalancer.healthcheck.headers.name0=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.headers.name1=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.hostname=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.interval=42s"
+- "traefik.http.services.service03.loadbalancer.healthcheck.method=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.mode=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.path=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.port=42"
+- "traefik.http.services.service03.loadbalancer.healthcheck.scheme=foobar"
+- "traefik.http.services.service03.loadbalancer.healthcheck.status=42"
+- "traefik.http.services.service03.loadbalancer.healthcheck.timeout=42s"
+- "traefik.http.services.service03.loadbalancer.healthcheck.unhealthyinterval=42s"
+- "traefik.http.services.service03.loadbalancer.passhostheader=true"
+- "traefik.http.services.service03.loadbalancer.passivehealthcheck.failurewindow=42s"
+- "traefik.http.services.service03.loadbalancer.passivehealthcheck.maxfailedattempts=42"
+- "traefik.http.services.service03.loadbalancer.responseforwarding.flushinterval=42s"
+- "traefik.http.services.service03.loadbalancer.serverstransport=foobar"
+- "traefik.http.services.service03.loadbalancer.sticky=true"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie=true"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.domain=foobar"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.httponly=true"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.maxage=42"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.name=foobar"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.path=foobar"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.samesite=foobar"
+- "traefik.http.services.service03.loadbalancer.sticky.cookie.secure=true"
+- "traefik.http.services.service03.loadbalancer.strategy=foobar"
+- "traefik.http.services.service03.loadbalancer.server.port=foobar"
+- "traefik.http.services.service03.loadbalancer.server.preservepath=true"
+- "traefik.http.services.service03.loadbalancer.server.scheme=foobar"
+- "traefik.http.services.service03.loadbalancer.server.url=foobar"
+- "traefik.http.services.service03.loadbalancer.server.weight=42"
 - "traefik.tcp.middlewares.tcpmiddleware01.ipallowlist.sourcerange=foobar, foobar"
 - "traefik.tcp.middlewares.tcpmiddleware02.ipwhitelist.sourcerange=foobar, foobar"
 - "traefik.tcp.middlewares.tcpmiddleware03.inflightconn.amount=42"
diff --git a/docs/content/reference/dynamic-configuration/file.toml b/docs/content/reference/dynamic-configuration/file.toml
index 985f96e21..e0e2139e5 100644
--- a/docs/content/reference/dynamic-configuration/file.toml
+++ b/docs/content/reference/dynamic-configuration/file.toml
@@ -55,12 +55,23 @@
         fallback = "foobar"
         [http.services.Service01.failover.healthCheck]
     [http.services.Service02]
-      [http.services.Service02.loadBalancer]
+      [http.services.Service02.highestRandomWeight]
+
+        [[http.services.Service02.highestRandomWeight.services]]
+          name = "foobar"
+          weight = 42
+
+        [[http.services.Service02.highestRandomWeight.services]]
+          name = "foobar"
+          weight = 42
+        [http.services.Service02.highestRandomWeight.healthCheck]
+    [http.services.Service03]
+      [http.services.Service03.loadBalancer]
         strategy = "foobar"
         passHostHeader = true
         serversTransport = "foobar"
-        [http.services.Service02.loadBalancer.sticky]
-          [http.services.Service02.loadBalancer.sticky.cookie]
+        [http.services.Service03.loadBalancer.sticky]
+          [http.services.Service03.loadBalancer.sticky.cookie]
             name = "foobar"
             secure = true
             httpOnly = true
@@ -69,16 +80,16 @@
             path = "foobar"
             domain = "foobar"
 
-        [[http.services.Service02.loadBalancer.servers]]
+        [[http.services.Service03.loadBalancer.servers]]
           url = "foobar"
           weight = 42
           preservePath = true
 
-        [[http.services.Service02.loadBalancer.servers]]
+        [[http.services.Service03.loadBalancer.servers]]
           url = "foobar"
           weight = 42
           preservePath = true
-        [http.services.Service02.loadBalancer.healthCheck]
+        [http.services.Service03.loadBalancer.healthCheck]
           scheme = "foobar"
           mode = "foobar"
           path = "foobar"
@@ -90,37 +101,40 @@
           timeout = "42s"
           hostname = "foobar"
           followRedirects = true
-          [http.services.Service02.loadBalancer.healthCheck.headers]
+          [http.services.Service03.loadBalancer.healthCheck.headers]
             name0 = "foobar"
             name1 = "foobar"
-        [http.services.Service02.loadBalancer.responseForwarding]
+        [http.services.Service03.loadBalancer.passiveHealthCheck]
+          failureWindow = "42s"
+          maxFailedAttempts = 42
+        [http.services.Service03.loadBalancer.responseForwarding]
           flushInterval = "42s"
-    [http.services.Service03]
-      [http.services.Service03.mirroring]
+    [http.services.Service04]
+      [http.services.Service04.mirroring]
         service = "foobar"
         mirrorBody = true
         maxBodySize = 42
 
-        [[http.services.Service03.mirroring.mirrors]]
+        [[http.services.Service04.mirroring.mirrors]]
           name = "foobar"
           percent = 42
 
-        [[http.services.Service03.mirroring.mirrors]]
+        [[http.services.Service04.mirroring.mirrors]]
           name = "foobar"
           percent = 42
-        [http.services.Service03.mirroring.healthCheck]
-    [http.services.Service04]
-      [http.services.Service04.weighted]
+        [http.services.Service04.mirroring.healthCheck]
+    [http.services.Service05]
+      [http.services.Service05.weighted]
 
-        [[http.services.Service04.weighted.services]]
+        [[http.services.Service05.weighted.services]]
           name = "foobar"
           weight = 42
 
-        [[http.services.Service04.weighted.services]]
+        [[http.services.Service05.weighted.services]]
           name = "foobar"
           weight = 42
-        [http.services.Service04.weighted.sticky]
-          [http.services.Service04.weighted.sticky.cookie]
+        [http.services.Service05.weighted.sticky]
+          [http.services.Service05.weighted.sticky.cookie]
             name = "foobar"
             secure = true
             httpOnly = true
@@ -128,7 +142,7 @@
             maxAge = 42
             path = "foobar"
             domain = "foobar"
-        [http.services.Service04.weighted.healthCheck]
+        [http.services.Service05.weighted.healthCheck]
   [http.middlewares]
     [http.middlewares.Middleware01]
       [http.middlewares.Middleware01.addPrefix]
diff --git a/docs/content/reference/dynamic-configuration/file.yaml b/docs/content/reference/dynamic-configuration/file.yaml
index 29822fddb..e2ab16e54 100644
--- a/docs/content/reference/dynamic-configuration/file.yaml
+++ b/docs/content/reference/dynamic-configuration/file.yaml
@@ -65,6 +65,14 @@ http:
         fallback: foobar
         healthCheck: {}
     Service02:
+      highestRandomWeight:
+        services:
+          - name: foobar
+            weight: 42
+          - name: foobar
+            weight: 42
+        healthCheck: {}
+    Service03:
       loadBalancer:
         sticky:
           cookie:
@@ -98,11 +106,14 @@ http:
           headers:
             name0: foobar
             name1: foobar
+        passiveHealthCheck:
+          failureWindow: 42s
+          maxFailedAttempts: 42
         passHostHeader: true
         responseForwarding:
           flushInterval: 42s
         serversTransport: foobar
-    Service03:
+    Service04:
       mirroring:
         service: foobar
         mirrorBody: true
@@ -113,7 +124,7 @@ http:
           - name: foobar
             percent: 42
         healthCheck: {}
-    Service04:
+    Service05:
       weighted:
         services:
           - name: foobar
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml b/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
index ea2618637..763d981eb 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
@@ -1,9 +1,8 @@
----
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutes.traefik.io
 spec:
   group: traefik.io
@@ -43,11 +42,31 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
                 type: array
+              parentRefs:
+                description: |-
+                  ParentRefs defines references to parent IngressRoute resources for multi-layer routing.
+                  When set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.
+                  More info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs
+                items:
+                  description: IngressRouteRef is a reference to an IngressRoute resource.
+                  properties:
+                    name:
+                      description: Name defines the name of the referenced IngressRoute
+                        resource.
+                      type: string
+                    namespace:
+                      description: Namespace defines the namespace of the referenced
+                        IngressRoute resource.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
               routes:
                 description: Routes defines the list of routes.
                 items:
@@ -64,12 +83,12 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: |-
                         Middlewares defines the list of references to Middleware resources.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/middleware/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/
                       items:
                         description: MiddlewareRef is a reference to a Middleware
                           resource.
@@ -89,7 +108,7 @@ spec:
                     observability:
                       description: |-
                         Observability defines the observability configuration for a router.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/observability/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/
                       properties:
                         accessLogs:
                           description: AccessLogs enables access logs for this router.
@@ -112,7 +131,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -227,6 +246,25 @@ spec:
                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                               By default, passHostHeader is true.
                             type: boolean
+                          passiveHealthCheck:
+                            description: PassiveHealthCheck defines passive health
+                              checks for ExternalName services.
+                            properties:
+                              failureWindow:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: FailureWindow defines the time window
+                                  during which the failed attempts must occur for
+                                  the server to be marked as unhealthy. It also defines
+                                  for how long the server will be considered unhealthy.
+                                x-kubernetes-int-or-string: true
+                              maxFailedAttempts:
+                                description: MaxFailedAttempts is the number of consecutive
+                                  failed attempts allowed within the failure window
+                                  before marking the server as unhealthy.
+                                type: integer
+                            type: object
                           port:
                             anyOf:
                             - type: integer
@@ -263,7 +301,7 @@ spec:
                           sticky:
                             description: |-
                               Sticky defines the sticky sessions configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                             properties:
                               cookie:
                                 description: Cookie defines the sticky cookie configuration.
@@ -312,11 +350,13 @@ spec:
                           strategy:
                             description: |-
                               Strategy defines the load balancing strategy between the servers.
-                              Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                              Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                               RoundRobin value is deprecated and supported for backward compatibility.
                             enum:
                             - wrr
                             - p2c
+                            - hrw
+                            - leasttime
                             - RoundRobin
                             type: string
                           weight:
@@ -332,7 +372,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       type: string
                   required:
@@ -342,18 +382,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -372,17 +412,17 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-options/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/
                     properties:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                     required:
                     - name
@@ -399,12 +439,12 @@ spec:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                     required:
                     - name
@@ -424,7 +464,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutetcps.traefik.io
 spec:
   group: traefik.io
@@ -464,7 +504,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
@@ -477,7 +517,7 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: Middlewares defines the list of references to MiddlewareTCP
@@ -501,7 +541,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -543,7 +583,7 @@ spec:
                           proxyProtocol:
                             description: |-
                               ProxyProtocol defines the PROXY protocol configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/service/#proxy-protocol
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol
                               Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
                             properties:
                               version:
@@ -585,7 +625,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       enum:
                       - v3
@@ -598,18 +638,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration on a layer 4 / TCP Route.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -628,7 +668,7 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#tls-options
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options
                     properties:
                       name:
                         description: Name defines the name of the referenced Traefik
@@ -680,7 +720,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressrouteudps.traefik.io
 spec:
   group: traefik.io
@@ -720,7 +760,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
@@ -792,7 +832,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewares.traefik.io
 spec:
   group: traefik.io
@@ -808,7 +848,7 @@ spec:
       openAPIV3Schema:
         description: |-
           Middleware is the CRD implementation of a Traefik Middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -834,7 +874,7 @@ spec:
                 description: |-
                   AddPrefix holds the add prefix middleware configuration.
                   This middleware updates the path of a request before forwarding it.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/addprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/
                 properties:
                   prefix:
                     description: |-
@@ -849,12 +889,12 @@ spec:
                 description: |-
                   BasicAuth holds the basic auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -875,7 +915,7 @@ spec:
                 description: |-
                   Buffering holds the buffering middleware configuration.
                   This middleware retries or limits the size of requests that can be forwarded to backends.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#maxrequestbodybytes
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes
                 properties:
                   maxRequestBodyBytes:
                     description: |-
@@ -907,14 +947,14 @@ spec:
                     description: |-
                       RetryExpression defines the retry conditions.
                       It is a logical combination of functions with operators AND (&&) and OR (||).
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#retryexpression
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression
                     type: string
                 type: object
               chain:
                 description: |-
                   Chain holds the configuration of the chain middleware.
                   This middleware enables to define reusable combinations of other pieces of middleware.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/chain/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/
                 properties:
                   middlewares:
                     description: Middlewares is the list of MiddlewareRef which composes
@@ -977,7 +1017,7 @@ spec:
                 description: |-
                   Compress holds the compress middleware configuration.
                   This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/compress/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/
                 properties:
                   defaultEncoding:
                     description: DefaultEncoding specifies the default encoding if
@@ -1027,12 +1067,12 @@ spec:
                 description: |-
                   DigestAuth holds the digest auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -1052,7 +1092,7 @@ spec:
                 description: |-
                   ErrorPage holds the custom error middleware configuration.
                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/
                 properties:
                   query:
                     description: |-
@@ -1064,7 +1104,7 @@ spec:
                   service:
                     description: |-
                       Service defines the reference to a Kubernetes Service that will serve the error page.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/#service
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service
                     properties:
                       healthCheck:
                         description: Healthcheck defines health checks for ExternalName
@@ -1170,6 +1210,25 @@ spec:
                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                           By default, passHostHeader is true.
                         type: boolean
+                      passiveHealthCheck:
+                        description: PassiveHealthCheck defines passive health checks
+                          for ExternalName services.
+                        properties:
+                          failureWindow:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: FailureWindow defines the time window during
+                              which the failed attempts must occur for the server
+                              to be marked as unhealthy. It also defines for how long
+                              the server will be considered unhealthy.
+                            x-kubernetes-int-or-string: true
+                          maxFailedAttempts:
+                            description: MaxFailedAttempts is the number of consecutive
+                              failed attempts allowed within the failure window before
+                              marking the server as unhealthy.
+                            type: integer
+                        type: object
                       port:
                         anyOf:
                         - type: integer
@@ -1206,7 +1265,7 @@ spec:
                       sticky:
                         description: |-
                           Sticky defines the sticky sessions configuration.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                         properties:
                           cookie:
                             description: Cookie defines the sticky cookie configuration.
@@ -1254,11 +1313,13 @@ spec:
                       strategy:
                         description: |-
                           Strategy defines the load balancing strategy between the servers.
-                          Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                          Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                           RoundRobin value is deprecated and supported for backward compatibility.
                         enum:
                         - wrr
                         - p2c
+                        - hrw
+                        - leasttime
                         - RoundRobin
                         type: string
                       weight:
@@ -1293,7 +1354,7 @@ spec:
                 description: |-
                   ForwardAuth holds the forward auth middleware configuration.
                   This middleware delegates the request authentication to a Service.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/
                 properties:
                   addAuthCookiesToResponse:
                     description: AddAuthCookiesToResponse defines the list of cookies
@@ -1321,7 +1382,7 @@ spec:
                   authResponseHeadersRegex:
                     description: |-
                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
                     type: string
                   forwardBody:
                     description: ForwardBody defines whether to send the request body
@@ -1330,7 +1391,7 @@ spec:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
                     type: string
                   maxBodySize:
                     description: MaxBodySize defines the maximum body size in bytes
@@ -1392,7 +1453,7 @@ spec:
                 description: |-
                   Headers holds the headers middleware configuration.
                   This middleware manages the requests and responses headers.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/headers/#customrequestheaders
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders
                 properties:
                   accessControlAllowCredentials:
                     description: AccessControlAllowCredentials defines whether the
@@ -1564,7 +1625,7 @@ spec:
                 description: |-
                   InFlightReq holds the in-flight request middleware configuration.
                   This middleware limits the number of requests being processed and served concurrently.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/
                 properties:
                   amount:
                     description: |-
@@ -1578,12 +1639,12 @@ spec:
                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
                       If several strategies are defined at the same time, an error will be raised.
                       If none are set, the default is to use the requestHost.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/#sourcecriterion
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion
                     properties:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -1619,12 +1680,12 @@ spec:
                 description: |-
                   IPAllowList holds the IP allowlist middleware configuration.
                   This middleware limits allowed requests based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/
                 properties:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -1662,7 +1723,7 @@ spec:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -1693,7 +1754,7 @@ spec:
                 description: |-
                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
                   This middleware adds the selected data from the passed client TLS certificate to a header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/passtlsclientcert/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/
                 properties:
                   info:
                     description: Info selects the specific client certificate details
@@ -1796,13 +1857,13 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 description: |-
                   Plugin defines the middleware plugin configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/#community-middlewares
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares
                 type: object
               rateLimit:
                 description: |-
                   RateLimit holds the rate limit configuration.
                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/ratelimit/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/
                 properties:
                   average:
                     description: |-
@@ -1921,7 +1982,7 @@ spec:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -1957,7 +2018,7 @@ spec:
                 description: |-
                   RedirectRegex holds the redirect regex middleware configuration.
                   This middleware redirects a request using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectregex/#regex
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex
                 properties:
                   permanent:
                     description: Permanent defines whether the redirection is permanent
@@ -1976,11 +2037,12 @@ spec:
                 description: |-
                   RedirectScheme holds the redirect scheme middleware configuration.
                   This middleware redirects requests from a scheme/port to another.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectscheme/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/
                 properties:
                   permanent:
-                    description: Permanent defines whether the redirection is permanent
-                      (308).
+                    description: |-
+                      Permanent defines whether the redirection is permanent.
+                      For HTTP GET requests a 301 is returned, otherwise a 308 is returned.
                     type: boolean
                   port:
                     description: Port defines the port of the new URL.
@@ -1993,7 +2055,7 @@ spec:
                 description: |-
                   ReplacePath holds the replace path middleware configuration.
                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepath/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/
                 properties:
                   path:
                     description: Path defines the path to use as replacement in the
@@ -2004,7 +2066,7 @@ spec:
                 description: |-
                   ReplacePathRegex holds the replace path regex middleware configuration.
                   This middleware replaces the path of a URL using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepathregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression used to match
@@ -2020,7 +2082,7 @@ spec:
                   Retry holds the retry middleware configuration.
                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/retry/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/
                 properties:
                   attempts:
                     description: Attempts defines how many times the request should
@@ -2044,7 +2106,7 @@ spec:
                 description: |-
                   StripPrefix holds the strip prefix middleware configuration.
                   This middleware removes the specified prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/
                 properties:
                   forceSlash:
                     description: |-
@@ -2063,7 +2125,7 @@ spec:
                 description: |-
                   StripPrefixRegex holds the strip prefix regex middleware configuration.
                   This middleware removes the matching prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefixregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression to match the
@@ -2084,7 +2146,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewaretcps.traefik.io
 spec:
   group: traefik.io
@@ -2100,7 +2162,7 @@ spec:
       openAPIV3Schema:
         description: |-
           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -2137,7 +2199,7 @@ spec:
                 description: |-
                   IPAllowList defines the IPAllowList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
@@ -2151,7 +2213,7 @@ spec:
                   IPWhiteList defines the IPWhiteList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
                   Deprecated: please use IPAllowList instead.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipwhitelist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
@@ -2172,7 +2234,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransports.traefik.io
 spec:
   group: traefik.io
@@ -2190,7 +2252,7 @@ spec:
           ServersTransport is the CRD implementation of a ServersTransport.
           If no serversTransport is specified, the default@internal will be used.
           The default@internal serversTransport is created from the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/
         properties:
           apiVersion:
             description: |-
@@ -2341,7 +2403,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransporttcps.traefik.io
 spec:
   group: traefik.io
@@ -2359,7 +2421,7 @@ spec:
           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
           If no tcpServersTransport is specified, a default one named default@internal will be used.
           The default@internal tcpServersTransport can be configured in the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/
         properties:
           apiVersion:
             description: |-
@@ -2497,7 +2559,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsoptions.traefik.io
 spec:
   group: traefik.io
@@ -2513,7 +2575,7 @@ spec:
       openAPIV3Schema:
         description: |-
           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
         properties:
           apiVersion:
             description: |-
@@ -2538,14 +2600,14 @@ spec:
               alpnProtocols:
                 description: |-
                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
                 items:
                   type: string
                 type: array
               cipherSuites:
                 description: |-
                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
                 items:
                   type: string
                 type: array
@@ -2573,7 +2635,7 @@ spec:
               curvePreferences:
                 description: |-
                   CurvePreferences defines the preferred elliptic curves.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
                 items:
                   type: string
                 type: array
@@ -2615,7 +2677,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsstores.traefik.io
 spec:
   group: traefik.io
@@ -2633,7 +2695,7 @@ spec:
           TLSStore is the CRD implementation of a Traefik TLS Store.
           For the time being, only the TLSStore named default is supported.
           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
         properties:
           apiVersion:
             description: |-
@@ -2712,7 +2774,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: traefikservices.traefik.io
 spec:
   group: traefik.io
@@ -2731,7 +2793,7 @@ spec:
           TraefikService object allows to:
           - Apply weight to Services on load-balancing
           - Mirror traffic on services
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/
         properties:
           apiVersion:
             description: |-
@@ -2753,6 +2815,244 @@ spec:
           spec:
             description: TraefikServiceSpec defines the desired state of a TraefikService.
             properties:
+              highestRandomWeight:
+                description: HighestRandomWeight defines the highest random weight
+                  service configuration.
+                properties:
+                  services:
+                    description: Services defines the list of Kubernetes Service and/or
+                      TraefikService to load-balance, with weight.
+                    items:
+                      description: Service defines an upstream HTTP service to proxy
+                        traffic to.
+                      properties:
+                        healthCheck:
+                          description: Healthcheck defines health checks for ExternalName
+                            services.
+                          properties:
+                            followRedirects:
+                              description: |-
+                                FollowRedirects defines whether redirects should be followed during the health check calls.
+                                Default: true
+                              type: boolean
+                            headers:
+                              additionalProperties:
+                                type: string
+                              description: Headers defines custom headers to be sent
+                                to the health check endpoint.
+                              type: object
+                            hostname:
+                              description: Hostname defines the value of hostname
+                                in the Host header of the health check request.
+                              type: string
+                            interval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Interval defines the frequency of the health check calls for healthy targets.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                            method:
+                              description: Method defines the healthcheck method.
+                              type: string
+                            mode:
+                              description: |-
+                                Mode defines the health check mode.
+                                If defined to grpc, will use the gRPC health check protocol to probe the server.
+                                Default: http
+                              type: string
+                            path:
+                              description: Path defines the server URL path for the
+                                health check endpoint.
+                              type: string
+                            port:
+                              description: Port defines the server URL port for the
+                                health check endpoint.
+                              type: integer
+                            scheme:
+                              description: Scheme replaces the server URL scheme for
+                                the health check endpoint.
+                              type: string
+                            status:
+                              description: Status defines the expected HTTP status
+                                code of the response to the health check request.
+                              type: integer
+                            timeout:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
+                                Default: 5s
+                              x-kubernetes-int-or-string: true
+                            unhealthyInterval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+                                When UnhealthyInterval is not defined, it defaults to the Interval value.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        kind:
+                          description: Kind defines the kind of the Service.
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: |-
+                            Name defines the name of the referenced Kubernetes Service or TraefikService.
+                            The differentiation between the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Kubernetes Service or TraefikService.
+                          type: string
+                        nativeLB:
+                          description: |-
+                            NativeLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
+                            The Kubernetes Service itself does load-balance to the pods.
+                            By default, NativeLB is false.
+                          type: boolean
+                        nodePortLB:
+                          description: |-
+                            NodePortLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
+                            It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
+                            By default, NodePortLB is false.
+                          type: boolean
+                        passHostHeader:
+                          description: |-
+                            PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
+                            By default, passHostHeader is true.
+                          type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          description: |-
+                            Port defines the port of a Kubernetes Service.
+                            This can be a reference to a named port.
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding defines how Traefik forwards
+                            the response from the upstream Kubernetes Service to the
+                            client.
+                          properties:
+                            flushInterval:
+                              description: |-
+                                FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
+                                A negative value means to flush immediately after each write to the client.
+                                This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
+                                for such responses, writes are flushed to the client immediately.
+                                Default: 100ms
+                              type: string
+                          type: object
+                        scheme:
+                          description: |-
+                            Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
+                            It defaults to https when Kubernetes Service port is 443, http otherwise.
+                          type: string
+                        serversTransport:
+                          description: |-
+                            ServersTransport defines the name of ServersTransport resource to use.
+                            It allows to configure the transport between Traefik and your servers.
+                            Can only be used on a Kubernetes Service.
+                          type: string
+                        sticky:
+                          description: |-
+                            Sticky defines the sticky sessions configuration.
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          properties:
+                            cookie:
+                              description: Cookie defines the sticky cookie configuration.
+                              properties:
+                                domain:
+                                  description: |-
+                                    Domain defines the host to which the cookie will be sent.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
+                                  type: string
+                                httpOnly:
+                                  description: HTTPOnly defines whether the cookie
+                                    can be accessed by client-side APIs, such as JavaScript.
+                                  type: boolean
+                                maxAge:
+                                  description: |-
+                                    MaxAge defines the number of seconds until the cookie expires.
+                                    When set to a negative number, the cookie expires immediately.
+                                    When set to zero, the cookie never expires.
+                                  type: integer
+                                name:
+                                  description: Name defines the Cookie name.
+                                  type: string
+                                path:
+                                  description: |-
+                                    Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
+                                    When not provided the cookie will be sent on every request to the domain.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
+                                  type: string
+                                sameSite:
+                                  description: |-
+                                    SameSite defines the same site policy.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+                                  enum:
+                                  - none
+                                  - lax
+                                  - strict
+                                  type: string
+                                secure:
+                                  description: Secure defines whether the cookie can
+                                    only be transmitted over an encrypted connection
+                                    (i.e. HTTPS).
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          description: |-
+                            Strategy defines the load balancing strategy between the servers.
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
+                            RoundRobin value is deprecated and supported for backward compatibility.
+                          enum:
+                          - wrr
+                          - p2c
+                          - hrw
+                          - leasttime
+                          - RoundRobin
+                          type: string
+                        weight:
+                          description: |-
+                            Weight defines the weight and should only be specified when Name references a TraefikService object
+                            (and to be precise, one that embeds a Weighted Round Robin).
+                          minimum: 0
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
               mirroring:
                 description: Mirroring defines the Mirroring service configuration.
                 properties:
@@ -2954,6 +3254,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         percent:
                           description: |-
                             Percent defines the part of the traffic to mirror.
@@ -2995,7 +3314,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -3043,11 +3362,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -3088,6 +3409,25 @@ spec:
                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                       By default, passHostHeader is true.
                     type: boolean
+                  passiveHealthCheck:
+                    description: PassiveHealthCheck defines passive health checks
+                      for ExternalName services.
+                    properties:
+                      failureWindow:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: FailureWindow defines the time window during
+                          which the failed attempts must occur for the server to be
+                          marked as unhealthy. It also defines for how long the server
+                          will be considered unhealthy.
+                        x-kubernetes-int-or-string: true
+                      maxFailedAttempts:
+                        description: MaxFailedAttempts is the number of consecutive
+                          failed attempts allowed within the failure window before
+                          marking the server as unhealthy.
+                        type: integer
+                    type: object
                   port:
                     anyOf:
                     - type: integer
@@ -3123,7 +3463,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines the sticky sessions configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
@@ -3170,11 +3510,13 @@ spec:
                   strategy:
                     description: |-
                       Strategy defines the load balancing strategy between the servers.
-                      Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                      Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                       RoundRobin value is deprecated and supported for backward compatibility.
                     enum:
                     - wrr
                     - p2c
+                    - hrw
+                    - leasttime
                     - RoundRobin
                     type: string
                   weight:
@@ -3300,6 +3642,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         port:
                           anyOf:
                           - type: integer
@@ -3336,7 +3697,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -3384,11 +3745,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -3404,7 +3767,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines whether sticky sessions are enabled.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-crd.md b/docs/content/reference/dynamic-configuration/kubernetes-crd.md
index fb6ec6f72..aec00bee1 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd.md
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd.md
@@ -26,4 +26,4 @@ Dynamic configuration with Kubernetes Custom Resource
 --8<-- "content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml b/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
index c03dc0147..b2ab1e5db 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
@@ -1,4 +1,3 @@
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml b/docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml
index d3b1bef20..4b860c4c5 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml
@@ -1,4 +1,3 @@
----
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-gateway-simple-https.yml b/docs/content/reference/dynamic-configuration/kubernetes-gateway-simple-https.yml
index 1f15ae429..886010b0b 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-gateway-simple-https.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-gateway-simple-https.yml
@@ -1,4 +1,3 @@
----
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass
 metadata:
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-gateway-traefik-lb-svc.yml b/docs/content/reference/dynamic-configuration/kubernetes-gateway-traefik-lb-svc.yml
index 2d09a2a16..ee5394387 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-gateway-traefik-lb-svc.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-gateway-traefik-lb-svc.yml
@@ -1,4 +1,3 @@
----
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -25,7 +24,7 @@ spec:
       serviceAccountName: traefik-controller
       containers:
         - name: traefik
-          image: traefik:v3.5
+          image: traefik:v3.6
           args:
             - --entryPoints.web.address=:80
             - --entryPoints.websecure.address=:443
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-ingress-nginx-rbac.yml b/docs/content/reference/dynamic-configuration/kubernetes-ingress-nginx-rbac.yml
new file mode 100644
index 000000000..ca36e2f41
--- /dev/null
+++ b/docs/content/reference/dynamic-configuration/kubernetes-ingress-nginx-rbac.yml
@@ -0,0 +1,65 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik-ingress-nginx-controller
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - secrets
+    verbs:
+      - list
+      - watch
+  # When using the watchNamespaceSelector option,
+  # Traefik requires permissions to list and watch namespaces.
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - list
+      - watch
+  # The pods right is needed to inject k8s.pod.uid and k8s.pod.name OTel attributes.
+  # When OTel tracing/logs/metrics are not enabled, this rule is not needed.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+      - ingressclasses
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik-ingress-nginx-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-ingress-nginx-controller
+subjects:
+  - kind: ServiceAccount
+    name: traefik-ingress-nginx-controller
+    namespace: default
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-knative-rbac.yml b/docs/content/reference/dynamic-configuration/kubernetes-knative-rbac.yml
new file mode 100644
index 000000000..ea721ec12
--- /dev/null
+++ b/docs/content/reference/dynamic-configuration/kubernetes-knative-rbac.yml
@@ -0,0 +1,49 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: knative-networking-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.internal.knative.dev
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.internal.knative.dev
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gateway-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: knative-networking-role
+subjects:
+  - kind: ServiceAccount
+    name: traefik-controller
+    namespace: default
diff --git a/docs/content/reference/dynamic-configuration/kubernetes-whoami-svc.yml b/docs/content/reference/dynamic-configuration/kubernetes-whoami-svc.yml
index 32471e4c7..2a1b33be4 100644
--- a/docs/content/reference/dynamic-configuration/kubernetes-whoami-svc.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-whoami-svc.yml
@@ -1,4 +1,3 @@
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/docs/content/reference/dynamic-configuration/kv-ref.md b/docs/content/reference/dynamic-configuration/kv-ref.md
index d73df2bfa..a9d2984b4 100644
--- a/docs/content/reference/dynamic-configuration/kv-ref.md
+++ b/docs/content/reference/dynamic-configuration/kv-ref.md
@@ -274,56 +274,63 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-traefikhttpservicesService01failoverfallback" href="#opt-traefikhttpservicesService01failoverfallback" title="#opt-traefikhttpservicesService01failoverfallback">`traefik/http/services/Service01/failover/fallback`</a> | `foobar` |
 | <a id="opt-traefikhttpservicesService01failoverhealthCheck" href="#opt-traefikhttpservicesService01failoverhealthCheck" title="#opt-traefikhttpservicesService01failoverhealthCheck">`traefik/http/services/Service01/failover/healthCheck`</a> | `` |
 | <a id="opt-traefikhttpservicesService01failoverservice" href="#opt-traefikhttpservicesService01failoverservice" title="#opt-traefikhttpservicesService01failoverservice">`traefik/http/services/Service01/failover/service`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckfollowRedirects" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckfollowRedirects" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckfollowRedirects">`traefik/http/services/Service02/loadBalancer/healthCheck/followRedirects`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname0" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname0" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname0">`traefik/http/services/Service02/loadBalancer/healthCheck/headers/name0`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname1" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname1" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckheadersname1">`traefik/http/services/Service02/loadBalancer/healthCheck/headers/name1`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckhostname" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckhostname" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckhostname">`traefik/http/services/Service02/loadBalancer/healthCheck/hostname`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckinterval" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckinterval" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckinterval">`traefik/http/services/Service02/loadBalancer/healthCheck/interval`</a> | `42s` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckmethod" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckmethod" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckmethod">`traefik/http/services/Service02/loadBalancer/healthCheck/method`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckmode" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckmode" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckmode">`traefik/http/services/Service02/loadBalancer/healthCheck/mode`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckpath" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckpath" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckpath">`traefik/http/services/Service02/loadBalancer/healthCheck/path`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckport" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckport" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckport">`traefik/http/services/Service02/loadBalancer/healthCheck/port`</a> | `42` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckscheme" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckscheme" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckscheme">`traefik/http/services/Service02/loadBalancer/healthCheck/scheme`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckstatus" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckstatus" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckstatus">`traefik/http/services/Service02/loadBalancer/healthCheck/status`</a> | `42` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthChecktimeout" href="#opt-traefikhttpservicesService02loadBalancerhealthChecktimeout" title="#opt-traefikhttpservicesService02loadBalancerhealthChecktimeout">`traefik/http/services/Service02/loadBalancer/healthCheck/timeout`</a> | `42s` |
-| <a id="opt-traefikhttpservicesService02loadBalancerhealthCheckunhealthyInterval" href="#opt-traefikhttpservicesService02loadBalancerhealthCheckunhealthyInterval" title="#opt-traefikhttpservicesService02loadBalancerhealthCheckunhealthyInterval">`traefik/http/services/Service02/loadBalancer/healthCheck/unhealthyInterval`</a> | `42s` |
-| <a id="opt-traefikhttpservicesService02loadBalancerpassHostHeader" href="#opt-traefikhttpservicesService02loadBalancerpassHostHeader" title="#opt-traefikhttpservicesService02loadBalancerpassHostHeader">`traefik/http/services/Service02/loadBalancer/passHostHeader`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerresponseForwardingflushInterval" href="#opt-traefikhttpservicesService02loadBalancerresponseForwardingflushInterval" title="#opt-traefikhttpservicesService02loadBalancerresponseForwardingflushInterval">`traefik/http/services/Service02/loadBalancer/responseForwarding/flushInterval`</a> | `42s` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers0preservePath" href="#opt-traefikhttpservicesService02loadBalancerservers0preservePath" title="#opt-traefikhttpservicesService02loadBalancerservers0preservePath">`traefik/http/services/Service02/loadBalancer/servers/0/preservePath`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers0url" href="#opt-traefikhttpservicesService02loadBalancerservers0url" title="#opt-traefikhttpservicesService02loadBalancerservers0url">`traefik/http/services/Service02/loadBalancer/servers/0/url`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers0weight" href="#opt-traefikhttpservicesService02loadBalancerservers0weight" title="#opt-traefikhttpservicesService02loadBalancerservers0weight">`traefik/http/services/Service02/loadBalancer/servers/0/weight`</a> | `42` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers1preservePath" href="#opt-traefikhttpservicesService02loadBalancerservers1preservePath" title="#opt-traefikhttpservicesService02loadBalancerservers1preservePath">`traefik/http/services/Service02/loadBalancer/servers/1/preservePath`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers1url" href="#opt-traefikhttpservicesService02loadBalancerservers1url" title="#opt-traefikhttpservicesService02loadBalancerservers1url">`traefik/http/services/Service02/loadBalancer/servers/1/url`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerservers1weight" href="#opt-traefikhttpservicesService02loadBalancerservers1weight" title="#opt-traefikhttpservicesService02loadBalancerservers1weight">`traefik/http/services/Service02/loadBalancer/servers/1/weight`</a> | `42` |
-| <a id="opt-traefikhttpservicesService02loadBalancerserversTransport" href="#opt-traefikhttpservicesService02loadBalancerserversTransport" title="#opt-traefikhttpservicesService02loadBalancerserversTransport">`traefik/http/services/Service02/loadBalancer/serversTransport`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiedomain" href="#opt-traefikhttpservicesService02loadBalancerstickycookiedomain" title="#opt-traefikhttpservicesService02loadBalancerstickycookiedomain">`traefik/http/services/Service02/loadBalancer/sticky/cookie/domain`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiehttpOnly" href="#opt-traefikhttpservicesService02loadBalancerstickycookiehttpOnly" title="#opt-traefikhttpservicesService02loadBalancerstickycookiehttpOnly">`traefik/http/services/Service02/loadBalancer/sticky/cookie/httpOnly`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiemaxAge" href="#opt-traefikhttpservicesService02loadBalancerstickycookiemaxAge" title="#opt-traefikhttpservicesService02loadBalancerstickycookiemaxAge">`traefik/http/services/Service02/loadBalancer/sticky/cookie/maxAge`</a> | `42` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiename" href="#opt-traefikhttpservicesService02loadBalancerstickycookiename" title="#opt-traefikhttpservicesService02loadBalancerstickycookiename">`traefik/http/services/Service02/loadBalancer/sticky/cookie/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiepath" href="#opt-traefikhttpservicesService02loadBalancerstickycookiepath" title="#opt-traefikhttpservicesService02loadBalancerstickycookiepath">`traefik/http/services/Service02/loadBalancer/sticky/cookie/path`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiesameSite" href="#opt-traefikhttpservicesService02loadBalancerstickycookiesameSite" title="#opt-traefikhttpservicesService02loadBalancerstickycookiesameSite">`traefik/http/services/Service02/loadBalancer/sticky/cookie/sameSite`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstickycookiesecure" href="#opt-traefikhttpservicesService02loadBalancerstickycookiesecure" title="#opt-traefikhttpservicesService02loadBalancerstickycookiesecure">`traefik/http/services/Service02/loadBalancer/sticky/cookie/secure`</a> | `true` |
-| <a id="opt-traefikhttpservicesService02loadBalancerstrategy" href="#opt-traefikhttpservicesService02loadBalancerstrategy" title="#opt-traefikhttpservicesService02loadBalancerstrategy">`traefik/http/services/Service02/loadBalancer/strategy`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService03mirroringhealthCheck" href="#opt-traefikhttpservicesService03mirroringhealthCheck" title="#opt-traefikhttpservicesService03mirroringhealthCheck">`traefik/http/services/Service03/mirroring/healthCheck`</a> | `` |
-| <a id="opt-traefikhttpservicesService03mirroringmaxBodySize" href="#opt-traefikhttpservicesService03mirroringmaxBodySize" title="#opt-traefikhttpservicesService03mirroringmaxBodySize">`traefik/http/services/Service03/mirroring/maxBodySize`</a> | `42` |
-| <a id="opt-traefikhttpservicesService03mirroringmirrorBody" href="#opt-traefikhttpservicesService03mirroringmirrorBody" title="#opt-traefikhttpservicesService03mirroringmirrorBody">`traefik/http/services/Service03/mirroring/mirrorBody`</a> | `true` |
-| <a id="opt-traefikhttpservicesService03mirroringmirrors0name" href="#opt-traefikhttpservicesService03mirroringmirrors0name" title="#opt-traefikhttpservicesService03mirroringmirrors0name">`traefik/http/services/Service03/mirroring/mirrors/0/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService03mirroringmirrors0percent" href="#opt-traefikhttpservicesService03mirroringmirrors0percent" title="#opt-traefikhttpservicesService03mirroringmirrors0percent">`traefik/http/services/Service03/mirroring/mirrors/0/percent`</a> | `42` |
-| <a id="opt-traefikhttpservicesService03mirroringmirrors1name" href="#opt-traefikhttpservicesService03mirroringmirrors1name" title="#opt-traefikhttpservicesService03mirroringmirrors1name">`traefik/http/services/Service03/mirroring/mirrors/1/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService03mirroringmirrors1percent" href="#opt-traefikhttpservicesService03mirroringmirrors1percent" title="#opt-traefikhttpservicesService03mirroringmirrors1percent">`traefik/http/services/Service03/mirroring/mirrors/1/percent`</a> | `42` |
-| <a id="opt-traefikhttpservicesService03mirroringservice" href="#opt-traefikhttpservicesService03mirroringservice" title="#opt-traefikhttpservicesService03mirroringservice">`traefik/http/services/Service03/mirroring/service`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedhealthCheck" href="#opt-traefikhttpservicesService04weightedhealthCheck" title="#opt-traefikhttpservicesService04weightedhealthCheck">`traefik/http/services/Service04/weighted/healthCheck`</a> | `` |
-| <a id="opt-traefikhttpservicesService04weightedservices0name" href="#opt-traefikhttpservicesService04weightedservices0name" title="#opt-traefikhttpservicesService04weightedservices0name">`traefik/http/services/Service04/weighted/services/0/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedservices0weight" href="#opt-traefikhttpservicesService04weightedservices0weight" title="#opt-traefikhttpservicesService04weightedservices0weight">`traefik/http/services/Service04/weighted/services/0/weight`</a> | `42` |
-| <a id="opt-traefikhttpservicesService04weightedservices1name" href="#opt-traefikhttpservicesService04weightedservices1name" title="#opt-traefikhttpservicesService04weightedservices1name">`traefik/http/services/Service04/weighted/services/1/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedservices1weight" href="#opt-traefikhttpservicesService04weightedservices1weight" title="#opt-traefikhttpservicesService04weightedservices1weight">`traefik/http/services/Service04/weighted/services/1/weight`</a> | `42` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiedomain" href="#opt-traefikhttpservicesService04weightedstickycookiedomain" title="#opt-traefikhttpservicesService04weightedstickycookiedomain">`traefik/http/services/Service04/weighted/sticky/cookie/domain`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiehttpOnly" href="#opt-traefikhttpservicesService04weightedstickycookiehttpOnly" title="#opt-traefikhttpservicesService04weightedstickycookiehttpOnly">`traefik/http/services/Service04/weighted/sticky/cookie/httpOnly`</a> | `true` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiemaxAge" href="#opt-traefikhttpservicesService04weightedstickycookiemaxAge" title="#opt-traefikhttpservicesService04weightedstickycookiemaxAge">`traefik/http/services/Service04/weighted/sticky/cookie/maxAge`</a> | `42` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiename" href="#opt-traefikhttpservicesService04weightedstickycookiename" title="#opt-traefikhttpservicesService04weightedstickycookiename">`traefik/http/services/Service04/weighted/sticky/cookie/name`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiepath" href="#opt-traefikhttpservicesService04weightedstickycookiepath" title="#opt-traefikhttpservicesService04weightedstickycookiepath">`traefik/http/services/Service04/weighted/sticky/cookie/path`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiesameSite" href="#opt-traefikhttpservicesService04weightedstickycookiesameSite" title="#opt-traefikhttpservicesService04weightedstickycookiesameSite">`traefik/http/services/Service04/weighted/sticky/cookie/sameSite`</a> | `foobar` |
-| <a id="opt-traefikhttpservicesService04weightedstickycookiesecure" href="#opt-traefikhttpservicesService04weightedstickycookiesecure" title="#opt-traefikhttpservicesService04weightedstickycookiesecure">`traefik/http/services/Service04/weighted/sticky/cookie/secure`</a> | `true` |
+| <a id="opt-traefikhttpservicesService02highestRandomWeighthealthCheck" href="#opt-traefikhttpservicesService02highestRandomWeighthealthCheck" title="#opt-traefikhttpservicesService02highestRandomWeighthealthCheck">`traefik/http/services/Service02/highestRandomWeight/healthCheck`</a> | `` |
+| <a id="opt-traefikhttpservicesService02highestRandomWeightservices0name" href="#opt-traefikhttpservicesService02highestRandomWeightservices0name" title="#opt-traefikhttpservicesService02highestRandomWeightservices0name">`traefik/http/services/Service02/highestRandomWeight/services/0/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService02highestRandomWeightservices0weight" href="#opt-traefikhttpservicesService02highestRandomWeightservices0weight" title="#opt-traefikhttpservicesService02highestRandomWeightservices0weight">`traefik/http/services/Service02/highestRandomWeight/services/0/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService02highestRandomWeightservices1name" href="#opt-traefikhttpservicesService02highestRandomWeightservices1name" title="#opt-traefikhttpservicesService02highestRandomWeightservices1name">`traefik/http/services/Service02/highestRandomWeight/services/1/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService02highestRandomWeightservices1weight" href="#opt-traefikhttpservicesService02highestRandomWeightservices1weight" title="#opt-traefikhttpservicesService02highestRandomWeightservices1weight">`traefik/http/services/Service02/highestRandomWeight/services/1/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckfollowRedirects" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckfollowRedirects" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckfollowRedirects">`traefik/http/services/Service03/loadBalancer/healthCheck/followRedirects`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname0" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname0" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname0">`traefik/http/services/Service03/loadBalancer/healthCheck/headers/name0`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname1" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname1" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckheadersname1">`traefik/http/services/Service03/loadBalancer/healthCheck/headers/name1`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckhostname" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckhostname" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckhostname">`traefik/http/services/Service03/loadBalancer/healthCheck/hostname`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckinterval" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckinterval" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckinterval">`traefik/http/services/Service03/loadBalancer/healthCheck/interval`</a> | `42s` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckmethod" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckmethod" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckmethod">`traefik/http/services/Service03/loadBalancer/healthCheck/method`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckmode" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckmode" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckmode">`traefik/http/services/Service03/loadBalancer/healthCheck/mode`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckpath" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckpath" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckpath">`traefik/http/services/Service03/loadBalancer/healthCheck/path`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckport" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckport" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckport">`traefik/http/services/Service03/loadBalancer/healthCheck/port`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckscheme" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckscheme" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckscheme">`traefik/http/services/Service03/loadBalancer/healthCheck/scheme`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckstatus" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckstatus" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckstatus">`traefik/http/services/Service03/loadBalancer/healthCheck/status`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthChecktimeout" href="#opt-traefikhttpservicesService03loadBalancerhealthChecktimeout" title="#opt-traefikhttpservicesService03loadBalancerhealthChecktimeout">`traefik/http/services/Service03/loadBalancer/healthCheck/timeout`</a> | `42s` |
+| <a id="opt-traefikhttpservicesService03loadBalancerhealthCheckunhealthyInterval" href="#opt-traefikhttpservicesService03loadBalancerhealthCheckunhealthyInterval" title="#opt-traefikhttpservicesService03loadBalancerhealthCheckunhealthyInterval">`traefik/http/services/Service03/loadBalancer/healthCheck/unhealthyInterval`</a> | `42s` |
+| <a id="opt-traefikhttpservicesService03loadBalancerpassHostHeader" href="#opt-traefikhttpservicesService03loadBalancerpassHostHeader" title="#opt-traefikhttpservicesService03loadBalancerpassHostHeader">`traefik/http/services/Service03/loadBalancer/passHostHeader`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckfailureWindow" href="#opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckfailureWindow" title="#opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckfailureWindow">`traefik/http/services/Service03/loadBalancer/passiveHealthCheck/failureWindow`</a> | `42s` |
+| <a id="opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckmaxFailedAttempts" href="#opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckmaxFailedAttempts" title="#opt-traefikhttpservicesService03loadBalancerpassiveHealthCheckmaxFailedAttempts">`traefik/http/services/Service03/loadBalancer/passiveHealthCheck/maxFailedAttempts`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerresponseForwardingflushInterval" href="#opt-traefikhttpservicesService03loadBalancerresponseForwardingflushInterval" title="#opt-traefikhttpservicesService03loadBalancerresponseForwardingflushInterval">`traefik/http/services/Service03/loadBalancer/responseForwarding/flushInterval`</a> | `42s` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers0preservePath" href="#opt-traefikhttpservicesService03loadBalancerservers0preservePath" title="#opt-traefikhttpservicesService03loadBalancerservers0preservePath">`traefik/http/services/Service03/loadBalancer/servers/0/preservePath`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers0url" href="#opt-traefikhttpservicesService03loadBalancerservers0url" title="#opt-traefikhttpservicesService03loadBalancerservers0url">`traefik/http/services/Service03/loadBalancer/servers/0/url`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers0weight" href="#opt-traefikhttpservicesService03loadBalancerservers0weight" title="#opt-traefikhttpservicesService03loadBalancerservers0weight">`traefik/http/services/Service03/loadBalancer/servers/0/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers1preservePath" href="#opt-traefikhttpservicesService03loadBalancerservers1preservePath" title="#opt-traefikhttpservicesService03loadBalancerservers1preservePath">`traefik/http/services/Service03/loadBalancer/servers/1/preservePath`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers1url" href="#opt-traefikhttpservicesService03loadBalancerservers1url" title="#opt-traefikhttpservicesService03loadBalancerservers1url">`traefik/http/services/Service03/loadBalancer/servers/1/url`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerservers1weight" href="#opt-traefikhttpservicesService03loadBalancerservers1weight" title="#opt-traefikhttpservicesService03loadBalancerservers1weight">`traefik/http/services/Service03/loadBalancer/servers/1/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerserversTransport" href="#opt-traefikhttpservicesService03loadBalancerserversTransport" title="#opt-traefikhttpservicesService03loadBalancerserversTransport">`traefik/http/services/Service03/loadBalancer/serversTransport`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiedomain" href="#opt-traefikhttpservicesService03loadBalancerstickycookiedomain" title="#opt-traefikhttpservicesService03loadBalancerstickycookiedomain">`traefik/http/services/Service03/loadBalancer/sticky/cookie/domain`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiehttpOnly" href="#opt-traefikhttpservicesService03loadBalancerstickycookiehttpOnly" title="#opt-traefikhttpservicesService03loadBalancerstickycookiehttpOnly">`traefik/http/services/Service03/loadBalancer/sticky/cookie/httpOnly`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiemaxAge" href="#opt-traefikhttpservicesService03loadBalancerstickycookiemaxAge" title="#opt-traefikhttpservicesService03loadBalancerstickycookiemaxAge">`traefik/http/services/Service03/loadBalancer/sticky/cookie/maxAge`</a> | `42` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiename" href="#opt-traefikhttpservicesService03loadBalancerstickycookiename" title="#opt-traefikhttpservicesService03loadBalancerstickycookiename">`traefik/http/services/Service03/loadBalancer/sticky/cookie/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiepath" href="#opt-traefikhttpservicesService03loadBalancerstickycookiepath" title="#opt-traefikhttpservicesService03loadBalancerstickycookiepath">`traefik/http/services/Service03/loadBalancer/sticky/cookie/path`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiesameSite" href="#opt-traefikhttpservicesService03loadBalancerstickycookiesameSite" title="#opt-traefikhttpservicesService03loadBalancerstickycookiesameSite">`traefik/http/services/Service03/loadBalancer/sticky/cookie/sameSite`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstickycookiesecure" href="#opt-traefikhttpservicesService03loadBalancerstickycookiesecure" title="#opt-traefikhttpservicesService03loadBalancerstickycookiesecure">`traefik/http/services/Service03/loadBalancer/sticky/cookie/secure`</a> | `true` |
+| <a id="opt-traefikhttpservicesService03loadBalancerstrategy" href="#opt-traefikhttpservicesService03loadBalancerstrategy" title="#opt-traefikhttpservicesService03loadBalancerstrategy">`traefik/http/services/Service03/loadBalancer/strategy`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService04mirroringhealthCheck" href="#opt-traefikhttpservicesService04mirroringhealthCheck" title="#opt-traefikhttpservicesService04mirroringhealthCheck">`traefik/http/services/Service04/mirroring/healthCheck`</a> | `` |
+| <a id="opt-traefikhttpservicesService04mirroringmaxBodySize" href="#opt-traefikhttpservicesService04mirroringmaxBodySize" title="#opt-traefikhttpservicesService04mirroringmaxBodySize">`traefik/http/services/Service04/mirroring/maxBodySize`</a> | `42` |
+| <a id="opt-traefikhttpservicesService04mirroringmirrorBody" href="#opt-traefikhttpservicesService04mirroringmirrorBody" title="#opt-traefikhttpservicesService04mirroringmirrorBody">`traefik/http/services/Service04/mirroring/mirrorBody`</a> | `true` |
+| <a id="opt-traefikhttpservicesService04mirroringmirrors0name" href="#opt-traefikhttpservicesService04mirroringmirrors0name" title="#opt-traefikhttpservicesService04mirroringmirrors0name">`traefik/http/services/Service04/mirroring/mirrors/0/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService04mirroringmirrors0percent" href="#opt-traefikhttpservicesService04mirroringmirrors0percent" title="#opt-traefikhttpservicesService04mirroringmirrors0percent">`traefik/http/services/Service04/mirroring/mirrors/0/percent`</a> | `42` |
+| <a id="opt-traefikhttpservicesService04mirroringmirrors1name" href="#opt-traefikhttpservicesService04mirroringmirrors1name" title="#opt-traefikhttpservicesService04mirroringmirrors1name">`traefik/http/services/Service04/mirroring/mirrors/1/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService04mirroringmirrors1percent" href="#opt-traefikhttpservicesService04mirroringmirrors1percent" title="#opt-traefikhttpservicesService04mirroringmirrors1percent">`traefik/http/services/Service04/mirroring/mirrors/1/percent`</a> | `42` |
+| <a id="opt-traefikhttpservicesService04mirroringservice" href="#opt-traefikhttpservicesService04mirroringservice" title="#opt-traefikhttpservicesService04mirroringservice">`traefik/http/services/Service04/mirroring/service`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedhealthCheck" href="#opt-traefikhttpservicesService05weightedhealthCheck" title="#opt-traefikhttpservicesService05weightedhealthCheck">`traefik/http/services/Service05/weighted/healthCheck`</a> | `` |
+| <a id="opt-traefikhttpservicesService05weightedservices0name" href="#opt-traefikhttpservicesService05weightedservices0name" title="#opt-traefikhttpservicesService05weightedservices0name">`traefik/http/services/Service05/weighted/services/0/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedservices0weight" href="#opt-traefikhttpservicesService05weightedservices0weight" title="#opt-traefikhttpservicesService05weightedservices0weight">`traefik/http/services/Service05/weighted/services/0/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService05weightedservices1name" href="#opt-traefikhttpservicesService05weightedservices1name" title="#opt-traefikhttpservicesService05weightedservices1name">`traefik/http/services/Service05/weighted/services/1/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedservices1weight" href="#opt-traefikhttpservicesService05weightedservices1weight" title="#opt-traefikhttpservicesService05weightedservices1weight">`traefik/http/services/Service05/weighted/services/1/weight`</a> | `42` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiedomain" href="#opt-traefikhttpservicesService05weightedstickycookiedomain" title="#opt-traefikhttpservicesService05weightedstickycookiedomain">`traefik/http/services/Service05/weighted/sticky/cookie/domain`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiehttpOnly" href="#opt-traefikhttpservicesService05weightedstickycookiehttpOnly" title="#opt-traefikhttpservicesService05weightedstickycookiehttpOnly">`traefik/http/services/Service05/weighted/sticky/cookie/httpOnly`</a> | `true` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiemaxAge" href="#opt-traefikhttpservicesService05weightedstickycookiemaxAge" title="#opt-traefikhttpservicesService05weightedstickycookiemaxAge">`traefik/http/services/Service05/weighted/sticky/cookie/maxAge`</a> | `42` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiename" href="#opt-traefikhttpservicesService05weightedstickycookiename" title="#opt-traefikhttpservicesService05weightedstickycookiename">`traefik/http/services/Service05/weighted/sticky/cookie/name`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiepath" href="#opt-traefikhttpservicesService05weightedstickycookiepath" title="#opt-traefikhttpservicesService05weightedstickycookiepath">`traefik/http/services/Service05/weighted/sticky/cookie/path`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiesameSite" href="#opt-traefikhttpservicesService05weightedstickycookiesameSite" title="#opt-traefikhttpservicesService05weightedstickycookiesameSite">`traefik/http/services/Service05/weighted/sticky/cookie/sameSite`</a> | `foobar` |
+| <a id="opt-traefikhttpservicesService05weightedstickycookiesecure" href="#opt-traefikhttpservicesService05weightedstickycookiesecure" title="#opt-traefikhttpservicesService05weightedstickycookiesecure">`traefik/http/services/Service05/weighted/sticky/cookie/secure`</a> | `true` |
 | <a id="opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange0" href="#opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange0" title="#opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange0">`traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/0`</a> | `foobar` |
 | <a id="opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange1" href="#opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange1" title="#opt-traefiktcpmiddlewaresTCPMiddleware01ipAllowListsourceRange1">`traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/1`</a> | `foobar` |
 | <a id="opt-traefiktcpmiddlewaresTCPMiddleware02ipWhiteListsourceRange0" href="#opt-traefiktcpmiddlewaresTCPMiddleware02ipWhiteListsourceRange0" title="#opt-traefiktcpmiddlewaresTCPMiddleware02ipWhiteListsourceRange0">`traefik/tcp/middlewares/TCPMiddleware02/ipWhiteList/sourceRange/0`</a> | `foobar` |
@@ -365,7 +372,6 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-traefiktcproutersTCPRouter1tlspassthrough" href="#opt-traefiktcproutersTCPRouter1tlspassthrough" title="#opt-traefiktcproutersTCPRouter1tlspassthrough">`traefik/tcp/routers/TCPRouter1/tls/passthrough`</a> | `true` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0dialKeepAlive" href="#opt-traefiktcpserversTransportsTCPServersTransport0dialKeepAlive" title="#opt-traefiktcpserversTransportsTCPServersTransport0dialKeepAlive">`traefik/tcp/serversTransports/TCPServersTransport0/dialKeepAlive`</a> | `42s` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0dialTimeout" href="#opt-traefiktcpserversTransportsTCPServersTransport0dialTimeout" title="#opt-traefiktcpserversTransportsTCPServersTransport0dialTimeout">`traefik/tcp/serversTransports/TCPServersTransport0/dialTimeout`</a> | `42s` |
-| <a id="opt-traefiktcpserversTransportsTCPServersTransport0proxyProtocolversion" href="#opt-traefiktcpserversTransportsTCPServersTransport0proxyProtocolversion" title="#opt-traefiktcpserversTransportsTCPServersTransport0proxyProtocolversion">`traefik/tcp/serversTransports/TCPServersTransport0/proxyProtocol/version`</a> | `42` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0terminationDelay" href="#opt-traefiktcpserversTransportsTCPServersTransport0terminationDelay" title="#opt-traefiktcpserversTransportsTCPServersTransport0terminationDelay">`traefik/tcp/serversTransports/TCPServersTransport0/terminationDelay`</a> | `42s` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0certFile" href="#opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0certFile" title="#opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0certFile">`traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/certFile`</a> | `foobar` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0keyFile" href="#opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0keyFile" title="#opt-traefiktcpserversTransportsTCPServersTransport0tlscertificates0keyFile">`traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/keyFile`</a> | `foobar` |
@@ -381,7 +387,6 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport0tlsspiffetrustDomain" href="#opt-traefiktcpserversTransportsTCPServersTransport0tlsspiffetrustDomain" title="#opt-traefiktcpserversTransportsTCPServersTransport0tlsspiffetrustDomain">`traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/trustDomain`</a> | `foobar` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport1dialKeepAlive" href="#opt-traefiktcpserversTransportsTCPServersTransport1dialKeepAlive" title="#opt-traefiktcpserversTransportsTCPServersTransport1dialKeepAlive">`traefik/tcp/serversTransports/TCPServersTransport1/dialKeepAlive`</a> | `42s` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport1dialTimeout" href="#opt-traefiktcpserversTransportsTCPServersTransport1dialTimeout" title="#opt-traefiktcpserversTransportsTCPServersTransport1dialTimeout">`traefik/tcp/serversTransports/TCPServersTransport1/dialTimeout`</a> | `42s` |
-| <a id="opt-traefiktcpserversTransportsTCPServersTransport1proxyProtocolversion" href="#opt-traefiktcpserversTransportsTCPServersTransport1proxyProtocolversion" title="#opt-traefiktcpserversTransportsTCPServersTransport1proxyProtocolversion">`traefik/tcp/serversTransports/TCPServersTransport1/proxyProtocol/version`</a> | `42` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport1terminationDelay" href="#opt-traefiktcpserversTransportsTCPServersTransport1terminationDelay" title="#opt-traefiktcpserversTransportsTCPServersTransport1terminationDelay">`traefik/tcp/serversTransports/TCPServersTransport1/terminationDelay`</a> | `42s` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0certFile" href="#opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0certFile" title="#opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0certFile">`traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/certFile`</a> | `foobar` |
 | <a id="opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0keyFile" href="#opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0keyFile" title="#opt-traefiktcpserversTransportsTCPServersTransport1tlscertificates0keyFile">`traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/keyFile`</a> | `foobar` |
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
index 7c40866ea..3debb5926 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutes.traefik.io
 spec:
   group: traefik.io
@@ -43,11 +43,31 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
                 type: array
+              parentRefs:
+                description: |-
+                  ParentRefs defines references to parent IngressRoute resources for multi-layer routing.
+                  When set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.
+                  More info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs
+                items:
+                  description: IngressRouteRef is a reference to an IngressRoute resource.
+                  properties:
+                    name:
+                      description: Name defines the name of the referenced IngressRoute
+                        resource.
+                      type: string
+                    namespace:
+                      description: Namespace defines the namespace of the referenced
+                        IngressRoute resource.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
               routes:
                 description: Routes defines the list of routes.
                 items:
@@ -64,12 +84,12 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: |-
                         Middlewares defines the list of references to Middleware resources.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/middleware/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/
                       items:
                         description: MiddlewareRef is a reference to a Middleware
                           resource.
@@ -89,7 +109,7 @@ spec:
                     observability:
                       description: |-
                         Observability defines the observability configuration for a router.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/observability/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/
                       properties:
                         accessLogs:
                           description: AccessLogs enables access logs for this router.
@@ -112,7 +132,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -227,6 +247,25 @@ spec:
                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                               By default, passHostHeader is true.
                             type: boolean
+                          passiveHealthCheck:
+                            description: PassiveHealthCheck defines passive health
+                              checks for ExternalName services.
+                            properties:
+                              failureWindow:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: FailureWindow defines the time window
+                                  during which the failed attempts must occur for
+                                  the server to be marked as unhealthy. It also defines
+                                  for how long the server will be considered unhealthy.
+                                x-kubernetes-int-or-string: true
+                              maxFailedAttempts:
+                                description: MaxFailedAttempts is the number of consecutive
+                                  failed attempts allowed within the failure window
+                                  before marking the server as unhealthy.
+                                type: integer
+                            type: object
                           port:
                             anyOf:
                             - type: integer
@@ -263,7 +302,7 @@ spec:
                           sticky:
                             description: |-
                               Sticky defines the sticky sessions configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                             properties:
                               cookie:
                                 description: Cookie defines the sticky cookie configuration.
@@ -312,11 +351,13 @@ spec:
                           strategy:
                             description: |-
                               Strategy defines the load balancing strategy between the servers.
-                              Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                              Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                               RoundRobin value is deprecated and supported for backward compatibility.
                             enum:
                             - wrr
                             - p2c
+                            - hrw
+                            - leasttime
                             - RoundRobin
                             type: string
                           weight:
@@ -332,7 +373,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       type: string
                   required:
@@ -342,18 +383,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -372,17 +413,17 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-options/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/
                     properties:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                     required:
                     - name
@@ -399,12 +440,12 @@ spec:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                     required:
                     - name
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
index 37a02f2fb..c7006f6d0 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutetcps.traefik.io
 spec:
   group: traefik.io
@@ -43,7 +43,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
@@ -56,7 +56,7 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: Middlewares defines the list of references to MiddlewareTCP
@@ -80,7 +80,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -122,7 +122,7 @@ spec:
                           proxyProtocol:
                             description: |-
                               ProxyProtocol defines the PROXY protocol configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/service/#proxy-protocol
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol
                               Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
                             properties:
                               version:
@@ -164,7 +164,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       enum:
                       - v3
@@ -177,18 +177,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration on a layer 4 / TCP Route.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -207,7 +207,7 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#tls-options
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options
                     properties:
                       name:
                         description: Name defines the name of the referenced Traefik
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
index dc08ce018..d5e8d0857 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressrouteudps.traefik.io
 spec:
   group: traefik.io
@@ -43,7 +43,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml b/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
index 5321da0b0..f0999cf22 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewares.traefik.io
 spec:
   group: traefik.io
@@ -19,7 +19,7 @@ spec:
       openAPIV3Schema:
         description: |-
           Middleware is the CRD implementation of a Traefik Middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -45,7 +45,7 @@ spec:
                 description: |-
                   AddPrefix holds the add prefix middleware configuration.
                   This middleware updates the path of a request before forwarding it.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/addprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/
                 properties:
                   prefix:
                     description: |-
@@ -60,12 +60,12 @@ spec:
                 description: |-
                   BasicAuth holds the basic auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -86,7 +86,7 @@ spec:
                 description: |-
                   Buffering holds the buffering middleware configuration.
                   This middleware retries or limits the size of requests that can be forwarded to backends.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#maxrequestbodybytes
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes
                 properties:
                   maxRequestBodyBytes:
                     description: |-
@@ -118,14 +118,14 @@ spec:
                     description: |-
                       RetryExpression defines the retry conditions.
                       It is a logical combination of functions with operators AND (&&) and OR (||).
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#retryexpression
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression
                     type: string
                 type: object
               chain:
                 description: |-
                   Chain holds the configuration of the chain middleware.
                   This middleware enables to define reusable combinations of other pieces of middleware.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/chain/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/
                 properties:
                   middlewares:
                     description: Middlewares is the list of MiddlewareRef which composes
@@ -188,7 +188,7 @@ spec:
                 description: |-
                   Compress holds the compress middleware configuration.
                   This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/compress/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/
                 properties:
                   defaultEncoding:
                     description: DefaultEncoding specifies the default encoding if
@@ -238,12 +238,12 @@ spec:
                 description: |-
                   DigestAuth holds the digest auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -263,7 +263,7 @@ spec:
                 description: |-
                   ErrorPage holds the custom error middleware configuration.
                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/
                 properties:
                   query:
                     description: |-
@@ -275,7 +275,7 @@ spec:
                   service:
                     description: |-
                       Service defines the reference to a Kubernetes Service that will serve the error page.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/#service
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service
                     properties:
                       healthCheck:
                         description: Healthcheck defines health checks for ExternalName
@@ -381,6 +381,25 @@ spec:
                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                           By default, passHostHeader is true.
                         type: boolean
+                      passiveHealthCheck:
+                        description: PassiveHealthCheck defines passive health checks
+                          for ExternalName services.
+                        properties:
+                          failureWindow:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: FailureWindow defines the time window during
+                              which the failed attempts must occur for the server
+                              to be marked as unhealthy. It also defines for how long
+                              the server will be considered unhealthy.
+                            x-kubernetes-int-or-string: true
+                          maxFailedAttempts:
+                            description: MaxFailedAttempts is the number of consecutive
+                              failed attempts allowed within the failure window before
+                              marking the server as unhealthy.
+                            type: integer
+                        type: object
                       port:
                         anyOf:
                         - type: integer
@@ -417,7 +436,7 @@ spec:
                       sticky:
                         description: |-
                           Sticky defines the sticky sessions configuration.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                         properties:
                           cookie:
                             description: Cookie defines the sticky cookie configuration.
@@ -465,11 +484,13 @@ spec:
                       strategy:
                         description: |-
                           Strategy defines the load balancing strategy between the servers.
-                          Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                          Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                           RoundRobin value is deprecated and supported for backward compatibility.
                         enum:
                         - wrr
                         - p2c
+                        - hrw
+                        - leasttime
                         - RoundRobin
                         type: string
                       weight:
@@ -504,7 +525,7 @@ spec:
                 description: |-
                   ForwardAuth holds the forward auth middleware configuration.
                   This middleware delegates the request authentication to a Service.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/
                 properties:
                   addAuthCookiesToResponse:
                     description: AddAuthCookiesToResponse defines the list of cookies
@@ -532,7 +553,7 @@ spec:
                   authResponseHeadersRegex:
                     description: |-
                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
                     type: string
                   forwardBody:
                     description: ForwardBody defines whether to send the request body
@@ -541,7 +562,7 @@ spec:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
                     type: string
                   maxBodySize:
                     description: MaxBodySize defines the maximum body size in bytes
@@ -603,7 +624,7 @@ spec:
                 description: |-
                   Headers holds the headers middleware configuration.
                   This middleware manages the requests and responses headers.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/headers/#customrequestheaders
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders
                 properties:
                   accessControlAllowCredentials:
                     description: AccessControlAllowCredentials defines whether the
@@ -775,7 +796,7 @@ spec:
                 description: |-
                   InFlightReq holds the in-flight request middleware configuration.
                   This middleware limits the number of requests being processed and served concurrently.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/
                 properties:
                   amount:
                     description: |-
@@ -789,12 +810,12 @@ spec:
                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
                       If several strategies are defined at the same time, an error will be raised.
                       If none are set, the default is to use the requestHost.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/#sourcecriterion
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion
                     properties:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -830,12 +851,12 @@ spec:
                 description: |-
                   IPAllowList holds the IP allowlist middleware configuration.
                   This middleware limits allowed requests based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/
                 properties:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -873,7 +894,7 @@ spec:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -904,7 +925,7 @@ spec:
                 description: |-
                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
                   This middleware adds the selected data from the passed client TLS certificate to a header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/passtlsclientcert/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/
                 properties:
                   info:
                     description: Info selects the specific client certificate details
@@ -1007,13 +1028,13 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 description: |-
                   Plugin defines the middleware plugin configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/#community-middlewares
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares
                 type: object
               rateLimit:
                 description: |-
                   RateLimit holds the rate limit configuration.
                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/ratelimit/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/
                 properties:
                   average:
                     description: |-
@@ -1132,7 +1153,7 @@ spec:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -1168,7 +1189,7 @@ spec:
                 description: |-
                   RedirectRegex holds the redirect regex middleware configuration.
                   This middleware redirects a request using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectregex/#regex
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex
                 properties:
                   permanent:
                     description: Permanent defines whether the redirection is permanent
@@ -1187,11 +1208,12 @@ spec:
                 description: |-
                   RedirectScheme holds the redirect scheme middleware configuration.
                   This middleware redirects requests from a scheme/port to another.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectscheme/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/
                 properties:
                   permanent:
-                    description: Permanent defines whether the redirection is permanent
-                      (308).
+                    description: |-
+                      Permanent defines whether the redirection is permanent.
+                      For HTTP GET requests a 301 is returned, otherwise a 308 is returned.
                     type: boolean
                   port:
                     description: Port defines the port of the new URL.
@@ -1204,7 +1226,7 @@ spec:
                 description: |-
                   ReplacePath holds the replace path middleware configuration.
                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepath/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/
                 properties:
                   path:
                     description: Path defines the path to use as replacement in the
@@ -1215,7 +1237,7 @@ spec:
                 description: |-
                   ReplacePathRegex holds the replace path regex middleware configuration.
                   This middleware replaces the path of a URL using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepathregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression used to match
@@ -1231,7 +1253,7 @@ spec:
                   Retry holds the retry middleware configuration.
                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/retry/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/
                 properties:
                   attempts:
                     description: Attempts defines how many times the request should
@@ -1255,7 +1277,7 @@ spec:
                 description: |-
                   StripPrefix holds the strip prefix middleware configuration.
                   This middleware removes the specified prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/
                 properties:
                   forceSlash:
                     description: |-
@@ -1274,7 +1296,7 @@ spec:
                 description: |-
                   StripPrefixRegex holds the strip prefix regex middleware configuration.
                   This middleware removes the matching prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefixregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression to match the
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
index 5f7604923..b2a19f9d5 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewaretcps.traefik.io
 spec:
   group: traefik.io
@@ -19,7 +19,7 @@ spec:
       openAPIV3Schema:
         description: |-
           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -56,7 +56,7 @@ spec:
                 description: |-
                   IPAllowList defines the IPAllowList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
@@ -70,7 +70,7 @@ spec:
                   IPWhiteList defines the IPWhiteList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
                   Deprecated: please use IPAllowList instead.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipwhitelist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml b/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
index 0828291ee..d5ec61903 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransports.traefik.io
 spec:
   group: traefik.io
@@ -21,7 +21,7 @@ spec:
           ServersTransport is the CRD implementation of a ServersTransport.
           If no serversTransport is specified, the default@internal will be used.
           The default@internal serversTransport is created from the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/
         properties:
           apiVersion:
             description: |-
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
index f8be2b1d9..79469823b 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransporttcps.traefik.io
 spec:
   group: traefik.io
@@ -21,7 +21,7 @@ spec:
           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
           If no tcpServersTransport is specified, a default one named default@internal will be used.
           The default@internal tcpServersTransport can be configured in the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/
         properties:
           apiVersion:
             description: |-
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml b/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
index c32974fae..5f37cb023 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsoptions.traefik.io
 spec:
   group: traefik.io
@@ -19,7 +19,7 @@ spec:
       openAPIV3Schema:
         description: |-
           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
         properties:
           apiVersion:
             description: |-
@@ -44,14 +44,14 @@ spec:
               alpnProtocols:
                 description: |-
                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
                 items:
                   type: string
                 type: array
               cipherSuites:
                 description: |-
                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
                 items:
                   type: string
                 type: array
@@ -79,7 +79,7 @@ spec:
               curvePreferences:
                 description: |-
                   CurvePreferences defines the preferred elliptic curves.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
                 items:
                   type: string
                 type: array
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml b/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
index 779c93908..7fbf65443 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsstores.traefik.io
 spec:
   group: traefik.io
@@ -21,7 +21,7 @@ spec:
           TLSStore is the CRD implementation of a Traefik TLS Store.
           For the time being, only the TLSStore named default is supported.
           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
         properties:
           apiVersion:
             description: |-
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml b/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
index 77e97156b..a51ddc0a4 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: traefikservices.traefik.io
 spec:
   group: traefik.io
@@ -22,7 +22,7 @@ spec:
           TraefikService object allows to:
           - Apply weight to Services on load-balancing
           - Mirror traffic on services
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/
         properties:
           apiVersion:
             description: |-
@@ -44,6 +44,244 @@ spec:
           spec:
             description: TraefikServiceSpec defines the desired state of a TraefikService.
             properties:
+              highestRandomWeight:
+                description: HighestRandomWeight defines the highest random weight
+                  service configuration.
+                properties:
+                  services:
+                    description: Services defines the list of Kubernetes Service and/or
+                      TraefikService to load-balance, with weight.
+                    items:
+                      description: Service defines an upstream HTTP service to proxy
+                        traffic to.
+                      properties:
+                        healthCheck:
+                          description: Healthcheck defines health checks for ExternalName
+                            services.
+                          properties:
+                            followRedirects:
+                              description: |-
+                                FollowRedirects defines whether redirects should be followed during the health check calls.
+                                Default: true
+                              type: boolean
+                            headers:
+                              additionalProperties:
+                                type: string
+                              description: Headers defines custom headers to be sent
+                                to the health check endpoint.
+                              type: object
+                            hostname:
+                              description: Hostname defines the value of hostname
+                                in the Host header of the health check request.
+                              type: string
+                            interval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Interval defines the frequency of the health check calls for healthy targets.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                            method:
+                              description: Method defines the healthcheck method.
+                              type: string
+                            mode:
+                              description: |-
+                                Mode defines the health check mode.
+                                If defined to grpc, will use the gRPC health check protocol to probe the server.
+                                Default: http
+                              type: string
+                            path:
+                              description: Path defines the server URL path for the
+                                health check endpoint.
+                              type: string
+                            port:
+                              description: Port defines the server URL port for the
+                                health check endpoint.
+                              type: integer
+                            scheme:
+                              description: Scheme replaces the server URL scheme for
+                                the health check endpoint.
+                              type: string
+                            status:
+                              description: Status defines the expected HTTP status
+                                code of the response to the health check request.
+                              type: integer
+                            timeout:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
+                                Default: 5s
+                              x-kubernetes-int-or-string: true
+                            unhealthyInterval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+                                When UnhealthyInterval is not defined, it defaults to the Interval value.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        kind:
+                          description: Kind defines the kind of the Service.
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: |-
+                            Name defines the name of the referenced Kubernetes Service or TraefikService.
+                            The differentiation between the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Kubernetes Service or TraefikService.
+                          type: string
+                        nativeLB:
+                          description: |-
+                            NativeLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
+                            The Kubernetes Service itself does load-balance to the pods.
+                            By default, NativeLB is false.
+                          type: boolean
+                        nodePortLB:
+                          description: |-
+                            NodePortLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
+                            It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
+                            By default, NodePortLB is false.
+                          type: boolean
+                        passHostHeader:
+                          description: |-
+                            PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
+                            By default, passHostHeader is true.
+                          type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          description: |-
+                            Port defines the port of a Kubernetes Service.
+                            This can be a reference to a named port.
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding defines how Traefik forwards
+                            the response from the upstream Kubernetes Service to the
+                            client.
+                          properties:
+                            flushInterval:
+                              description: |-
+                                FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
+                                A negative value means to flush immediately after each write to the client.
+                                This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
+                                for such responses, writes are flushed to the client immediately.
+                                Default: 100ms
+                              type: string
+                          type: object
+                        scheme:
+                          description: |-
+                            Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
+                            It defaults to https when Kubernetes Service port is 443, http otherwise.
+                          type: string
+                        serversTransport:
+                          description: |-
+                            ServersTransport defines the name of ServersTransport resource to use.
+                            It allows to configure the transport between Traefik and your servers.
+                            Can only be used on a Kubernetes Service.
+                          type: string
+                        sticky:
+                          description: |-
+                            Sticky defines the sticky sessions configuration.
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          properties:
+                            cookie:
+                              description: Cookie defines the sticky cookie configuration.
+                              properties:
+                                domain:
+                                  description: |-
+                                    Domain defines the host to which the cookie will be sent.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
+                                  type: string
+                                httpOnly:
+                                  description: HTTPOnly defines whether the cookie
+                                    can be accessed by client-side APIs, such as JavaScript.
+                                  type: boolean
+                                maxAge:
+                                  description: |-
+                                    MaxAge defines the number of seconds until the cookie expires.
+                                    When set to a negative number, the cookie expires immediately.
+                                    When set to zero, the cookie never expires.
+                                  type: integer
+                                name:
+                                  description: Name defines the Cookie name.
+                                  type: string
+                                path:
+                                  description: |-
+                                    Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
+                                    When not provided the cookie will be sent on every request to the domain.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
+                                  type: string
+                                sameSite:
+                                  description: |-
+                                    SameSite defines the same site policy.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+                                  enum:
+                                  - none
+                                  - lax
+                                  - strict
+                                  type: string
+                                secure:
+                                  description: Secure defines whether the cookie can
+                                    only be transmitted over an encrypted connection
+                                    (i.e. HTTPS).
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          description: |-
+                            Strategy defines the load balancing strategy between the servers.
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
+                            RoundRobin value is deprecated and supported for backward compatibility.
+                          enum:
+                          - wrr
+                          - p2c
+                          - hrw
+                          - leasttime
+                          - RoundRobin
+                          type: string
+                        weight:
+                          description: |-
+                            Weight defines the weight and should only be specified when Name references a TraefikService object
+                            (and to be precise, one that embeds a Weighted Round Robin).
+                          minimum: 0
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
               mirroring:
                 description: Mirroring defines the Mirroring service configuration.
                 properties:
@@ -245,6 +483,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         percent:
                           description: |-
                             Percent defines the part of the traffic to mirror.
@@ -286,7 +543,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -334,11 +591,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -379,6 +638,25 @@ spec:
                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                       By default, passHostHeader is true.
                     type: boolean
+                  passiveHealthCheck:
+                    description: PassiveHealthCheck defines passive health checks
+                      for ExternalName services.
+                    properties:
+                      failureWindow:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: FailureWindow defines the time window during
+                          which the failed attempts must occur for the server to be
+                          marked as unhealthy. It also defines for how long the server
+                          will be considered unhealthy.
+                        x-kubernetes-int-or-string: true
+                      maxFailedAttempts:
+                        description: MaxFailedAttempts is the number of consecutive
+                          failed attempts allowed within the failure window before
+                          marking the server as unhealthy.
+                        type: integer
+                    type: object
                   port:
                     anyOf:
                     - type: integer
@@ -414,7 +692,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines the sticky sessions configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
@@ -461,11 +739,13 @@ spec:
                   strategy:
                     description: |-
                       Strategy defines the load balancing strategy between the servers.
-                      Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                      Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                       RoundRobin value is deprecated and supported for backward compatibility.
                     enum:
                     - wrr
                     - p2c
+                    - hrw
+                    - leasttime
                     - RoundRobin
                     type: string
                   weight:
@@ -591,6 +871,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         port:
                           anyOf:
                           - type: integer
@@ -627,7 +926,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -675,11 +974,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -695,7 +996,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines whether sticky sessions are enabled.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
diff --git a/docs/content/reference/install-configuration/api-dashboard.md b/docs/content/reference/install-configuration/api-dashboard.md
index 9f03454ca..42b954d01 100644
--- a/docs/content/reference/install-configuration/api-dashboard.md
+++ b/docs/content/reference/install-configuration/api-dashboard.md
@@ -3,13 +3,27 @@ title: "Traefik API & Dashboard Documentation"
 description: "Traefik Proxy exposes information through API handlers and showcase them on the Dashboard. Learn about the security, configuration, and endpoints of the APIs and Dashboard. Read the technical documentation."
 ---
 
-The dashboard is the central place that shows you the current active routes handled by Traefik.
+Traefik exposes a number of information through API endpoints, such as the configuration of your routers, services, middlewares, etc.
+
+The dashboard, which is the central place that displays the current active routes handled by Traefik, fetches the data from this API.
 
 <figure>
     <img src="../../../assets/img/webui-dashboard.png" alt="Dashboard - Providers" />
     <figcaption>The dashboard in action</figcaption>
 </figure>
 
+## Security
+
+Enabling the API and the dashboard in production is not recommended, because it will expose all configuration elements,
+including sensitive data, for which access should be reserved to administrators.
+
+In production, it should be at least secured by authentication and authorizations.
+
+!!! info
+
+    It's recommended to NOT publicly exposing the API's port, keeping it restricted to internal networks
+    (as in the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), applied to networks).
+
 ## Configuration Example
 
 Enable the dashboard:
@@ -150,7 +164,7 @@ http:
 The API and the dashboard can be configured:
 
 - In the Helm Chart: You can find the options to customize the Traefik installation
-enabing the dashboard [here](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L155).
+enabling the dashboard [here](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L155).
 - In the Traefik Static Configuration as described below.
 
 | Field      | Description  | Default | Required |
@@ -187,6 +201,7 @@ All the following endpoints must be accessed with a `GET` HTTP request.
 | <a id="opt-apientrypoints" href="#opt-apientrypoints" title="#opt-apientrypoints">`/api/entrypoints`</a> | Lists all the entry points information.                                                     |
 | <a id="opt-apientrypointsname" href="#opt-apientrypointsname" title="#opt-apientrypointsname">`/api/entrypoints/{name}`</a> | Returns the information of the entry point specified by `name`.                             |
 | <a id="opt-apioverview" href="#opt-apioverview" title="#opt-apioverview">`/api/overview`</a> | Returns statistic information about HTTP, TCP and about enabled features and providers. |
+| <a id="opt-apisupport-dump" href="#opt-apisupport-dump" title="#opt-apisupport-dump">`/api/support-dump`</a> | Returns an archive that contains the anonymized static configuration and the runtime configuration. |
 | <a id="opt-apirawdata" href="#opt-apirawdata" title="#opt-apirawdata">`/api/rawdata`</a> | Returns information about dynamic configurations, errors, status and dependency relations.  |
 | <a id="opt-apiversion" href="#opt-apiversion" title="#opt-apiversion">`/api/version`</a> | Returns information about Traefik version.                                                  |
 | <a id="opt-debugvars" href="#opt-debugvars" title="#opt-debugvars">`/debug/vars`</a> | See the [expvar](https://golang.org/pkg/expvar/) Go documentation.                          |
@@ -203,14 +218,16 @@ All the following endpoints must be accessed with a `GET` HTTP request.
 
 ## Dashboard
 
-The dashboard is available at the same location as the API, but by default on the path  `/dashboard/`.
+The dashboard is available by default on the path  `/dashboard/`.
 
 !!! note
 
     - The trailing slash `/` in `/dashboard/` is mandatory. This limitation can be mitigated using the the [RedirectRegex Middleware](../../middlewares/http/redirectregex.md).
-	  - There is also a redirect from the path `/` to `/dashboard/`, but you should not rely on this behavior, as it is subject to change and may complicate routing rules.
+    - There is also a redirect from the path `/` to `/dashboard/`.
 
-To securely access the dashboard, you need to define a routing configuration within Traefik. This involves setting up a router attached to the service `api@internal`, which allows you to:
+As mentioned above in the [Security](#security) section, it is important to secure access to both the dashboard and the API.
+You need to define a routing configuration within Traefik.
+This involves setting up a router attached to the service `api@internal`, which allows you to:
 
 - Implement security features using [middlewares](../../middlewares/overview.md), such as authentication ([basicAuth](../../middlewares/http/basicauth.md), [digestAuth](../../middlewares/http/digestauth.md),
   [forwardAuth](../../middlewares/http/forwardauth.md)) or [allowlisting](../../middlewares/http/ipallowlist.md).
@@ -238,4 +255,4 @@ rule = "PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
 rule = "Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/configuration-options.md b/docs/content/reference/install-configuration/configuration-options.md
index 596c69283..3fd9908b0 100644
--- a/docs/content/reference/install-configuration/configuration-options.md
+++ b/docs/content/reference/install-configuration/configuration-options.md
@@ -51,6 +51,7 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-certificatesresolvers-name-acme-certificatesduration" href="#opt-certificatesresolvers-name-acme-certificatesduration" title="#opt-certificatesresolvers-name-acme-certificatesduration">certificatesresolvers._name_.acme.certificatesduration</a> | Certificates' duration in hours. | 2160 |
 | <a id="opt-certificatesresolvers-name-acme-clientresponseheadertimeout" href="#opt-certificatesresolvers-name-acme-clientresponseheadertimeout" title="#opt-certificatesresolvers-name-acme-clientresponseheadertimeout">certificatesresolvers._name_.acme.clientresponseheadertimeout</a> | Timeout for receiving the response headers when communicating with the ACME server. | 30 |
 | <a id="opt-certificatesresolvers-name-acme-clienttimeout" href="#opt-certificatesresolvers-name-acme-clienttimeout" title="#opt-certificatesresolvers-name-acme-clienttimeout">certificatesresolvers._name_.acme.clienttimeout</a> | Timeout for a complete HTTP transaction with the ACME server. | 120 |
+| <a id="opt-certificatesresolvers-name-acme-disablecommonname" href="#opt-certificatesresolvers-name-acme-disablecommonname" title="#opt-certificatesresolvers-name-acme-disablecommonname">certificatesresolvers._name_.acme.disablecommonname</a> | Disable the common name in the CSR. | false |
 | <a id="opt-certificatesresolvers-name-acme-dnschallenge" href="#opt-certificatesresolvers-name-acme-dnschallenge" title="#opt-certificatesresolvers-name-acme-dnschallenge">certificatesresolvers._name_.acme.dnschallenge</a> | Activate DNS-01 Challenge. | false |
 | <a id="opt-certificatesresolvers-name-acme-dnschallenge-delaybeforecheck" href="#opt-certificatesresolvers-name-acme-dnschallenge-delaybeforecheck" title="#opt-certificatesresolvers-name-acme-dnschallenge-delaybeforecheck">certificatesresolvers._name_.acme.dnschallenge.delaybeforecheck</a> | (Deprecated) Assume DNS propagates after a delay in seconds rather than finding and querying nameservers. | 0 |
 | <a id="opt-certificatesresolvers-name-acme-dnschallenge-disablepropagationcheck" href="#opt-certificatesresolvers-name-acme-dnschallenge-disablepropagationcheck" title="#opt-certificatesresolvers-name-acme-dnschallenge-disablepropagationcheck">certificatesresolvers._name_.acme.dnschallenge.disablepropagationcheck</a> | (Deprecated) Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready. [not recommended] | false |
@@ -72,7 +73,8 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-certificatesresolvers-name-acme-preferredchain" href="#opt-certificatesresolvers-name-acme-preferredchain" title="#opt-certificatesresolvers-name-acme-preferredchain">certificatesresolvers._name_.acme.preferredchain</a> | Preferred chain to use. | |
 | <a id="opt-certificatesresolvers-name-acme-profile" href="#opt-certificatesresolvers-name-acme-profile" title="#opt-certificatesresolvers-name-acme-profile">certificatesresolvers._name_.acme.profile</a> | Certificate profile to use. | |
 | <a id="opt-certificatesresolvers-name-acme-storage" href="#opt-certificatesresolvers-name-acme-storage" title="#opt-certificatesresolvers-name-acme-storage">certificatesresolvers._name_.acme.storage</a> | Storage to use. | acme.json |
-| <a id="opt-certificatesresolvers-name-acme-tlschallenge" href="#opt-certificatesresolvers-name-acme-tlschallenge" title="#opt-certificatesresolvers-name-acme-tlschallenge">certificatesresolvers._name_.acme.tlschallenge</a> | Activate TLS-ALPN-01 Challenge. | true |
+| <a id="opt-certificatesresolvers-name-acme-tlschallenge" href="#opt-certificatesresolvers-name-acme-tlschallenge" title="#opt-certificatesresolvers-name-acme-tlschallenge">certificatesresolvers._name_.acme.tlschallenge</a> | Activate TLS-ALPN-01 Challenge. | false |
+| <a id="opt-certificatesresolvers-name-acme-tlschallenge-delay" href="#opt-certificatesresolvers-name-acme-tlschallenge-delay" title="#opt-certificatesresolvers-name-acme-tlschallenge-delay">certificatesresolvers._name_.acme.tlschallenge.delay</a> | Delay between the creation of the challenge and the validation. | 0 |
 | <a id="opt-certificatesresolvers-name-tailscale" href="#opt-certificatesresolvers-name-tailscale" title="#opt-certificatesresolvers-name-tailscale">certificatesresolvers._name_.tailscale</a> | Enables Tailscale certificate resolution. | true |
 | <a id="opt-core-defaultrulesyntax" href="#opt-core-defaultrulesyntax" title="#opt-core-defaultrulesyntax">core.defaultrulesyntax</a> | Defines the rule parser default syntax (v2 or v3) | v3 |
 | <a id="opt-entrypoints-name" href="#opt-entrypoints-name" title="#opt-entrypoints-name">entrypoints._name_</a> | Entry points definition. | false |
@@ -83,6 +85,13 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-entrypoints-name-forwardedheaders-insecure" href="#opt-entrypoints-name-forwardedheaders-insecure" title="#opt-entrypoints-name-forwardedheaders-insecure">entrypoints._name_.forwardedheaders.insecure</a> | Trust all forwarded headers. | false |
 | <a id="opt-entrypoints-name-forwardedheaders-trustedips" href="#opt-entrypoints-name-forwardedheaders-trustedips" title="#opt-entrypoints-name-forwardedheaders-trustedips">entrypoints._name_.forwardedheaders.trustedips</a> | Trust only forwarded headers from selected IPs. | |
 | <a id="opt-entrypoints-name-http" href="#opt-entrypoints-name-http" title="#opt-entrypoints-name-http">entrypoints._name_.http</a> | HTTP configuration. | |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedbackslash" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedbackslash" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedbackslash">entrypoints._name_.http.encodedcharacters.allowencodedbackslash</a> | Defines whether requests with encoded back slash characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedhash" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedhash" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedhash">entrypoints._name_.http.encodedcharacters.allowencodedhash</a> | Defines whether requests with encoded hash characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodednullcharacter" href="#opt-entrypoints-name-http-encodedcharacters-allowencodednullcharacter" title="#opt-entrypoints-name-http-encodedcharacters-allowencodednullcharacter">entrypoints._name_.http.encodedcharacters.allowencodednullcharacter</a> | Defines whether requests with encoded null characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedpercent" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedpercent" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedpercent">entrypoints._name_.http.encodedcharacters.allowencodedpercent</a> | Defines whether requests with encoded percent characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedquestionmark" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedquestionmark" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedquestionmark">entrypoints._name_.http.encodedcharacters.allowencodedquestionmark</a> | Defines whether requests with encoded question mark characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedsemicolon" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedsemicolon" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedsemicolon">entrypoints._name_.http.encodedcharacters.allowencodedsemicolon</a> | Defines whether requests with encoded semicolon characters in the path are allowed. | true |
+| <a id="opt-entrypoints-name-http-encodedcharacters-allowencodedslash" href="#opt-entrypoints-name-http-encodedcharacters-allowencodedslash" title="#opt-entrypoints-name-http-encodedcharacters-allowencodedslash">entrypoints._name_.http.encodedcharacters.allowencodedslash</a> | Defines whether requests with encoded slash characters in the path are allowed. | true |
 | <a id="opt-entrypoints-name-http-encodequerysemicolons" href="#opt-entrypoints-name-http-encodequerysemicolons" title="#opt-entrypoints-name-http-encodequerysemicolons">entrypoints._name_.http.encodequerysemicolons</a> | Defines whether request query semicolons should be URLEncoded. | false |
 | <a id="opt-entrypoints-name-http-maxheaderbytes" href="#opt-entrypoints-name-http-maxheaderbytes" title="#opt-entrypoints-name-http-maxheaderbytes">entrypoints._name_.http.maxheaderbytes</a> | Maximum size of request headers in bytes. | 1048576 |
 | <a id="opt-entrypoints-name-http-middlewares" href="#opt-entrypoints-name-http-middlewares" title="#opt-entrypoints-name-http-middlewares">entrypoints._name_.http.middlewares</a> | Default middlewares for the routers linked to the entry point. | |
@@ -98,6 +107,8 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-entrypoints-name-http-tls-domains0-sans" href="#opt-entrypoints-name-http-tls-domains0-sans" title="#opt-entrypoints-name-http-tls-domains0-sans">entrypoints._name_.http.tls.domains[0].sans</a> | Subject alternative names. | |
 | <a id="opt-entrypoints-name-http-tls-options" href="#opt-entrypoints-name-http-tls-options" title="#opt-entrypoints-name-http-tls-options">entrypoints._name_.http.tls.options</a> | Default TLS options for the routers linked to the entry point. | |
 | <a id="opt-entrypoints-name-http2-maxconcurrentstreams" href="#opt-entrypoints-name-http2-maxconcurrentstreams" title="#opt-entrypoints-name-http2-maxconcurrentstreams">entrypoints._name_.http2.maxconcurrentstreams</a> | Specifies the number of concurrent streams per connection that each client is allowed to initiate. | 250 |
+| <a id="opt-entrypoints-name-http2-maxdecoderheadertablesize" href="#opt-entrypoints-name-http2-maxdecoderheadertablesize" title="#opt-entrypoints-name-http2-maxdecoderheadertablesize">entrypoints._name_.http2.maxdecoderheadertablesize</a> | Specifies the maximum size of the HTTP2 HPACK header table on the decoding (receiving from client) side. | 4096 |
+| <a id="opt-entrypoints-name-http2-maxencoderheadertablesize" href="#opt-entrypoints-name-http2-maxencoderheadertablesize" title="#opt-entrypoints-name-http2-maxencoderheadertablesize">entrypoints._name_.http2.maxencoderheadertablesize</a> | Specifies the maximum size of the HTTP2 HPACK header table on the encoding (sending to client) side. | 4096 |
 | <a id="opt-entrypoints-name-http3" href="#opt-entrypoints-name-http3" title="#opt-entrypoints-name-http3">entrypoints._name_.http3</a> | HTTP/3 configuration. | false |
 | <a id="opt-entrypoints-name-http3-advertisedport" href="#opt-entrypoints-name-http3-advertisedport" title="#opt-entrypoints-name-http3-advertisedport">entrypoints._name_.http3.advertisedport</a> | UDP port to advertise, on which HTTP/3 is available. | 0 |
 | <a id="opt-entrypoints-name-observability-accesslogs" href="#opt-entrypoints-name-observability-accesslogs" title="#opt-entrypoints-name-observability-accesslogs">entrypoints._name_.observability.accesslogs</a> | Enables access-logs for this entryPoint. | true |
@@ -119,6 +130,7 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-experimental-abortonpluginfailure" href="#opt-experimental-abortonpluginfailure" title="#opt-experimental-abortonpluginfailure">experimental.abortonpluginfailure</a> | Defines whether all plugins must be loaded successfully for Traefik to start. | false |
 | <a id="opt-experimental-fastproxy" href="#opt-experimental-fastproxy" title="#opt-experimental-fastproxy">experimental.fastproxy</a> | Enables the FastProxy implementation. | false |
 | <a id="opt-experimental-fastproxy-debug" href="#opt-experimental-fastproxy-debug" title="#opt-experimental-fastproxy-debug">experimental.fastproxy.debug</a> | Enable debug mode for the FastProxy implementation. | false |
+| <a id="opt-experimental-knative" href="#opt-experimental-knative" title="#opt-experimental-knative">experimental.knative</a> | Allow the Knative provider usage. | false |
 | <a id="opt-experimental-kubernetesgateway" href="#opt-experimental-kubernetesgateway" title="#opt-experimental-kubernetesgateway">experimental.kubernetesgateway</a> | (Deprecated) Allow the Kubernetes gateway api provider usage. | false |
 | <a id="opt-experimental-kubernetesingressnginx" href="#opt-experimental-kubernetesingressnginx" title="#opt-experimental-kubernetesingressnginx">experimental.kubernetesingressnginx</a> | Allow the Kubernetes Ingress NGINX provider usage. | false |
 | <a id="opt-experimental-localplugins-name" href="#opt-experimental-localplugins-name" title="#opt-experimental-localplugins-name">experimental.localplugins._name_</a> | Local plugins configuration. | false |
@@ -126,14 +138,14 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-experimental-localplugins-name-settings" href="#opt-experimental-localplugins-name-settings" title="#opt-experimental-localplugins-name-settings">experimental.localplugins._name_.settings</a> | Plugin's settings (works only for wasm plugins). | |
 | <a id="opt-experimental-localplugins-name-settings-envs" href="#opt-experimental-localplugins-name-settings-envs" title="#opt-experimental-localplugins-name-settings-envs">experimental.localplugins._name_.settings.envs</a> | Environment variables to forward to the wasm guest. | |
 | <a id="opt-experimental-localplugins-name-settings-mounts" href="#opt-experimental-localplugins-name-settings-mounts" title="#opt-experimental-localplugins-name-settings-mounts">experimental.localplugins._name_.settings.mounts</a> | Directory to mount to the wasm guest. | |
-| <a id="opt-experimental-localplugins-name-settings-useunsafe" href="#opt-experimental-localplugins-name-settings-useunsafe" title="#opt-experimental-localplugins-name-settings-useunsafe">experimental.localplugins._name_.settings.useunsafe</a> | Allow the plugin to use unsafe package. | false |
+| <a id="opt-experimental-localplugins-name-settings-useunsafe" href="#opt-experimental-localplugins-name-settings-useunsafe" title="#opt-experimental-localplugins-name-settings-useunsafe">experimental.localplugins._name_.settings.useunsafe</a> | Allow the plugin to use unsafe and syscall packages. | false |
 | <a id="opt-experimental-otlplogs" href="#opt-experimental-otlplogs" title="#opt-experimental-otlplogs">experimental.otlplogs</a> | Enables the OpenTelemetry logs integration. | false |
 | <a id="opt-experimental-plugins-name-hash" href="#opt-experimental-plugins-name-hash" title="#opt-experimental-plugins-name-hash">experimental.plugins._name_.hash</a> | plugin's hash to validate' | |
 | <a id="opt-experimental-plugins-name-modulename" href="#opt-experimental-plugins-name-modulename" title="#opt-experimental-plugins-name-modulename">experimental.plugins._name_.modulename</a> | plugin's module name. | |
 | <a id="opt-experimental-plugins-name-settings" href="#opt-experimental-plugins-name-settings" title="#opt-experimental-plugins-name-settings">experimental.plugins._name_.settings</a> | Plugin's settings (works only for wasm plugins). | |
 | <a id="opt-experimental-plugins-name-settings-envs" href="#opt-experimental-plugins-name-settings-envs" title="#opt-experimental-plugins-name-settings-envs">experimental.plugins._name_.settings.envs</a> | Environment variables to forward to the wasm guest. | |
 | <a id="opt-experimental-plugins-name-settings-mounts" href="#opt-experimental-plugins-name-settings-mounts" title="#opt-experimental-plugins-name-settings-mounts">experimental.plugins._name_.settings.mounts</a> | Directory to mount to the wasm guest. | |
-| <a id="opt-experimental-plugins-name-settings-useunsafe" href="#opt-experimental-plugins-name-settings-useunsafe" title="#opt-experimental-plugins-name-settings-useunsafe">experimental.plugins._name_.settings.useunsafe</a> | Allow the plugin to use unsafe package. | false |
+| <a id="opt-experimental-plugins-name-settings-useunsafe" href="#opt-experimental-plugins-name-settings-useunsafe" title="#opt-experimental-plugins-name-settings-useunsafe">experimental.plugins._name_.settings.useunsafe</a> | Allow the plugin to use unsafe and syscall packages. | false |
 | <a id="opt-experimental-plugins-name-version" href="#opt-experimental-plugins-name-version" title="#opt-experimental-plugins-name-version">experimental.plugins._name_.version</a> | plugin's version. | |
 | <a id="opt-global-checknewversion" href="#opt-global-checknewversion" title="#opt-global-checknewversion">global.checknewversion</a> | Periodically check if a new version has been released. | true |
 | <a id="opt-global-sendanonymoususage" href="#opt-global-sendanonymoususage" title="#opt-global-sendanonymoususage">global.sendanonymoususage</a> | Periodically send anonymous usage statistics. If the option is not specified, it will be disabled by default. | false |
@@ -320,6 +332,21 @@ THIS FILE MUST NOT BE EDITED BY HAND
 | <a id="opt-providers-http-tls-cert" href="#opt-providers-http-tls-cert" title="#opt-providers-http-tls-cert">providers.http.tls.cert</a> | TLS cert | |
 | <a id="opt-providers-http-tls-insecureskipverify" href="#opt-providers-http-tls-insecureskipverify" title="#opt-providers-http-tls-insecureskipverify">providers.http.tls.insecureskipverify</a> | TLS insecure skip verify | false |
 | <a id="opt-providers-http-tls-key" href="#opt-providers-http-tls-key" title="#opt-providers-http-tls-key">providers.http.tls.key</a> | TLS key | |
+| <a id="opt-providers-knative" href="#opt-providers-knative" title="#opt-providers-knative">providers.knative</a> | Enables Knative provider. | false |
+| <a id="opt-providers-knative-certauthfilepath" href="#opt-providers-knative-certauthfilepath" title="#opt-providers-knative-certauthfilepath">providers.knative.certauthfilepath</a> | Kubernetes certificate authority file path (not needed for in-cluster client). | |
+| <a id="opt-providers-knative-endpoint" href="#opt-providers-knative-endpoint" title="#opt-providers-knative-endpoint">providers.knative.endpoint</a> | Kubernetes server endpoint (required for external cluster client). | |
+| <a id="opt-providers-knative-labelselector" href="#opt-providers-knative-labelselector" title="#opt-providers-knative-labelselector">providers.knative.labelselector</a> | Kubernetes label selector to use. | |
+| <a id="opt-providers-knative-namespaces" href="#opt-providers-knative-namespaces" title="#opt-providers-knative-namespaces">providers.knative.namespaces</a> | Kubernetes namespaces. | |
+| <a id="opt-providers-knative-privateentrypoints" href="#opt-providers-knative-privateentrypoints" title="#opt-providers-knative-privateentrypoints">providers.knative.privateentrypoints</a> | Entrypoint names used to expose the Ingress privately. If empty local Ingresses are skipped. | |
+| <a id="opt-providers-knative-privateservice" href="#opt-providers-knative-privateservice" title="#opt-providers-knative-privateservice">providers.knative.privateservice</a> | Kubernetes service used to expose the networking controller privately. | |
+| <a id="opt-providers-knative-privateservice-name" href="#opt-providers-knative-privateservice-name" title="#opt-providers-knative-privateservice-name">providers.knative.privateservice.name</a> | Name of the Kubernetes service. | |
+| <a id="opt-providers-knative-privateservice-namespace" href="#opt-providers-knative-privateservice-namespace" title="#opt-providers-knative-privateservice-namespace">providers.knative.privateservice.namespace</a> | Namespace of the Kubernetes service. | |
+| <a id="opt-providers-knative-publicentrypoints" href="#opt-providers-knative-publicentrypoints" title="#opt-providers-knative-publicentrypoints">providers.knative.publicentrypoints</a> | Entrypoint names used to expose the Ingress publicly. If empty an Ingress is exposed on all entrypoints. | |
+| <a id="opt-providers-knative-publicservice" href="#opt-providers-knative-publicservice" title="#opt-providers-knative-publicservice">providers.knative.publicservice</a> | Kubernetes service used to expose the networking controller publicly. | |
+| <a id="opt-providers-knative-publicservice-name" href="#opt-providers-knative-publicservice-name" title="#opt-providers-knative-publicservice-name">providers.knative.publicservice.name</a> | Name of the Kubernetes service. | |
+| <a id="opt-providers-knative-publicservice-namespace" href="#opt-providers-knative-publicservice-namespace" title="#opt-providers-knative-publicservice-namespace">providers.knative.publicservice.namespace</a> | Namespace of the Kubernetes service. | |
+| <a id="opt-providers-knative-throttleduration" href="#opt-providers-knative-throttleduration" title="#opt-providers-knative-throttleduration">providers.knative.throttleduration</a> | Ingress refresh throttle duration | 0 |
+| <a id="opt-providers-knative-token" href="#opt-providers-knative-token" title="#opt-providers-knative-token">providers.knative.token</a> | Kubernetes bearer token (not needed for in-cluster client). | |
 | <a id="opt-providers-kubernetescrd" href="#opt-providers-kubernetescrd" title="#opt-providers-kubernetescrd">providers.kubernetescrd</a> | Enables Kubernetes CRD provider. | false |
 | <a id="opt-providers-kubernetescrd-allowcrossnamespace" href="#opt-providers-kubernetescrd-allowcrossnamespace" title="#opt-providers-kubernetescrd-allowcrossnamespace">providers.kubernetescrd.allowcrossnamespace</a> | Allow cross namespace resource reference. | false |
 | <a id="opt-providers-kubernetescrd-allowemptyservices" href="#opt-providers-kubernetescrd-allowemptyservices" title="#opt-providers-kubernetescrd-allowemptyservices">providers.kubernetescrd.allowemptyservices</a> | Allow the creation of services without endpoints. | false |
diff --git a/docs/content/reference/install-configuration/entrypoints.md b/docs/content/reference/install-configuration/entrypoints.md
index 9a41e3bc3..6b1809932 100644
--- a/docs/content/reference/install-configuration/entrypoints.md
+++ b/docs/content/reference/install-configuration/entrypoints.md
@@ -84,8 +84,8 @@ additionalArguments:
 
 ## Configuration Options
 
-| Field                                                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Default                 | Required |
-|:----------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------|:---------|
+| Field                                                                                                                                                                                                                                                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Default                 | Required |
+|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------|:---------|
 | <a id="opt-address" href="#opt-address" title="#opt-address">`address`</a> | Define the port, and optionally the hostname, on which to listen for incoming connections and packets.<br /> It also defines the protocol to use (TCP or UDP).<br /> If no protocol is specified, the default is TCP. The format is:`[host]:port[/tcp\|/udp]                                                                                                                                                                                                                                                                                                                                                                                                                        | -                       | Yes      |
 | <a id="opt-asDefault" href="#opt-asDefault" title="#opt-asDefault">`asDefault`</a> | Mark the `entryPoint` to be in the list of default `entryPoints`.<br /> `entryPoints`in this list are used (by default) on HTTP and TCP routers that do not define their own `entryPoints` option.<br /> More information [here](#asdefault).                                                                                                                                                                                                                                                                                                                                                                                                                                       | false                   | No       |
 | <a id="opt-forwardedHeaders-trustedIPs" href="#opt-forwardedHeaders-trustedIPs" title="#opt-forwardedHeaders-trustedIPs">`forwardedHeaders.trustedIPs`</a> | Set the IPs or CIDR from where Traefik trusts the forwarded headers information (`X-Forwarded-*`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | -                       | No       |
@@ -94,14 +94,25 @@ additionalArguments:
 | <a id="opt-http-redirections-entryPoint-scheme" href="#opt-http-redirections-entryPoint-scheme" title="#opt-http-redirections-entryPoint-scheme">`http.redirections.`<br />`entryPoint.scheme`</a> | The target scheme to use for (permanent) redirection of all incoming requests.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | https                   | No       |
 | <a id="opt-http-redirections-entryPoint-permanent" href="#opt-http-redirections-entryPoint-permanent" title="#opt-http-redirections-entryPoint-permanent">`http.redirections.`<br />`entryPoint.permanent`</a> | Enable permanent redirecting of all incoming requests on an entry point to another one changing the scheme. <br /> The target element, it can be an entry point name (ex: `websecure`), or a port (`:443`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | false                   | No       |
 | <a id="opt-http-redirections-entryPoint-priority" href="#opt-http-redirections-entryPoint-priority" title="#opt-http-redirections-entryPoint-priority">`http.redirections.`<br />`entryPoint.priority`</a> | Default priority applied to the routers attached to the `entryPoint`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | MaxInt32-1 (2147483646) | No       |
+| <a id="opt-http-encodedCharacters" href="#opt-http-encodedCharacters" title="#opt-http-encodedCharacters">`http.encodedCharacters`</a> | Defines which encoded characters are allowed in the request path. More information [here](#encoded-characters).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | false                   | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedSlash" href="#opt-http-encodedCharacters-allowEncodedSlash" title="#opt-http-encodedCharacters-allowEncodedSlash">`http.encodedCharacters.`<br />`allowEncodedSlash`</a> | Defines whether requests with encoded slash characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedBackSlash" href="#opt-http-encodedCharacters-allowEncodedBackSlash" title="#opt-http-encodedCharacters-allowEncodedBackSlash">`http.encodedCharacters.`<br />`allowEncodedBackSlash`</a> | Defines whether requests with encoded back slash characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedNullCharacter" href="#opt-http-encodedCharacters-allowEncodedNullCharacter" title="#opt-http-encodedCharacters-allowEncodedNullCharacter">`http.encodedCharacters.`<br />`allowEncodedNullCharacter`</a> | Defines whether requests with encoded null characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedSemicolon" href="#opt-http-encodedCharacters-allowEncodedSemicolon" title="#opt-http-encodedCharacters-allowEncodedSemicolon">`http.encodedCharacters.`<br />`allowEncodedSemicolon`</a> | Defines whether requests with encoded semicolon characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedPercent" href="#opt-http-encodedCharacters-allowEncodedPercent" title="#opt-http-encodedCharacters-allowEncodedPercent">`http.encodedCharacters.`<br />`allowEncodedPercent`</a> | Defines whether requests with encoded percent characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedQuestionMark" href="#opt-http-encodedCharacters-allowEncodedQuestionMark" title="#opt-http-encodedCharacters-allowEncodedQuestionMark">`http.encodedCharacters.`<br />`allowEncodedQuestionMark`</a> | Defines whether requests with encoded question mark characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | true                    | No       |
+| <a id="opt-http-encodedCharacters-allowEncodedHash" href="#opt-http-encodedCharacters-allowEncodedHash" title="#opt-http-encodedCharacters-allowEncodedHash">`http.encodedCharacters.`<br />`allowEncodedHash`</a> | Defines whether requests with encoded hash characters in the path are allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | true                    | No       |
 | <a id="opt-http-encodeQuerySemicolons" href="#opt-http-encodeQuerySemicolons" title="#opt-http-encodeQuerySemicolons">`http.encodeQuerySemicolons`</a> | Enable query semicolons encoding. <br /> Use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik. <br /> When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.<br /> More information [here](#encodequerysemicolons).                                                                                                                                                                                                                                                                                                                                               | false                   | No       |
 | <a id="opt-http-sanitizePath" href="#opt-http-sanitizePath" title="#opt-http-sanitizePath">`http.sanitizePath`</a> | Defines whether to enable the request path sanitization.<br /> More information [here](#sanitizepath).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | false                   | No       |
+| <a id="opt-http-maxHeaderBytes" href="#opt-http-maxHeaderBytes" title="#opt-http-maxHeaderBytes">`http.maxHeaderBytes`</a> | Set the maximum size of request headers in bytes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | 1048576                 | No       |
 | <a id="opt-http-middlewares" href="#opt-http-middlewares" title="#opt-http-middlewares">`http.middlewares`</a> | Set the list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point. <br />More information [here](#httpmiddlewares).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | -                       | No       |
 | <a id="opt-http-tls" href="#opt-http-tls" title="#opt-http-tls">`http.tls`</a> | Enable TLS on every router attached to the `entryPoint`. <br /> If no certificate are set, a default self-signed certificate is generated by Traefik. <br /> We recommend to not use self signed certificates in production.                                                                                                                                                                                                                                                                                                                                                                                                                                                        | -                       | No       |
 | <a id="opt-http-tls-options" href="#opt-http-tls-options" title="#opt-http-tls-options">`http.tls.options`</a> | Apply TLS options on every router attached to the `entryPoint`. <br /> The TLS options can be overidden per router. <br /> More information in the [dedicated section](../../routing/providers/kubernetes-crd.md#kind-tlsoption).                                                                                                                                                                                                                                                                                                                                                                                                                                                   | -                       | No       |
 | <a id="opt-http-tls-certResolver" href="#opt-http-tls-certResolver" title="#opt-http-tls-certResolver">`http.tls.certResolver`</a> | Apply a certificate resolver on every router attached to the `entryPoint`. <br /> The TLS options can be overidden per router. <br /> More information in the [dedicated section](../install-configuration/tls/certificate-resolvers/overview.md).                                                                                                                                                                                                                                                                                                                                                                                                                                  | -                       | No       |
 | <a id="opt-http2-maxConcurrentStreams" href="#opt-http2-maxConcurrentStreams" title="#opt-http2-maxConcurrentStreams">`http2.maxConcurrentStreams`</a> | Set the number of concurrent streams per connection that each client is allowed to initiate. <br /> The value must be greater than zero.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | 250                     | No       |
-| <a id="opt-http3" href="#opt-http3" title="#opt-http3">`http3`</a> | Enable HTTP/3 protocol on the `entryPoint`. <br /> HTTP/3 requires a TCP `entryPoint`. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this `entryPoint` is the same as the one used for TLS traffic.<br /> More information [here](#http3).                                                                                                                                                                                                                                                                                                                                                                                          | -                       | No       |
+| <a id="opt-http2-maxDecoderHeaderTableSize" href="#opt-http2-maxDecoderHeaderTableSize" title="#opt-http2-maxDecoderHeaderTableSize">`http2.maxDecoderHeaderTableSize`</a> | Set the maximum size of the decoder header compression table. This controls the maximum size of the header cache that the server is willing to maintain so the client does not need to repeatedly send the same header across requests in the same http2 connection. <br /> This value is only a maximum, the other end of the connection can use a lower size.                                                                                                                                                                                                                                                                                                                     | 4096                    | No       |
+| <a id="opt-http2-maxEncoderHeaderTableSize" href="#opt-http2-maxEncoderHeaderTableSize" title="#opt-http2-maxEncoderHeaderTableSize">`http2.maxEncoderHeaderTableSize`</a> | Set the maximum size of the encoder header compression table. This controls the maximum size of the header cache that the server is willing to maintain when sending headers to the client, allowing the server to reduce the amount of duplicate headers it is sending in responses. <br /> This value is only a maximum, the other end of the connection can use a lower size.                                                                                                                                                                                                                                                                                                    | 4096                    | No       |
+| <a id="opt-http3" href="#opt-http3" title="#opt-http3">`http3`</a> | Enable HTTP/3 protocol on the `entryPoint`. <br /> HTTP/3 requires a TCP `entryPoint`. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this `entryPoint` is the same as the one used for TLS traffic.<br /> More information [here](#http3).                                                                                                                                                                                                                                                                                                                                                                                         | -                       | No       |
 | <a id="opt-http3-advertisedPort" href="#opt-http3-advertisedPort" title="#opt-http3-advertisedPort">`http3.advertisedPort`</a> | Set the UDP port to advertise as the HTTP/3 authority. <br /> It defaults to the entryPoint's address port. <br /> It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik is listening.                                                                                                                                                                                                                                                                                                                                                                                                            | -                       | No       |
 | <a id="opt-observability-accessLogs" href="#opt-observability-accessLogs" title="#opt-observability-accessLogs">`observability.accessLogs`</a> | Defines whether a router attached to this EntryPoint produces access-logs by default. Nonetheless, a router defining its own observability configuration will opt-out from this default.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | true                    | No       |
 | <a id="opt-observability-metrics" href="#opt-observability-metrics" title="#opt-observability-metrics">`observability.metrics`</a> | Defines whether a router attached to this EntryPoint produces metrics by default. Nonetheless, a router defining its own observability configuration will opt-out from this default.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | true                    | No       |
@@ -206,6 +217,33 @@ it can lead to unsafe routing when the `sanitizePath` option is set to `false`.
 | <a id="opt-false-6" href="#opt-false-6" title="#opt-false-6">false</a> | /./foo/../bar// | /./foo/../bar//        |
 | <a id="opt-true-6" href="#opt-true-6" title="#opt-true-6">true</a> | /./foo/../bar// | /bar/                  |
 
+### Encoded Characters
+
+You can configure Traefik to control the handling of encoded characters in request paths for security purposes.
+By default, Traefik do not reject requests with path containing certain encoded characters that could be used in path traversal or other security attacks.
+
+!!! info 
+    
+    This check is not done against the request query parameters,
+    but only against the request path as defined in [RFC3986 section-3](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
+
+!!! info "Security Considerations"
+
+    When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) and notably decode encoded reserved characters in the requets path,
+    it is recommended to set these options to `false` to avoid split-view situation and helps prevent path traversal attacks or other malicious attempts to bypass security controls.
+
+Here is the list of the encoded characters that are rejected by default:
+
+| Encoded Character                                                                  | Character               |
+|------------------------------------------------------------------------------------|-------------------------|
+| <a id="opt-2f-or-2F" href="#opt-2f-or-2F" title="#opt-2f-or-2F">`%2f` or `%2F`</a> | `/` (slash)             |
+| <a id="opt-5c-or-5C" href="#opt-5c-or-5C" title="#opt-5c-or-5C">`%5c` or `%5C`</a> | `\` (backslash)         |
+| <a id="opt-00" href="#opt-00" title="#opt-00">`%00`</a> | `NULL` (null character) |
+| <a id="opt-3b-or-3B" href="#opt-3b-or-3B" title="#opt-3b-or-3B">`%3b` or `%3B`</a> | `;` (semicolon)         |
+| <a id="opt-25" href="#opt-25" title="#opt-25">`%25`</a> | `%` (percent)           |
+| <a id="opt-3f-or-3F" href="#opt-3f-or-3F" title="#opt-3f-or-3F">`%3f` or `%3F`</a> | `?` (question mark)     |
+| <a id="opt-23" href="#opt-23" title="#opt-23">`%23`</a> | `#` (hash)              |
+
 ### HTTP3
 
 As HTTP/3 actually uses UDP, when Traefik is configured with a TCP `entryPoint`
diff --git a/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md b/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
index 7fab52d14..147826fc0 100644
--- a/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
+++ b/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
@@ -397,7 +397,7 @@ Example utilizing Docker Compose:
 ```yaml
 services:
   traefik:
-    image: traefik:v3.5
+    image: traefik:v3.6
     environment:
       - TZ=US/Alaska
     command:
@@ -409,4 +409,4 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/docker.md b/docs/content/reference/install-configuration/providers/docker.md
index eff2a9297..47354ae91 100644
--- a/docs/content/reference/install-configuration/providers/docker.md
+++ b/docs/content/reference/install-configuration/providers/docker.md
@@ -420,11 +420,11 @@ You can specify which Docker API Endpoint to use with the directive [`endpoint`]
         - [Traefik and Docker: A Discussion with Docker Captain, Bret Fisher](https://blog.traefik.io/traefik-and-docker-a-discussion-with-docker-captain-bret-fisher-7f0b9a54ff88)
         - [KubeCon EU 2018 Keynote, Running with Scissors, from Liz Rice](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
         - [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container/)
-        - [A thread on Stack Overflow about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
+        - [A thread on Hacker News about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
         - [To DinD or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
         - [Traefik issue GH-4174 about security with Docker socket](https://github.com/traefik/traefik/issues/4174)
         - [Inspecting Docker Activity with Socat](https://developers.redhat.com/blog/2015/02/25/inspecting-docker-activity-with-socat/)
         - [Letting Traefik run on Worker Nodes](https://blog.mikesir87.io/2018/07/letting-traefik-run-on-worker-nodes/)
         - [Docker Socket Proxy from Tecnativa](https://github.com/Tecnativa/docker-socket-proxy)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/knative.md b/docs/content/reference/install-configuration/providers/kubernetes/knative.md
new file mode 100644
index 000000000..810bf2335
--- /dev/null
+++ b/docs/content/reference/install-configuration/providers/kubernetes/knative.md
@@ -0,0 +1,142 @@
+---
+title: "Traefik Knative Documentation"
+description: "Learn how to use the Knative as a provider for configuration discovery in Traefik Proxy. Read the technical documentation."
+---
+
+# Traefik & Knative
+
+The Traefik Knative provider integrates with Knative Serving to provide advanced traffic management and routing capabilities for serverless applications.
+
+[Knative](https://knative.dev) is a Kubernetes-based platform that enables serverless workloads with features like scale-to-zero, 
+automatic scaling, and revision management.
+
+The provider watches Knative `Ingress` resources and automatically configures Traefik routing rules,
+enabling seamless integration between Traefik's networking capabilities and Knative's serverless platform.
+
+## Requirements
+
+{% include-markdown "includes/kubernetes-requirements.md" %}
+
+1. Install/update the Knative CRDs.
+
+    ```bash
+    kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.19.0/serving-crds.yaml
+    ```
+
+2. Install the Knative Serving core components.
+
+    ```bash
+    kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.19.0/serving-core.yaml
+    ```
+
+3. Update the config-network configuration to use the Traefik ingress class.
+
+    ```bash
+       kubectl patch configmap/config-network \
+       -n knative-serving \
+       --type merge \
+       -p '{"data":{"ingress.class":"traefik.ingress.networking.knative.dev"}}'
+    ```
+
+4. Add a custom domain to your Knative configuration (Optional).
+
+    ```bash
+    kubectl patch configmap config-domain \
+      -n knative-serving \
+      --type='merge' \
+      -p='{"data":{"example.com":""}}'
+    ```
+
+5. Install/update the Traefik [RBAC](../../../dynamic-configuration/kubernetes-knative-rbac.yml).
+
+    ```bash
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-knative-rbac.yml
+    ```
+
+## Configuration Example
+
+As this provider is an experimental feature, it needs to be enabled in the experimental and in the provider sections of the configuration.
+You can enable the Knative provider as detailed below:
+
+```yaml tab="File (YAML)"
+experimental:
+  knative: true
+
+providers:
+  knative: {}
+```
+
+```toml tab="File (TOML)"
+[experimental.knative]
+
+[providers.knative]
+```
+
+```bash tab="CLI"
+--experimental.knative=true
+--providers.knative=true
+```
+
+The Knative provider uses the Knative API to retrieve its routing configuration.
+The provider then watches for incoming Knative events and derives the corresponding dynamic configuration from it.
+
+## Configuration Options
+
+<!-- markdownlint-disable MD013 -->
+
+| Field                                                                                                                                                                                                    | Description                                                                                                                                                                                                                                                                                                                                                                          | Default | Required |
+|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| <a id="opt-providers-providersThrottleDuration" href="#opt-providers-providersThrottleDuration" title="#opt-providers-providersThrottleDuration">`providers.providersThrottleDuration`</a> | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.<br />If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.<br />**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s      | No       |
+| <a id="opt-providers-knative-endpoint" href="#opt-providers-knative-endpoint" title="#opt-providers-knative-endpoint">providers.knative.endpoint</a> | Server endpoint URL.<br />More information [here](#endpoint).                                                                                                                                                                                                                                                                                                                        |         |
+| <a id="opt-providers-knative-token" href="#opt-providers-knative-token" title="#opt-providers-knative-token">providers.knative.token</a> | Bearer token used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                                                           |         |
+| <a id="opt-providers-knative-certauthfilepath" href="#opt-providers-knative-certauthfilepath" title="#opt-providers-knative-certauthfilepath">providers.knative.certauthfilepath</a> | Path to the certificate authority file.<br />Used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                           |         |
+| <a id="opt-providers-knative-namespaces" href="#opt-providers-knative-namespaces" title="#opt-providers-knative-namespaces">providers.knative.namespaces</a> | Array of namespaces to watch.<br />If left empty, watch all namespaces.                                                                                                                                                                                                                                                                                                              |         |
+| <a id="opt-providers-knative-labelselector" href="#opt-providers-knative-labelselector" title="#opt-providers-knative-labelselector">providers.knative.labelselector</a> | Allow filtering Knative Ingress objects using label selectors.                                                                                                                                                                                                                                                                                                                       |         |
+| <a id="opt-providers-knative-throttleduration" href="#opt-providers-knative-throttleduration" title="#opt-providers-knative-throttleduration">providers.knative.throttleduration</a> | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.<br />This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.<br />If empty, every event is caught.                                                                                                           | 0       |
+| <a id="opt-providers-knative-privateentrypoints" href="#opt-providers-knative-privateentrypoints" title="#opt-providers-knative-privateentrypoints">providers.knative.privateentrypoints</a> | Entrypoint names used to expose the Ingress privately. If empty local Ingresses are skipped.                                                                                                                                                                                                                                                                                         |         |
+| <a id="opt-providers-knative-privateservice" href="#opt-providers-knative-privateservice" title="#opt-providers-knative-privateservice">providers.knative.privateservice</a> | Kubernetes service used to expose the networking controller privately.                                                                                                                                                                                                                                                                                                               |         |
+| <a id="opt-providers-knative-privateservice-name" href="#opt-providers-knative-privateservice-name" title="#opt-providers-knative-privateservice-name">providers.knative.privateservice.name</a> | Name of the private Kubernetes service.                                                                                                                                                                                                                                                                                                                                              |         |
+| <a id="opt-providers-knative-privateservice-namespace" href="#opt-providers-knative-privateservice-namespace" title="#opt-providers-knative-privateservice-namespace">providers.knative.privateservice.namespace</a> | Namespace of the private Kubernetes service.                                                                                                                                                                                                                                                                                                                                         |         |
+| <a id="opt-providers-knative-publicentrypoints" href="#opt-providers-knative-publicentrypoints" title="#opt-providers-knative-publicentrypoints">providers.knative.publicentrypoints</a> | Entrypoint names used to expose the Ingress publicly. If empty an Ingress is exposed on all entrypoints.                                                                                                                                                                                                                                                                             |         |
+| <a id="opt-providers-knative-publicservice" href="#opt-providers-knative-publicservice" title="#opt-providers-knative-publicservice">providers.knative.publicservice</a> | Kubernetes service used to expose the networking controller publicly.                                                                                                                                                                                                                                                                                                                |         |
+| <a id="opt-providers-knative-publicservice-name" href="#opt-providers-knative-publicservice-name" title="#opt-providers-knative-publicservice-name">providers.knative.publicservice.name</a> | Name of the public Kubernetes service.                                                                                                                                                                                                                                                                                                                                               |         |
+| <a id="opt-providers-knative-publicservice-namespace" href="#opt-providers-knative-publicservice-namespace" title="#opt-providers-knative-publicservice-namespace">providers.knative.publicservice.namespace</a> | Namespace of the public Kubernetes service.                                                                                                                                                                                                                                                                                                                                          |         |
+
+<!-- markdownlint-enable MD013 -->
+
+### `endpoint`
+
+The Kubernetes server endpoint URL.
+
+When deployed into Kubernetes, Traefik reads the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` or `KUBECONFIG` to construct the endpoint.
+
+The access token is looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+Both are mounted automatically when deployed inside Kubernetes.
+
+The endpoint may be specified to override the environment variable values inside a cluster.
+
+When the environment variables are not found, Traefik tries to connect to the Knative API server with an external-cluster client.
+In this case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Knative cluster using the granted authentication and authorization of the associated kubeconfig.
+
+```yaml tab="File (YAML)"
+providers:
+  knative:
+    endpoint: "http://localhost:8080"
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.knative]
+  endpoint = "http://localhost:8080"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.knative.endpoint=http://localhost:8080
+```
+## Routing Configuration
+
+See the dedicated section in [routing](../../../routing-configuration/kubernetes/knative.md).
+
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
index 50ea7ff2d..d89e28bd2 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
@@ -20,10 +20,10 @@ When you install Traefik without using the Helm Chart, or when you are upgrading
 
 ```bash
 # Install Traefik Resource Definitions:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
 
 # Install RBAC for Traefik:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
 ```
 
 ## Configuration Example
@@ -130,4 +130,4 @@ See the dedicated section in [routing](../../../../routing/providers/kubernetes-
 
 For additional information, refer to the [full example](../../../../user-guides/crd-acme/index.md) with Let's Encrypt.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
index bdbf04428..2a59a8300 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
@@ -8,33 +8,33 @@ description: "Learn how to use the Kubernetes Gateway API as a provider for conf
 The Kubernetes Gateway provider is a Traefik implementation of the [Gateway API](https://gateway-api.sigs.k8s.io/)
 specification from the Kubernetes Special Interest Groups (SIGs).
 
-This provider supports Standard version [v1.3.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0) of the Gateway API specification.
+This provider supports Standard version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the Gateway API specification.
 
-It fully supports all HTTP core and some extended features, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels).
+It fully supports all `HTTPRoute` core and some extended features, like `BackendTLSPolicy`, and `GRPCRoute` resources from the [Standard channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels), as well as `TCPRoute`, and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). 
 
-For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.3.0/traefik-traefik).
+For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik).
 
 !!! info "Using The Helm Chart"
 
     When using the Traefik [Helm Chart](../../../../getting-started/install-traefik.md#use-the-helm-chart), the CRDs (Custom Resource Definitions) and RBAC (Role-Based Access Control) are automatically managed for you.
-    The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L130).
+    The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L323).
 
 ## Requirements
 
-{!kubernetes-requirements.md!}
+{% include-markdown "includes/kubernetes-requirements.md" %}
 
 1. Install/update the Kubernetes Gateway API CRDs.
 
     ```bash
     # Install Gateway API CRDs from the Standard channel.
-    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
+    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
     ```
 
 2. Install/update the Traefik [RBAC](../../../dynamic-configuration/kubernetes-gateway-rbac.yml).
 
     ```bash
     # Install Traefik RBACs.
-    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
     ```
 
 ## Configuration Example
@@ -137,4 +137,4 @@ See the dedicated section in [routing](../../../../routing/providers/kubernetes-
     and the dedicated [routing section](../../../../routing/providers/kubernetes-gateway.md)
     in the Traefik documentation.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md
index 2d9e93c1e..aa42c8acb 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md
@@ -3,67 +3,134 @@ title: "Traefik Kubernetes Ingress NGINX Documentation"
 description: "Understand the requirements, routing configuration, and how to set up the Kubernetes Ingress NGINX provider. Read the technical documentation."
 ---
 
-# Traefik & Ingresses with NGINX Annotations 
+# Traefik & Ingresses with NGINX Annotations
 
-The experimental Traefik Kubernetes Ingress NGINX provider is a Kubernetes Ingress controller; i.e,
-it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
-It also supports some of the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) annotations on ingresses to customize their behavior.
+This provider is a Kubernetes Ingress controller that manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
+It also supports many of the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) annotations on Ingresses, enabling teams to migrate from NGINX Ingress Controller to Traefik with minimal configuration changes.
 
-!!! warning "Ingress Discovery"
+!!! warning "NGINX Ingress Controller Retirement"
 
-    The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster,
-    which may lead to duplicated routers if you are also using the Kubernetes Ingress provider.
-    We recommend to use IngressClass for the Ingresses you want to be handled by this provider,
-    or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces.
+    The Kubernetes NGINX Ingress Controller project has announced its retirement in **March 2026** and will no longer receive updates or security patches.
+    Traefik provides a migration path by supporting NGINX annotations, allowing you to transition your workloads without rewriting all your Ingress configurations.
+
+    **→ See the [NGINX to Traefik Migration Guide](../../../../migrate/nginx-to-traefik.md) for step-by-step instructions.**
+
+    For more information about the NGINX Ingress Controller retirement, see the [official Kubernetes blog announcement](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement).
+
+## Requirements
+
+When you install Traefik without using the Helm Chart, 
+ensure that you add/update the [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) for the Traefik Kubernetes Ingress NGINX provider. 
+
+!!! note "Additional RBAC for Namespace Selector"
+
+    When using the `watchNamespaceSelector` option, Traefik requires permissions to list and watch namespaces.
+    These permissions are included in the RBAC configuration below.
+
+```bash
+# Install RBAC for Traefik Ingress NGINX provider:
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-ingress-nginx-rbac.yml
+```
+
+## Ingress Discovery
+
+This provider discovers all Ingresses in the cluster by default, which may lead to duplicated routers if you are also using the standard Kubernetes Ingress provider.
+
+**Best Practices:**
+
+- Use IngressClass to specify which Ingresses should be handled by this provider
+- Configure `watchNamespace` to limit discovery to specific namespaces
+- Use `watchNamespaceSelector` to target Ingresses based on namespace labels
 
 ## Configuration Example
 
-As this provider is an experimental feature, it needs to be enabled in the experimental and in the provider sections of the configuration.
 You can enable the Kubernetes Ingress NGINX provider as detailed below:
 
 ```yaml tab="File (YAML)"
-experimental:
-  kubernetesIngressNGINX: true
-
 providers:
-  kubernetesIngressNGINX: {}
+  kubernetesIngressNGINX:
+    # Namespace discovery
+    watchNamespace: "default"
+    # OR use namespace selector (mutually exclusive with watchNamespace)
+    # watchNamespaceSelector: "environment=production"
+
+    # IngressClass configuration
+    ingressClass: "nginx"
+    controllerClass: "k8s.io/ingress-nginx"
+    watchIngressWithoutClass: false
+    ingressClassByName: false
 ```
 
 ```toml tab="File (TOML)"
-[experimental.kubernetesIngressNGINX]
-
 [providers.kubernetesIngressNGINX]
+  # Namespace discovery
+  watchNamespace = "default"
+  # OR use namespace selector (mutually exclusive with watchNamespace)
+  # watchNamespaceSelector = "environment=production"
+
+  # IngressClass configuration
+  ingressClass = "nginx"
+  controllerClass = "k8s.io/ingress-nginx"
+  watchIngressWithoutClass = false
+  ingressClassByName = false
 ```
 
 ```bash tab="CLI"
---experimental.kubernetesingressnginx=true
 --providers.kubernetesingressnginx=true
+--providers.kubernetesingressnginx.watchnamespace=default
+--providers.kubernetesingressnginx.ingressclass=nginx
+--providers.kubernetesingressnginx.controllerclass=k8s.io/ingress-nginx
+--providers.kubernetesingressnginx.watchingresswithoutclass=false
+--providers.kubernetesingressnginx.ingressclassbyname=false
 ```
 
-The provider then watches for incoming ingresses events, such as the example below,
-and derives the corresponding dynamic configuration from it,
-which in turn creates the resulting routers, services, handlers, etc.
+```yaml tab="Helm Chart Values"
+providers:
+  kubernetesIngressNginx:
+    # -- Enable Kubernetes Ingress NGINX provider
+    enabled: true
+
+    # Namespace discovery
+    # -- Namespace the controller watches for updates to Kubernetes objects
+    # When using rbac.namespaced, it will watch helm release namespace and namespaces listed in this array
+    namespaces:
+      - default
+    # OR use namespace selector (mutually exclusive with namespaces)
+    # namespaceSelector: "environment=production"
+
+    # IngressClass configuration
+    # -- Name of the ingress class this controller satisfies
+    ingressClass: "nginx"
+    # -- Ingress Class Controller value this controller satisfies
+    controllerClass: "k8s.io/ingress-nginx"
+    # -- Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified
+    watchIngressWithoutClass: false
+    # -- Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class
+    ingressClassByName: false
+```
+
+This provider watches for incoming Ingress events and automatically translates NGINX annotations into Traefik's dynamic configuration, creating the corresponding routers, services, middlewares, and other components needed to route traffic to your cluster services.
 
 ## Configuration Options
 <!-- markdownlint-disable MD013 -->
 
-| Field                                                       | Description                                                                                                                                                                                                                                                                                                                                                                          | Default | Required |
-|:------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| <a id="opt-providers-providersThrottleDuration" href="#opt-providers-providersThrottleDuration" title="#opt-providers-providersThrottleDuration">`providers.providersThrottleDuration`</a> | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.<br />If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.<br />**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-endpoint" href="#opt-providers-kubernetesIngressNGINX-endpoint" title="#opt-providers-kubernetesIngressNGINX-endpoint">`providers.kubernetesIngressNGINX.endpoint`</a> | Server endpoint URL.<br />More information [here](#endpoint).                                                                                                                                                                                                                                                                                                                        | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-token" href="#opt-providers-kubernetesIngressNGINX-token" title="#opt-providers-kubernetesIngressNGINX-token">`providers.kubernetesIngressNGINX.token`</a> | Bearer token used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                                                           | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-certAuthFilePath" href="#opt-providers-kubernetesIngressNGINX-certAuthFilePath" title="#opt-providers-kubernetesIngressNGINX-certAuthFilePath">`providers.kubernetesIngressNGINX.certAuthFilePath`</a> | Path to the certificate authority file.<br />Used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                           | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-throttleDuration" href="#opt-providers-kubernetesIngressNGINX-throttleDuration" title="#opt-providers-kubernetesIngressNGINX-throttleDuration">`providers.kubernetesIngressNGINX.throttleDuration`</a> | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.<br />This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.<br />If empty, every event is caught.                                                                                                           | 0s      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-watchNamespace" href="#opt-providers-kubernetesIngressNGINX-watchNamespace" title="#opt-providers-kubernetesIngressNGINX-watchNamespace">`providers.kubernetesIngressNGINX.watchNamespace`</a> | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty.                                                                                                                                                                                                                                                      | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-watchNamespaceSelector" href="#opt-providers-kubernetesIngressNGINX-watchNamespaceSelector" title="#opt-providers-kubernetesIngressNGINX-watchNamespaceSelector">`providers.kubernetesIngressNGINX.watchNamespaceSelector`</a> | Selector selects namespaces the controller watches for updates to Kubernetes objects.                                                                                                                                                                                                                                                                                                | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-ingressClass" href="#opt-providers-kubernetesIngressNGINX-ingressClass" title="#opt-providers-kubernetesIngressNGINX-ingressClass">`providers.kubernetesIngressNGINX.ingressClass`</a> | Name of the ingress class this controller satisfies.                                                                                                                                                                                                                                                                                                                                 | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-controllerClass" href="#opt-providers-kubernetesIngressNGINX-controllerClass" title="#opt-providers-kubernetesIngressNGINX-controllerClass">`providers.kubernetesIngressNGINX.controllerClass`</a> | Ingress Class Controller value this controller satisfies.                                                                                                                                                                                                                                                                                                                            | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass" href="#opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass" title="#opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass">`providers.kubernetesIngressNGINX.watchIngressWithoutClass`</a> | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified.                                                                                                                                                                                                                                                                    | false   | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-ingressClassByName" href="#opt-providers-kubernetesIngressNGINX-ingressClassByName" title="#opt-providers-kubernetesIngressNGINX-ingressClassByName">`providers.kubernetesIngressNGINX.ingressClassByName`</a> | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class.                                                                                                                                                                                                                                                                                  | false   | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-publishService" href="#opt-providers-kubernetesIngressNGINX-publishService" title="#opt-providers-kubernetesIngressNGINX-publishService">`providers.kubernetesIngressNGINX.publishService`</a> | Service fronting the Ingress controller. Takes the form namespace/name.                                                                                                                                                                                                                                                                                                              | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-publishStatusAddress" href="#opt-providers-kubernetesIngressNGINX-publishStatusAddress" title="#opt-providers-kubernetesIngressNGINX-publishStatusAddress">`providers.kubernetesIngressNGINX.publishStatusAddress`</a> | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies.                                                                                                                                                                                                                                               | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-defaultBackendService" href="#opt-providers-kubernetesIngressNGINX-defaultBackendService" title="#opt-providers-kubernetesIngressNGINX-defaultBackendService">`providers.kubernetesIngressNGINX.defaultBackendService`</a> | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'.                                                                                                                                                                                                                                                                 | ""      | No       |
-| <a id="opt-providers-kubernetesIngressNGINX-disableSvcExternalName" href="#opt-providers-kubernetesIngressNGINX-disableSvcExternalName" title="#opt-providers-kubernetesIngressNGINX-disableSvcExternalName">`providers.kubernetesIngressNGINX.disableSvcExternalName`</a> | Disable support for Services of type ExternalName.                                                                                                                                                                                                                                                                                                                                   | false   | No       |
+| Field                                                                                                                                                                                                                                                                                            | Description | Default | Required |
+|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------|:--------|:---------|
+| <a id="opt-providers-providers-ThrottleDuration" href="#opt-providers-providers-ThrottleDuration" title="#opt-providers-providers-ThrottleDuration">`providers.providers`<br/>`ThrottleDuration`</a> | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.<br />If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.<br />**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-endpoint" href="#opt-providers-kubernetesIngressNGINX-endpoint" title="#opt-providers-kubernetesIngressNGINX-endpoint">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`endpoint`</a> | Server endpoint URL.<br />More information [here](#endpoint).                                                                                                                                                                                                                                                                                                                        | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-token" href="#opt-providers-kubernetesIngressNGINX-token" title="#opt-providers-kubernetesIngressNGINX-token">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`token`</a> | Bearer token used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                                                           | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-certAuthFilePath" href="#opt-providers-kubernetesIngressNGINX-certAuthFilePath" title="#opt-providers-kubernetesIngressNGINX-certAuthFilePath">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`certAuthFilePath`</a> | Path to the certificate authority file.<br />Used for the Kubernetes client configuration.                                                                                                                                                                                                                                                                                           | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-throttleDuration" href="#opt-providers-kubernetesIngressNGINX-throttleDuration" title="#opt-providers-kubernetesIngressNGINX-throttleDuration">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`throttleDuration`</a> | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.<br />This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.<br />If empty, every event is caught.                                                                                                           | 0s      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-watchNamespace" href="#opt-providers-kubernetesIngressNGINX-watchNamespace" title="#opt-providers-kubernetesIngressNGINX-watchNamespace">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`watchNamespace`</a> | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty.                                                                                                                                                                                                                                                      | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-watchNamespaceSelector" href="#opt-providers-kubernetesIngressNGINX-watchNamespaceSelector" title="#opt-providers-kubernetesIngressNGINX-watchNamespaceSelector">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`watchNamespaceSelector`</a> | Selector selects namespaces the controller watches for updates to Kubernetes objects.                                                                                                                                                                                                                                                                                                | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-ingressClass" href="#opt-providers-kubernetesIngressNGINX-ingressClass" title="#opt-providers-kubernetesIngressNGINX-ingressClass">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`ingressClass`</a> | Name of the ingress class this controller satisfies.                                                                                                                                                                                                                                                                                                                                 | "nginx"      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-controllerClass" href="#opt-providers-kubernetesIngressNGINX-controllerClass" title="#opt-providers-kubernetesIngressNGINX-controllerClass">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`controllerClass`</a> | Ingress Class Controller value this controller satisfies.                                                                                                                                                                                                                                                                                                                            | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass" href="#opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass" title="#opt-providers-kubernetesIngressNGINX-watchIngressWithoutClass">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`watchIngressWithoutClass`</a> | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified.                                                                                                                                                                                                                                                                    | false   | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-ingressClassByName" href="#opt-providers-kubernetesIngressNGINX-ingressClassByName" title="#opt-providers-kubernetesIngressNGINX-ingressClassByName">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`ingressClassByName`</a> | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class.                                                                                                                                                                                                                                                                                  | false   | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-publishService" href="#opt-providers-kubernetesIngressNGINX-publishService" title="#opt-providers-kubernetesIngressNGINX-publishService">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`publishService`</a> | Service fronting the Ingress controller. Takes the form `namespace/name`.                                                                                                                                                                                                                                                                                                              | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-publishStatusAddress" href="#opt-providers-kubernetesIngressNGINX-publishStatusAddress" title="#opt-providers-kubernetesIngressNGINX-publishStatusAddress">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`publishStatusAddress`</a> | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies.                                                                                                                                                                                                                                               | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-defaultBackendService" href="#opt-providers-kubernetesIngressNGINX-defaultBackendService" title="#opt-providers-kubernetesIngressNGINX-defaultBackendService">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`defaultBackendService`</a> | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'.                                                                                                                                                                                                                                                                 | ""      | No       |
+| <a id="opt-providers-kubernetesIngressNGINX-disableSvcExternalName" href="#opt-providers-kubernetesIngressNGINX-disableSvcExternalName" title="#opt-providers-kubernetesIngressNGINX-disableSvcExternalName">`providers.`<br/>`kubernetesIngressNGINX.`<br/>`disableSvcExternalName`</a> | Disable support for Services of type ExternalName.                                                                                                                                                                                                                                                                                                                                   | false   | No       |
 
 <!-- markdownlint-enable MD013 -->
 
@@ -109,4 +176,4 @@ providers:
 
 See the dedicated section in [routing](../../../routing-configuration/kubernetes/ingress-nginx.md).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
index 5ac53b269..b9df965b7 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
@@ -60,7 +60,6 @@ which in turn creates the resulting routers, services, handlers, etc.
 | <a id="opt-providers-kubernetesIngress-ingressEndpoint-publishedService" href="#opt-providers-kubernetesIngress-ingressEndpoint-publishedService" title="#opt-providers-kubernetesIngress-ingressEndpoint-publishedService">`providers.kubernetesIngress.`<br />`ingressEndpoint.publishedService`</a> | The Kubernetes service to copy status from.<br />More information [here](#ingressendpointpublishedservice). | ""      | No       |
 | <a id="opt-providers-kubernetesIngress-throttleDuration" href="#opt-providers-kubernetesIngress-throttleDuration" title="#opt-providers-kubernetesIngress-throttleDuration">`providers.kubernetesIngress.throttleDuration`</a> | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.<br />This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.<br />If empty, every event is caught.  | 0s      | No       |
 | <a id="opt-providers-kubernetesIngress-allowEmptyServices" href="#opt-providers-kubernetesIngress-allowEmptyServices" title="#opt-providers-kubernetesIngress-allowEmptyServices">`providers.kubernetesIngress.allowEmptyServices`</a> | Allows creating a route to reach a service that has no endpoint available.<br />It allows Traefik to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a `503` HTTP Status.  | false   | No       |
-| <a id="opt-providers-kubernetesIngress-allowCrossNamespace" href="#opt-providers-kubernetesIngress-allowCrossNamespace" title="#opt-providers-kubernetesIngress-allowCrossNamespace">`providers.kubernetesIngress.allowCrossNamespace`</a> | Allows the `Ingress` to reference resources in namespaces other than theirs. | false   | No       |
 | <a id="opt-providers-kubernetesIngress-allowExternalNameServices" href="#opt-providers-kubernetesIngress-allowExternalNameServices" title="#opt-providers-kubernetesIngress-allowExternalNameServices">`providers.kubernetesIngress.allowExternalNameServices`</a> | Allows the `Ingress` to reference ExternalName services.   | false   | No       |
 | <a id="opt-providers-kubernetesIngress-nativeLBByDefault" href="#opt-providers-kubernetesIngress-nativeLBByDefault" title="#opt-providers-kubernetesIngress-nativeLBByDefault">`providers.kubernetesIngress.nativeLBByDefault`</a> | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik for every `Ingress` by default.<br />It can br overridden in the [`ServerTransport`](../../../../routing/services/index.md#serverstransport).         | false   | No       |
 | <a id="opt-providers-kubernetesIngress-disableClusterScopeResources" href="#opt-providers-kubernetesIngress-disableClusterScopeResources" title="#opt-providers-kubernetesIngress-disableClusterScopeResources">`providers.kubernetesIngress.disableClusterScopeResources`</a> | Prevent from discovering cluster scope resources (`IngressClass` and `Nodes`).<br />By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources.<br />Furthermore, Traefik will not handle Ingresses with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option).<br />This will also prevent from using the `NodePortLB` options on services. | false   | No       |
@@ -116,6 +115,7 @@ depending on the service type:
 - **ClusterIP:** The ExternalIPs of the service will be propagated to the ingress status.
 - **NodePort:** The ExternalIP addresses of the nodes in the cluster will be propagated to the ingress status.
 - **LoadBalancer:** The IPs from the service's `loadBalancer.status` field (which contains the endpoints provided by the load balancer) will be propagated to the ingress status.
+- **ExternalName:** The hostname from the service's `spec.externalName` field will be propagated to the ingress status.
 
 When using third-party tools such as External-DNS, this option enables the copying of external service IPs to the ingress resources.
 
@@ -149,4 +149,4 @@ many examples of Ingresses definitions are located in the test
 [examples](https://github.com/traefik/traefik/tree/v3.1/pkg/provider/kubernetes/ingress/fixtures)
 of the Traefik repository.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/others/file.md b/docs/content/reference/install-configuration/providers/others/file.md
index 737c7a65c..1f3304d84 100644
--- a/docs/content/reference/install-configuration/providers/others/file.md
+++ b/docs/content/reference/install-configuration/providers/others/file.md
@@ -121,4 +121,4 @@ http:
     As it is very difficult to listen to all file system notifications, Traefik uses [fsnotify](https://github.com/fsnotify/fsnotify).
     If using a directory with a mounted directory does not fix your issue, please check your file system compatibility with fsnotify.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/overview.md b/docs/content/reference/install-configuration/providers/overview.md
index 5253f57a0..cbdbffb4d 100644
--- a/docs/content/reference/install-configuration/providers/overview.md
+++ b/docs/content/reference/install-configuration/providers/overview.md
@@ -160,4 +160,4 @@ List of providers that support constraints:
 - [Consul Catalog](./hashicorp/consul-catalog.md#constraints)
 - [Nomad](./hashicorp/nomad.md#constraints)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/providers/swarm.md b/docs/content/reference/install-configuration/providers/swarm.md
index 8f876dfd2..e1d57e14b 100644
--- a/docs/content/reference/install-configuration/providers/swarm.md
+++ b/docs/content/reference/install-configuration/providers/swarm.md
@@ -464,4 +464,4 @@ It allows different implementation levels of the [AAA (Authentication, Authoriza
 - [Letting Traefik run on Worker Nodes](https://blog.mikesir87.io/2018/07/letting-traefik-run-on-worker-nodes/)
 - [Docker Socket Proxy from Tecnativa](https://github.com/Tecnativa/docker-socket-proxy)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md b/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
index f923e6c72..dbb12e8a8 100644
--- a/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
+++ b/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
@@ -73,30 +73,37 @@ certificatesResolvers:
 
 ACME certificate resolvers have the following configuration options:
 
-| Field                                             | Description                                                                                                                                                                                                                                                                                                                | Default                                        | Required |
-|:--------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------|:---------|
-| <a id="opt-acme-email" href="#opt-acme-email" title="#opt-acme-email">`acme.email`</a> | Email address used for registration.                                                                                                                                                                                                                                                                                       | ""                                             | Yes      |
-| <a id="opt-acme-caServer" href="#opt-acme-caServer" title="#opt-acme-caServer">`acme.caServer`</a> | CA server to use.                                                                                                                                                                                                                                                                                                          | https://acme-v02.api.letsencrypt.org/directory | No       |
-| <a id="opt-acme-preferredChain" href="#opt-acme-preferredChain" title="#opt-acme-preferredChain">`acme.preferredChain`</a> | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used.                                                                                                                              | ""                                             | No       |
-| <a id="opt-acme-keyType" href="#opt-acme-keyType" title="#opt-acme-keyType">`acme.keyType`</a> | KeyType to use.                                                                                                                                                                                                                                                                                                            | "RSA4096"                                      | No       |
-| <a id="opt-acme-eab" href="#opt-acme-eab" title="#opt-acme-eab">`acme.eab`</a> | Enable external account binding.                                                                                                                                                                                                                                                                                           |                                                | No       |
-| <a id="opt-acme-eab-kid" href="#opt-acme-eab-kid" title="#opt-acme-eab-kid">`acme.eab.kid`</a> | Key identifier from External CA.                                                                                                                                                                                                                                                                                           | ""                                             | No       |
-| <a id="opt-acme-eab-hmacEncoded" href="#opt-acme-eab-hmacEncoded" title="#opt-acme-eab-hmacEncoded">`acme.eab.hmacEncoded`</a> | HMAC key from External CA, should be in Base64 URL Encoding without padding format.                                                                                                                                                                                                                                        | ""                                             | No       |
-| <a id="opt-acme-certificatesDuration" href="#opt-acme-certificatesDuration" title="#opt-acme-certificatesDuration">`acme.certificatesDuration`</a> | The certificates' duration in hours, exclusively used to determine renewal dates.                                                                                                                                                                                                                                          | 2160                                           | No       |
-| <a id="opt-acme-clientTimeout" href="#opt-acme-clientTimeout" title="#opt-acme-clientTimeout">`acme.clientTimeout`</a> | Timeout for HTTP Client used to communicate with the ACME server. | 2m  | No       |
-| <a id="opt-acme-clientResponseHeaderTimeout" href="#opt-acme-clientResponseHeaderTimeout" title="#opt-acme-clientResponseHeaderTimeout">`acme.clientResponseHeaderTimeout`</a> | Timeout for response headers for HTTP Client used to communicate with the ACME server. | 30s  | No       |
-| <a id="opt-acme-dnsChallenge" href="#opt-acme-dnsChallenge" title="#opt-acme-dnsChallenge">`acme.dnsChallenge`</a> | Enable DNS-01 challenge. More information [here](#dnschallenge).                                                                                                                                                                                                                                                           | -                                              | No       |
-| <a id="opt-acme-dnsChallenge-provider" href="#opt-acme-dnsChallenge-provider" title="#opt-acme-dnsChallenge-provider">`acme.dnsChallenge.provider`</a> | DNS provider to use.                                                                                                                                                                                                                                                                                                       | ""                                             | No       |
-| <a id="opt-acme-dnsChallenge-resolvers" href="#opt-acme-dnsChallenge-resolvers" title="#opt-acme-dnsChallenge-resolvers">`acme.dnsChallenge.resolvers`</a> | DNS servers to resolve the FQDN authority.                                                                                                                                                                                                                                                                                 | []                                             | No       |
-| <a id="opt-acme-dnsChallenge-propagation-delayBeforeChecks" href="#opt-acme-dnsChallenge-propagation-delayBeforeChecks" title="#opt-acme-dnsChallenge-propagation-delayBeforeChecks">`acme.dnsChallenge.propagation.delayBeforeChecks`</a> | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries.                                                    | 0s                                             | No       |
-| <a id="opt-acme-dnsChallenge-propagation-disableChecks" href="#opt-acme-dnsChallenge-propagation-disableChecks" title="#opt-acme-dnsChallenge-propagation-disableChecks">`acme.dnsChallenge.propagation.disableChecks`</a> | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding.                                                                                                                                  | false                                          | No       |
-| <a id="opt-acme-dnsChallenge-propagation-requireAllRNS" href="#opt-acme-dnsChallenge-propagation-requireAllRNS" title="#opt-acme-dnsChallenge-propagation-requireAllRNS">`acme.dnsChallenge.propagation.requireAllRNS`</a> | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead.                                                                                 | false                                          | No       |
-| <a id="opt-acme-dnsChallenge-propagation-disableANSChecks" href="#opt-acme-dnsChallenge-propagation-disableANSChecks" title="#opt-acme-dnsChallenge-propagation-disableANSChecks">`acme.dnsChallenge.propagation.disableANSChecks`</a> | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable.                                                          | false                                          | No       |
-| <a id="opt-acme-httpChallenge" href="#opt-acme-httpChallenge" title="#opt-acme-httpChallenge">`acme.httpChallenge`</a> | Enable HTTP-01 challenge. More information [here](#httpchallenge).                                                                                                                                                                                                                                                         |                                                | No       |
-| <a id="opt-acme-httpChallenge-entryPoint" href="#opt-acme-httpChallenge-entryPoint" title="#opt-acme-httpChallenge-entryPoint">`acme.httpChallenge.entryPoint`</a> | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80                                                                                                                                                                                                                           | ""                                             | Yes      |
-| <a id="opt-acme-httpChallenge-delay" href="#opt-acme-httpChallenge-delay" title="#opt-acme-httpChallenge-delay">`acme.httpChallenge.delay`</a> | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay.                                                                                                                                                                                                    | 0                                              | No       |
-| <a id="opt-acme-tlsChallenge" href="#opt-acme-tlsChallenge" title="#opt-acme-tlsChallenge">`acme.tlsChallenge`</a> | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge).                                                                                                                                                                                         | -                                              | No       |
-| <a id="opt-acme-storage" href="#opt-acme-storage" title="#opt-acme-storage">`acme.storage`</a> | File path used for certificates storage.                                                                                                                                                                                                                                                                                   | "acme.json"                                    | Yes      |
+| Field | Description | Default | Required |
+|:------|:------------|:--------|:---------|
+| <a id="opt-acme-email" href="#opt-acme-email" title="#opt-acme-email">`acme.email`</a> | Email address used for registration. | "" | Yes |
+| <a id="opt-acme-caServer" href="#opt-acme-caServer" title="#opt-acme-caServer">`acme.caServer`</a> | CA server to use. | https://acme-v02.api.letsencrypt.org/directory | No |
+| <a id="opt-acme-preferredChain" href="#opt-acme-preferredChain" title="#opt-acme-preferredChain">`acme.preferredChain`</a> | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used. | "" | No |
+| <a id="opt-acme-keyType" href="#opt-acme-keyType" title="#opt-acme-keyType">`acme.keyType`</a> | KeyType to use. | "RSA4096" | No |
+| <a id="opt-acme-disableCommonName" href="#opt-acme-disableCommonName" title="#opt-acme-disableCommonName">`acme.disableCommonName`</a> | Disable common name inside CSR and certificates.                                                                                                                                                                                                                        | false                                          | No       |
+| <a id="opt-acme-profile" href="#opt-acme-profile" title="#opt-acme-profile">`acme.profile`</a> | Certificate profile to use. | "" | No |
+| <a id="opt-acme-caCertificates" href="#opt-acme-caCertificates" title="#opt-acme-caCertificates">`acme.caCertificates`</a> | Specify the paths to PEM encoded CA Certificates that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list. | [] | No |
+| <a id="opt-acme-caSystemCertPool" href="#opt-acme-caSystemCertPool" title="#opt-acme-caSystemCertPool">`acme.caSystemCertPool`</a> | Defines if the certificates pool must use a copy of the system cert pool. | false | No |
+| <a id="opt-acme-caServerName" href="#opt-acme-caServerName" title="#opt-acme-caServerName">`acme.caServerName`</a> | Specify the CA server name that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list. | "" | No |
+| <a id="opt-acme-emailAddresses" href="#opt-acme-emailAddresses" title="#opt-acme-emailAddresses">`acme.emailAddresses`</a> | CSR email addresses to use. | "" | No |
+| <a id="opt-acme-eab" href="#opt-acme-eab" title="#opt-acme-eab">`acme.eab`</a> | Enable external account binding. | | No |
+| <a id="opt-acme-eab-kid" href="#opt-acme-eab-kid" title="#opt-acme-eab-kid">`acme.eab.kid`</a> | Key identifier from External CA. | "" | No |
+| <a id="opt-acme-eab-hmacEncoded" href="#opt-acme-eab-hmacEncoded" title="#opt-acme-eab-hmacEncoded">`acme.eab.hmacEncoded`</a> | HMAC key from External CA, should be in Base64 URL Encoding without padding format. | "" | No |
+| <a id="opt-acme-certificatesDuration" href="#opt-acme-certificatesDuration" title="#opt-acme-certificatesDuration">`acme.certificatesDuration`</a> | The certificates' duration in hours, exclusively used to determine renewal dates. | 2160 | No |
+| <a id="opt-acme-clientTimeout" href="#opt-acme-clientTimeout" title="#opt-acme-clientTimeout">`acme.clientTimeout`</a> | Timeout for HTTP Client used to communicate with the ACME server. | 2m | No |
+| <a id="opt-acme-clientResponseHeaderTimeout" href="#opt-acme-clientResponseHeaderTimeout" title="#opt-acme-clientResponseHeaderTimeout">`acme.clientResponseHeaderTimeout`</a> | Timeout for response headers for HTTP Client used to communicate with the ACME server. | 30s | No |
+| <a id="opt-acme-dnsChallenge" href="#opt-acme-dnsChallenge" title="#opt-acme-dnsChallenge">`acme.dnsChallenge`</a> | Enable DNS-01 challenge. More information [here](#dnschallenge). | - | No |
+| <a id="opt-acme-dnsChallenge-provider" href="#opt-acme-dnsChallenge-provider" title="#opt-acme-dnsChallenge-provider">`acme.dnsChallenge.provider`</a> | DNS provider to use. | "" | No |
+| <a id="opt-acme-dnsChallenge-resolvers" href="#opt-acme-dnsChallenge-resolvers" title="#opt-acme-dnsChallenge-resolvers">`acme.dnsChallenge.resolvers`</a> | DNS servers to resolve the FQDN authority. | [] | No |
+| <a id="opt-acme-dnsChallenge-propagation-delayBeforeChecks" href="#opt-acme-dnsChallenge-propagation-delayBeforeChecks" title="#opt-acme-dnsChallenge-propagation-delayBeforeChecks">`acme.dnsChallenge.propagation.delayBeforeChecks`</a> | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries. | 0s | No |
+| <a id="opt-acme-dnsChallenge-propagation-disableChecks" href="#opt-acme-dnsChallenge-propagation-disableChecks" title="#opt-acme-dnsChallenge-propagation-disableChecks">`acme.dnsChallenge.propagation.disableChecks`</a> | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding. | false | No |
+| <a id="opt-acme-dnsChallenge-propagation-requireAllRNS" href="#opt-acme-dnsChallenge-propagation-requireAllRNS" title="#opt-acme-dnsChallenge-propagation-requireAllRNS">`acme.dnsChallenge.propagation.requireAllRNS`</a> | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead. | false | No |
+| <a id="opt-acme-dnsChallenge-propagation-disableANSChecks" href="#opt-acme-dnsChallenge-propagation-disableANSChecks" title="#opt-acme-dnsChallenge-propagation-disableANSChecks">`acme.dnsChallenge.propagation.disableANSChecks`</a> | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable. | false | No |
+| <a id="opt-acme-httpChallenge" href="#opt-acme-httpChallenge" title="#opt-acme-httpChallenge">`acme.httpChallenge`</a> | Enable HTTP-01 challenge. More information [here](#httpchallenge). | | No |
+| <a id="opt-acme-httpChallenge-entryPoint" href="#opt-acme-httpChallenge-entryPoint" title="#opt-acme-httpChallenge-entryPoint">`acme.httpChallenge.entryPoint`</a> | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80 | "" | Yes |
+| <a id="opt-acme-httpChallenge-delay" href="#opt-acme-httpChallenge-delay" title="#opt-acme-httpChallenge-delay">`acme.httpChallenge.delay`</a> | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay. | 0 | No |
+| <a id="opt-acme-tlsChallenge" href="#opt-acme-tlsChallenge" title="#opt-acme-tlsChallenge">`acme.tlsChallenge`</a> | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge). | - | No |
+| <a id="opt-acme-tlschallenge-delay" href="#opt-acme-tlschallenge-delay" title="#opt-acme-tlschallenge-delay">`acme.tlschallenge.delay`</a> | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay.                                                                                                                                                 | 0                                              | No       |
+| <a id="opt-acme-storage" href="#opt-acme-storage" title="#opt-acme-storage">`acme.storage`</a> | File path used for certificates storage. | "acme.json" | Yes |
 
 ## Automatic Certificate Renewal
 
@@ -323,4 +330,4 @@ If Let's Encrypt is not reachable, the following certificates will apply:
 !!! important
     For new (sub)domains which need Let's Encrypt authentication, the default Traefik certificate will be used until Traefik is restarted.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/install-configuration/tls/certificate-resolvers/overview.md b/docs/content/reference/install-configuration/tls/certificate-resolvers/overview.md
index 5652f0982..eccf4a66a 100644
--- a/docs/content/reference/install-configuration/tls/certificate-resolvers/overview.md
+++ b/docs/content/reference/install-configuration/tls/certificate-resolvers/overview.md
@@ -17,4 +17,4 @@ The Certificates resolvers are defined in the static configuration.
     Defining a certificate resolver does not imply that routers are going to use it automatically.
     Each router or entrypoint that is meant to use the resolver must explicitly reference it.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/load-balancing/service.md b/docs/content/reference/routing-configuration/http/load-balancing/service.md
index 38f26d077..7b009e2e3 100644
--- a/docs/content/reference/routing-configuration/http/load-balancing/service.md
+++ b/docs/content/reference/routing-configuration/http/load-balancing/service.md
@@ -30,6 +30,9 @@ http:
           path: "/health"
           interval: "10s"
           timeout: "3s"
+        passiveHealthcheck:
+          failureWindow: "3s"
+          maxFailedAttempts: "3"
         passHostHeader: true
         serversTransport: "customTransport@file"
         responseForwarding:
@@ -49,6 +52,10 @@ http:
       path = "/health"
       interval = "10s"
       timeout = "3s"
+
+    [http.services.my-service.loadBalancer.passiveHealthcheck]
+      failureWindow = "3s"
+      maxFailedAttempts = "3"
     
     passHostHeader = true
     serversTransport = "customTransport@file"
@@ -66,6 +73,8 @@ labels:
   - "traefik.http.services.my-service.loadBalancer.healthcheck.path=/health"
   - "traefik.http.services.my-service.loadBalancer.healthcheck.interval=10s"
   - "traefik.http.services.my-service.loadBalancer.healthcheck.timeout=3s"
+  - "traefik.http.services.my-service.loadBalancer.passiveHealthcheck.failureWindow=3s"
+  - "traefik.http.services.my-service.loadBalancer.passiveHealthcheck.maxFailedAttempts=3"
   - "traefik.http.services.my-service.loadBalancer.passHostHeader=true"
   - "traefik.http.services.my-service.loadBalancer.serversTransport=customTransport@file"
   - "traefik.http.services.my-service.loadBalancer.responseForwarding.flushInterval=150ms"
@@ -81,6 +90,8 @@ labels:
     "traefik.http.services.my-service.loadBalancer.healthcheck.path=/health",
     "traefik.http.services.my-service.loadBalancer.healthcheck.interval=10s",
     "traefik.http.services.my-service.loadBalancer.healthcheck.timeout=3s",
+    "traefik.http.services.my-service.loadBalancer.passiveHealthcheck.failureWindow=3s",
+    "traefik.http.services.my-service.loadBalancer.passiveHealthcheck.maxFailedAttempts=3",
     "traefik.http.services.my-service.loadBalancer.passHostHeader=true",
     "traefik.http.services.my-service.loadBalancer.serversTransport=customTransport@file",
     "traefik.http.services.my-service.loadBalancer.responseForwarding.flushInterval=150ms"
@@ -95,6 +106,7 @@ labels:
 | <a id="opt-servers" href="#opt-servers" title="#opt-servers">`servers`</a> | Represents individual backend instances for your service                                                                                                                                                                                                                                                                                                                                      | Yes      |
 | <a id="opt-sticky" href="#opt-sticky" title="#opt-sticky">`sticky`</a> | Defines a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.                                                                                                                                                                                                                                                                  | No       |
 | <a id="opt-healthcheck" href="#opt-healthcheck" title="#opt-healthcheck">`healthcheck`</a> | Configures health check to remove unhealthy servers from the load balancing rotation.                                                                                                                                                                                                                                                                                                         | No       |
+| <a id="opt-passiveHealthcheck" href="#opt-passiveHealthcheck" title="#opt-passiveHealthcheck">`passiveHealthcheck`</a> | Configures the passive health check to remove unhealthy servers from the load balancing rotation.                                                                                                                                                                                                                                                                                             | No       |
 | <a id="opt-passHostHeader" href="#opt-passHostHeader" title="#opt-passHostHeader">`passHostHeader`</a> | Allows forwarding of the client Host header to server. By default, `passHostHeader` is true.                                                                                                                                                                                                                                                                                                  | No       |
 | <a id="opt-serversTransport" href="#opt-serversTransport" title="#opt-serversTransport">`serversTransport`</a> | Allows to reference an [HTTP ServersTransport](./serverstransport.md) configuration for the communication between Traefik and your servers. If no `serversTransport` is specified, the `default@internal` will be used.                                                                                                                                                                       | No       |
 | <a id="opt-responseForwarding" href="#opt-responseForwarding" title="#opt-responseForwarding">`responseForwarding`</a> | Configures how Traefik forwards the response from the backend server to the client.                                                                                                                                                                                                                                                                                                           | No       |
@@ -114,7 +126,9 @@ Servers represent individual backend instances for your service. The [service lo
 
 #### Health Check
 
-The `healthcheck` option configures health check to remove unhealthy servers from the load balancing rotation. Traefik will consider HTTP(s) servers healthy as long as they return a status code to the health check request (carried out every interval) between `2XX` and `3XX`, or matching the configured status. For gRPC servers, Traefik will consider them healthy as long as they return SERVING to [gRPC health check v1 requests](https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+The `healthcheck` option configures health check to remove unhealthy servers from the load balancing rotation.
+Traefik will consider HTTP(s) servers healthy as long as they return a status code to the health check request (carried out every interval) between `2XX` and `3XX`, or matching the configured status.
+For gRPC servers, Traefik will consider them healthy as long as they return SERVING to [gRPC health check v1 requests](https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
 
 To propagate status changes (e.g. all servers of this service are down) upwards, HealthCheck must also be enabled on the parent(s) of this service.
 
@@ -143,39 +157,39 @@ On subsequent requests, to keep the session alive with the same server, the clie
 
 ##### Stickiness on multiple levels
 
-    When chaining or mixing load-balancers (e.g. a load-balancer of servers is one of the "children" of a load-balancer of services), for stickiness to work all the way, the option needs to be specified at all required levels. Which means the client needs to send a cookie with as many key/value pairs as there are sticky levels.
+When chaining or mixing load-balancers (e.g. a load-balancer of servers is one of the "children" of a load-balancer of services), for stickiness to work all the way, the option needs to be specified at all required levels. Which means the client needs to send a cookie with as many key/value pairs as there are sticky levels.
 
 ##### Stickiness & Unhealthy Servers
 
-    If the server specified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
+If the server specified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
 
 ##### Cookie Name
 
-    The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
+The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
 
 ##### MaxAge
 
-    By default, the affinity cookie will never expire as the `MaxAge` option is set to zero.
+By default, the affinity cookie will never expire as the `MaxAge` option is set to zero.
+
+This option indicates the number of seconds until the cookie expires.  
+When set to a negative number, the cookie expires immediately.
 
-    This option indicates the number of seconds until the cookie expires.  
-    When set to a negative number, the cookie expires immediately.
-    
 ##### Secure & HTTPOnly & SameSite flags
 
-    By default, the affinity cookie is created without those flags.
-    One however can change that through configuration.
+By default, the affinity cookie is created without those flags.
+One however can change that through configuration.
 
-    `SameSite` can be `none`, `lax`, `strict` or empty.
+`SameSite` can be `none`, `lax`, `strict` or empty.
 
 ##### Domain
 
-    The Domain attribute of a cookie specifies the domain for which the cookie is valid. 
-    
-    By setting the Domain attribute, the cookie can be shared across subdomains (for example, a cookie set for example.com would be accessible to www.example.com, api.example.com, etc.). This is particularly useful in cases where sticky sessions span multiple subdomains, ensuring that the session is maintained even when the client interacts with different parts of the infrastructure.
+The Domain attribute of a cookie specifies the domain for which the cookie is valid. 
+
+By setting the Domain attribute, the cookie can be shared across subdomains (for example, a cookie set for example.com would be accessible to www.example.com, api.example.com, etc.). This is particularly useful in cases where sticky sessions span multiple subdomains, ensuring that the session is maintained even when the client interacts with different parts of the infrastructure.
 
 ??? example "Adding Stickiness -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
 
-    ```yaml tab="YAML"
+    ```yaml tab="Structured (YAML)"
     ## Dynamic configuration
     http:
       services:
@@ -185,7 +199,7 @@ On subsequent requests, to keep the session alive with the same server, the clie
              cookie: {}
     ```
 
-    ```toml tab="TOML"
+    ```toml tab="Structured (TOML)"
     ## Dynamic configuration
     [http.services]
       [http.services.my-service]
@@ -194,7 +208,7 @@ On subsequent requests, to keep the session alive with the same server, the clie
 
 ??? example "Adding Stickiness with custom Options -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
 
-    ```yaml tab="YAML"
+    ```yaml tab="Structured (YAML)"
     ## Dynamic configuration
     http:
       services:
@@ -208,7 +222,7 @@ On subsequent requests, to keep the session alive with the same server, the clie
                 httpOnly: true
     ```
 
-    ```toml tab="TOML"
+    ```toml tab="Structured (TOML)"
     ## Dynamic configuration
     [http.services]
       [http.services.my-service]
@@ -222,7 +236,7 @@ On subsequent requests, to keep the session alive with the same server, the clie
 
 ??? example "Setting Stickiness on all the required levels -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
 
-    ```yaml tab="YAML"
+    ```yaml tab="Structured (YAML)"
     ## Dynamic configuration
     http:
       services:
@@ -256,7 +270,7 @@ On subsequent requests, to keep the session alive with the same server, the clie
               - url: http://127.0.0.1:8084
     ```
 
-    ```toml tab="TOML"
+    ```toml tab="Structured (TOML)"
     ## Dynamic configuration
     [http.services]
       [http.services.wrr1]
@@ -288,11 +302,29 @@ On subsequent requests, to keep the session alive with the same server, the clie
             url = "http://127.0.0.1:8084"
     ```
 
-    To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:
+To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:
 
-    ```
-    curl -b "lvl1=whoami1; lvl2=http://127.0.0.1:8081" http://localhost:8000
-    ```
+```bash
+curl -b "lvl1=whoami1; lvl2=http://127.0.0.1:8081" http://localhost:8000
+```
+
+#### Passive Health Check
+
+The `passiveHealthcheck` option configures passive health check to remove unhealthy servers from the load balancing rotation.
+
+Passive health checks rely on real traffic to assess server health.
+Traefik forwards requests as usual and evaluates each response or timeout,
+incrementing a failure counter whenever a request fails.
+If the number of successive failures within a specified time window exceeds the configured threshold,
+Traefik will automatically stop routing traffic to that server until it recovers.
+A server will be considered healthy again after the configured failure window has passed.
+
+Below are the available options for the passive health check mechanism:
+
+| Field               | Description                                                                                                                                                                         | Default | Required |
+|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------|
+| <a id="opt-failureWindow" href="#opt-failureWindow" title="#opt-failureWindow">`failureWindow`</a> | Defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy. | 10s     | No       |
+| <a id="opt-maxFailedAttempts" href="#opt-maxFailedAttempts" title="#opt-maxFailedAttempts">`maxFailedAttempts`</a> | Defines the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.                                                         | 1       | No       |
 
 ## Weighted Round Robin (WRR)
 
@@ -421,13 +453,14 @@ http:
       [[http.services.appv2.loadBalancer.servers]]
         url = "http://private-ip-server-2/"
 ```
+
 ## P2C
 
 Power of two choices algorithm is a load balancing strategy that selects two servers at random and chooses the one with the least number of active requests.
 
 ??? example "P2C Load Balancing -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
 
-    ```yaml tab="YAML"
+    ```yaml tab="Structured (YAML)"
     ## Dynamic configuration
     http:
       services:
@@ -440,7 +473,7 @@ Power of two choices algorithm is a load balancing strategy that selects two ser
             - url: "http://private-ip-server-3/"
     ```
 
-    ```toml tab="TOML"
+    ```toml tab="Structured (TOML) "
     ## Dynamic configuration
     [http.services]
       [http.services.my-service.loadBalancer]
@@ -453,6 +486,48 @@ Power of two choices algorithm is a load balancing strategy that selects two ser
           url = "http://private-ip-server-3/"
     ```
 
+## Least-Time
+
+The Least-Time load balancing algorithm selects the server with the lowest average response time (Time To First Byte - TTFB),
+combined with the fewest active connections, weighted by server capacity.
+This strategy is ideal for heterogeneous backend environments where servers have varying performance characteristics,
+different hardware capabilities, or varying network latency.
+
+The algorithm continuously measures each backend's response time and tracks active connection counts.
+When routing a request,
+it calculates a score for each healthy server using the formula: `(avg_response_time × (1 + active_connections)) / weight`.
+The server with the lowest score receives the request.
+When multiple servers have identical scores,
+Weighted Round Robin (WRR) with Earliest Deadline First (EDF) scheduling is used as a tie-breaker to ensure fair distribution.
+
+??? example "Basic Least-Time Load Balancing -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
+
+    ```yaml tab="Structured (YAML)"
+    ## Dynamic configuration
+    http:
+      services:
+        my-service:
+          loadBalancer:
+            strategy: "leasttime"
+            servers:
+            - url: "http://private-ip-server-1/"
+            - url: "http://private-ip-server-2/"
+            - url: "http://private-ip-server-3/"
+    ```
+
+    ```toml tab="Structured (TOML)"
+    ## Dynamic configuration
+    [http.services]
+      [http.services.my-service.loadBalancer]
+        strategy = "leasttime"
+        [[http.services.my-service.loadBalancer.servers]]
+          url = "http://private-ip-server-1/"
+        [[http.services.my-service.loadBalancer.servers]]
+          url = "http://private-ip-server-2/"
+        [[http.services.my-service.loadBalancer.servers]]
+          url = "http://private-ip-server-3/"
+    ```
+
 ## Mirroring
 
 The mirroring is able to mirror requests sent to a service to other services. Please note that by default the whole request is buffered in memory while it is being mirrored. See the `maxBodySize` option in the example below for how to modify this behaviour. You can also omit the request body by setting the `mirrorBody` option to false.
diff --git a/docs/content/reference/routing-configuration/http/middlewares/apikey.md b/docs/content/reference/routing-configuration/http/middlewares/apikey.md
index 454c141a1..a5b2c44b2 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/apikey.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/apikey.md
@@ -53,4 +53,4 @@ stringData:
 | <a id="opt-secretNonBase64Encoded" href="#opt-secretNonBase64Encoded" title="#opt-secretNonBase64Encoded">`secretNonBase64Encoded`</a> | Defines whether the secret sent by the client is base64 encoded. | false   | No       |
 | <a id="opt-secretValues" href="#opt-secretValues" title="#opt-secretValues">`secretValues`</a> | Contain the hash of the API keys. <br /> Supported hashing algorithms are Bcrypt, SHA1 and MD5. <br /> The hash should be generated using `htpasswd`.<br />Can reference a Kubernetes Secret using the URN format: `urn:k8s:secret:[name]:[valueKey]` | []      | Yes      |
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/basicauth.md b/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
index be372250b..641170051 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
@@ -92,4 +92,4 @@ The option `users` supports Kubernetes secrets.
     Please note that these keys are not hashed or encrypted in any way, and therefore is less secure than other methods.
     You can find more information on the [Kubernetes Basic Authentication Secret Documentation](https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret)
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/compress.md b/docs/content/reference/routing-configuration/http/middlewares/compress.md
index f67c62c9a..31cf2a4eb 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/compress.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/compress.md
@@ -53,7 +53,7 @@ spec:
 |:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
 | <a id="opt-excludedContentTypes" href="#opt-excludedContentTypes" title="#opt-excludedContentTypes">`excludedContentTypes`</a> | List of content types to compare the `Content-Type` header of the incoming requests and responses before compressing. <br /> The responses with content types defined in `excludedContentTypes` are not compressed. <br /> Content types are compared in a case-insensitive, whitespace-ignored manner. <br /> **The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
 | <a id="opt-defaultEncoding" href="#opt-defaultEncoding" title="#opt-defaultEncoding">`defaultEncoding`</a> | specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`). | "" | No |
-| <a id="opt-encodings" href="#opt-encodings" title="#opt-encodings">`encodings`</a> | Specifies the list of supported compression encodings. At least one encoding value must be specified, and valid entries are `zstd` (Zstandard), `br` (Brotli), and `gzip` (Gzip). The order of the list also sets the priority, the top entry has the highest priority. | zstd, br, gzip | No |
+| <a id="opt-encodings" href="#opt-encodings" title="#opt-encodings">`encodings`</a> | Specifies the list of supported compression encodings. At least one encoding value must be specified, and valid entries are `zstd` (Zstandard), `br` (Brotli), and `gzip` (Gzip). The order of the list also sets the priority, the top entry has the highest priority. | gzip, br, zstd | No |
 | <a id="opt-includedContentTypes" href="#opt-includedContentTypes" title="#opt-includedContentTypes">`includedContentTypes`</a> | List of content types to compare the `Content-Type` header of the responses before compressing. <br /> The responses with content types defined in `includedContentTypes` are compressed. <br /> Content types are compared in a case-insensitive, whitespace-ignored manner.<br /> **The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
 | <a id="opt-minResponseBodyBytes" href="#opt-minResponseBodyBytes" title="#opt-minResponseBodyBytes">`minResponseBodyBytes`</a> | `Minimum amount of bytes a response body must have to be compressed. <br />Responses smaller than the specified values will **not** be compressed. | 1024 | No |
 
diff --git a/docs/content/reference/routing-configuration/http/middlewares/digestauth.md b/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
index 974ef48ce..8e5354393 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
@@ -82,4 +82,4 @@ On Kubernetes, you don’t use the `users` or `usersFile` fields. Instead, you r
 - `kubernetes.io/basic-auth secret`: This secret type contains two keys—`username` and `password`—but is generally suited for a smaller number of users. Please note that these keys are not hashed or encrypted in any way, and therefore is less secure than the other method.
 - Opaque secret with a users field: Here, the secret contains a single string field (often called `users`) where each line represents a user. This approach allows you to store multiple users in one secret.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md b/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
index 5df864c26..30bc78ec7 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
@@ -62,7 +62,7 @@ spec:
 | <a id="opt-authRequestHeaders" href="#opt-authRequestHeaders" title="#opt-authRequestHeaders">`authRequestHeaders`</a> | List of the headers to copy from the request to the authentication server. <br /> It allows filtering headers that should not be passed to the authentication server. <br /> If not set or empty, then all request headers are passed. | [] | No      |
 | <a id="opt-addAuthCookiesToResponse" href="#opt-addAuthCookiesToResponse" title="#opt-addAuthCookiesToResponse">`addAuthCookiesToResponse`</a> | List of cookies to copy from the authentication server to the response, replacing any existing conflicting cookie from the forwarded response.<br /> Please note that all backend cookies matching the configured list will not be added to the response. | [] | No      |
 | <a id="opt-forwardBody" href="#opt-forwardBody" title="#opt-forwardBody">`forwardBody`</a> | Sets the `forwardBody` option to `true` to send the Body. As body is read inside Traefik before forwarding, this breaks streaming. | false | No      |
-| <a id="opt-maxBodySize" href="#opt-maxBodySize" title="#opt-maxBodySize">`maxBodySize`</a> | Set the `maxBodySize` to limit the body size in bytes. If body is bigger than this, it returns a 401 (unauthorized). | -1 | No      |
+| <a id="opt-maxBodySize" href="#opt-maxBodySize" title="#opt-maxBodySize">`maxBodySize`</a> | Set the `maxBodySize` to limit the body size in bytes. If body is bigger than this, it returns a 401 (unauthorized). If left unset, the request body size is unrestricted which can have performance or security implications. < br/>More information [here](#maxbodysize).| -1 | No      |
 | <a id="opt-headerField" href="#opt-headerField" title="#opt-headerField">`headerField`</a> | Defines a header field to store the authenticated user. | "" | No      |
 | <a id="opt-preserveLocationHeader" href="#opt-preserveLocationHeader" title="#opt-preserveLocationHeader">`preserveLocationHeader`</a> | Defines whether to forward the Location header to the client as is or prefix it with the domain name of the authentication server. | false | No      |
 | <a id="opt-preserveRequestMethod" href="#opt-preserveRequestMethod" title="#opt-preserveRequestMethod">`preserveRequestMethod`</a> | Defines whether to preserve the original request method while forwarding the request to the authentication server. | false | No      |
@@ -81,6 +81,40 @@ The start of string (`^`) and end of string (`$`) anchors should be used to ensu
 
 Regular expressions and replacements can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
 
+### maxBodySize
+
+The `maxBodySize` option controls the maximum size of request bodies that will be forwarded to the authentication server.
+
+**⚠️ Important Security Consideration**
+
+By default, `maxBodySize` is not set (value: -1), which means request body size is unlimited. This can have significant security and performance implications:
+
+- **Security Risk**: Attackers can send extremely large request bodies, potentially causing DoS attacks or memory exhaustion
+- **Performance Impact**: Large request bodies consume memory and processing resources, affecting overall system performance
+- **Resource Consumption**: Unlimited body size can lead to unexpected resource usage patterns
+
+**Recommended Configuration**
+
+It is strongly recommended to set an appropriate `maxBodySize` value for your use case:
+
+```yaml
+# For most web applications (1MB limit)
+maxBodySize: 1048576  # 1MB in bytes
+
+# For API endpoints expecting larger payloads (10MB limit)  
+maxBodySize: 10485760  # 10MB in bytes
+
+# For file upload authentication (100MB limit)
+maxBodySize: 104857600  # 100MB in bytes
+```
+
+**Guidelines for Setting maxBodySize**
+
+- **Web Forms**: 1-5MB is typically sufficient for most form submissions
+- **API Endpoints**: Consider your largest expected JSON/XML payload + buffer
+- **File Uploads**: Set based on your maximum expected file size
+- **High-Traffic Services**: Use smaller limits to prevent resource exhaustion
+
 ## Forward-Request Headers
 
 The following request properties are provided to the forward-auth target endpoint as `X-Forwarded-` headers.
@@ -93,4 +127,4 @@ The following request properties are provided to the forward-auth target endpoin
 | <a id="opt-Request-URI" href="#opt-Request-URI" title="#opt-Request-URI">Request URI</a> | `X-Forwarded-Uri`        |
 | <a id="opt-Source-IP-Address" href="#opt-Source-IP-Address" title="#opt-Source-IP-Address">Source IP-Address</a> | `X-Forwarded-For`        |
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/headers.md b/docs/content/reference/routing-configuration/http/middlewares/headers.md
index 5d468363e..f1774d85e 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/headers.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/headers.md
@@ -323,4 +323,4 @@ It allows all origins that contain any match of a regular expression in the `acc
 
     When defining a regular expression within YAML, any escaped character needs to be escaped twice: `example\.com` needs to be written as `example\\.com`.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/hmac.md b/docs/content/reference/routing-configuration/http/middlewares/hmac.md
index 2eabab306..0bc37da90 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/hmac.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/hmac.md
@@ -204,4 +204,4 @@ Only SHA-256 and SHA-512 checksums are supported for checksum computation.
 
     To disable this feature and only perform authentication, set the `validateDigest` option to `false` in the middleware configuration.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/jwt.md b/docs/content/reference/routing-configuration/http/middlewares/jwt.md
index 2aebcdf86..5dc9f5479 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/jwt.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/jwt.md
@@ -230,4 +230,4 @@ The reference to a Kubernetes secret takes the form of a URN:
 urn:k8s:secret:[name]:[valueKey]
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/ldap.md b/docs/content/reference/routing-configuration/http/middlewares/ldap.md
index 9a0efc6f2..027d6ee02 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/ldap.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/ldap.md
@@ -102,4 +102,4 @@ and a `bindPassword`, then the middleware runs in search mode. In this mode, a s
 issued to the LDAP server before trying to bind. If result of this search returns only 1 record,
 it tries to issue a bind request with this record, otherwise it aborts a `401 Unauthorized` status code.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md b/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md
index 80eecea88..40de4f315 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md
@@ -252,4 +252,4 @@ The following Redis modes are supported:
 
 For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation").
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md b/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md
index 8633abcbb..d98ad4e43 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md
@@ -206,4 +206,4 @@ stringData:
     -----END EC PRIVATE KEY-----
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oidc.md b/docs/content/reference/routing-configuration/http/middlewares/oidc.md
index 120e79bf9..0e0dfe1ea 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/oidc.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/oidc.md
@@ -427,4 +427,4 @@ This means that a new CSRF token will be generated and sent to the client whenev
 When a request is sent and uses a non-safe method (see [RFC7231#section-4.2.1](https://datatracker.ietf.org/doc/html/rfc7231.html#section-4.2.1)),
 the CSRF token value (extracted from the cookie) have to be sent to the server in the header configured with the [headerName option](#configuration-options).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/opa.md b/docs/content/reference/routing-configuration/http/middlewares/opa.md
index 4dabfe455..298c8ef04 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/opa.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/opa.md
@@ -69,4 +69,4 @@ spec:
 | <a id="opt-allow" href="#opt-allow" title="#opt-allow">`allow`</a> | The `allow` option sets the expression to evaluate that determines if the request should be authorized. | ""      | No (one of `allow` or `forwardHeaders` must be set) |
 | <a id="opt-forwardHeaders" href="#opt-forwardHeaders" title="#opt-forwardHeaders">`forwardHeaders`</a> | The `forwardHeaders` option sets the HTTP headers to add to requests and populates them with the result of the given expression. | ""      | No (one of `allow` or `forwardHeaders` must be set) |   
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/overview.md b/docs/content/reference/routing-configuration/http/middlewares/overview.md
index 40ddb6015..5a287c70b 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/overview.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/overview.md
@@ -48,4 +48,4 @@ Middlewares that use the same protocol can be combined into chains to fit every
 
 Please take a look at the community-contributed plugins in the [plugin catalog](https://plugins.traefik.io/plugins).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md b/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
index 942f2e833..187cb0286 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
@@ -85,4 +85,4 @@ The `replacement` option defines how to modify the URL to have the new target UR
 
     Care should be taken when defining replacement expand variables: `$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md b/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
index b3e6ebfd8..90590489c 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
@@ -63,4 +63,4 @@ spec:
 |:-----------------------------|:--------------------------------------------------------------|:--------|:---------|
 | <a id="opt-prefixes" href="#opt-prefixes" title="#opt-prefixes">`prefixes`</a> | List of prefixes to strip from the request URL.<br />If your backend is serving assets (for example, images or JavaScript files), it can use the `X-Forwarded-Prefix` header to construct relative URLs. | [] | No |
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/waf.md b/docs/content/reference/routing-configuration/http/middlewares/waf.md
index e5e864db7..33fe47b21 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/waf.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/waf.md
@@ -61,4 +61,4 @@ spec:
 | <a id="opt-directives" href="#opt-directives" title="#opt-directives">`directives`</a> | List of WAF rules to enforce. |  | Yes |
 | <a id="opt-crsEnabled" href="#opt-crsEnabled" title="#opt-crsEnabled">`crsEnabled`</a> | Enable [CRS rulesets](https://github.com/corazawaf/coraza-coreruleset/tree/main/rules/%40owasp_crs).<br /> Once the ruleset is enabled, it can be used in the middleware. | false |  False |
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/routing/multi-layer-routing.md b/docs/content/reference/routing-configuration/http/routing/multi-layer-routing.md
new file mode 100644
index 000000000..7d6f9f01e
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/routing/multi-layer-routing.md
@@ -0,0 +1,188 @@
+---
+title: "Multi-Layer Routing"
+description: "Learn how to use Traefik's multi-layer routing to create hierarchical router relationships where parent routers can apply middleware before child routers make routing decisions."
+---
+
+# Multi-Layer Routing
+
+Hierarchical Router Relationships for Advanced Routing Scenarios.
+
+## Overview
+
+Multi-layer routing enables you to create hierarchical relationships between routers,
+where parent routers can process requests through middleware before child routers make final routing decisions.
+
+This feature allows middleware at the parent level to modify requests (adding headers, performing authentication, etc.) that influence how child routers evaluate their rules and route traffic to services.
+
+Multi-layer routing is particularly useful for progressive request enrichment, where each layer adds context to the request, enabling increasingly specific routing decisions:
+
+- **Authentication-Based Routing**: Parent router authenticates requests and adds user context (roles, permissions) as headers, child routers route based on these headers
+- **Staged Middleware Application**: Apply common middleware (rate limiting, CORS) at parent level (for a given domain/path), but specific middleware at child level
+
+!!! info "Provider Support"
+
+    Multi-layer routing is supported by the following providers:
+
+    - **File provider** (YAML, TOML, JSON)
+    - **KV stores** (Consul, etcd, Redis, ZooKeeper)
+    - **Kubernetes CRD** (IngressRoute)
+
+    Multi-layer routing is not available for other providers (Docker, Kubernetes Ingress, Gateway API, etc.).
+
+
+## How It Works
+
+```
+Request → EntryPoint → Parent Router → Middleware → Child Router A → Service A
+                                          ↓       → Child Router B → Service B
+                                     Modify Request
+                                  (e.g., add headers)
+```
+
+1. **Request arrives** at an entrypoint
+2. **Parent router matches** based on its rule (e.g., ```Host(`example.com`)```)
+3. **Parent middleware executes**, potentially modifying the request
+4. **One child router matches** based on its rule (which may use modified request attributes)
+5. **Request is forwarded** to the matching child router's service
+
+## Building a Router Hierarchy
+
+### Root Routers
+
+- Have no `parentRefs` (top of the hierarchy)
+- **Can** have `tls`, `observability`, and `entryPoints` configuration
+- Can be either parent routers (with children) or standalone routers (with service)
+- **Can** have models applied (non-root routers cannot have models)
+
+### Intermediate Routers
+
+- Reference their parent router(s) via `parentRefs`
+- Have one or more child routers
+- **Must not** have a `service` defined
+- **Must not** have `entryPoints`, `tls`, or `observability` configuration
+
+### Leaf Routers
+
+- Reference their parent router(s) via `parentRefs`
+- **Must** have a `service` defined
+- **Must not** have `entryPoints`, `tls`, or `observability` configuration
+
+## Configuration Example
+
+??? example "Authentication-Based Routing"
+
+    ```yaml tab="File (YAML)"
+    ## Dynamic configuration
+    http:
+      routers:
+        # Parent router with authentication
+        api-parent:
+          rule: "PathPrefix(`/api`)"
+          middlewares:
+            - auth-middleware
+          entryPoints:
+            - websecure
+          tls: {}
+          # Note: No service defined - this is a parent router
+
+        # Child router for admin users
+        api-admin:
+          rule: "HeadersRegexp(`X-User-Role`, `admin`)"
+          service: admin-service
+          parentRefs:
+            - api-parent
+
+        # Child router for regular users
+        api-user:
+          rule: "HeadersRegexp(`X-User-Role`, `user`)"
+          service: user-service
+          parentRefs:
+            - api-parent
+
+      middlewares:
+        auth-middleware:
+          forwardAuth:
+            address: "http://auth-service:8080/auth"
+            authResponseHeaders:
+              - X-User-Role
+              - X-User-Name
+
+      services:
+        admin-service:
+          loadBalancer:
+            servers:
+              - url: "http://admin-backend:8080"
+
+        user-service:
+          loadBalancer:
+            servers:
+              - url: "http://user-backend:8080"
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Dynamic configuration
+    [http.routers]
+      # Parent router with authentication
+      [http.routers.api-parent]
+        rule = "PathPrefix(`/api`)"
+        middlewares = ["auth-middleware"]
+        entryPoints = ["websecure"]
+        [http.routers.api-parent.tls]
+        # Note: No service defined - this is a parent router
+
+      # Child router for admin users
+      [http.routers.api-admin]
+        rule = "HeadersRegexp(`X-User-Role`, `admin`)"
+        service = "admin-service"
+        parentRefs = ["api-parent"]
+
+      # Child router for regular users
+      [http.routers.api-user]
+        rule = "HeadersRegexp(`X-User-Role`, `user`)"
+        service = "user-service"
+        parentRefs = ["api-parent"]
+
+    [http.middlewares]
+      [http.middlewares.auth-middleware.forwardAuth]
+        address = "http://auth-service:8080/auth"
+        authResponseHeaders = ["X-User-Role", "X-User-Name"]
+
+    [http.services]
+      [http.services.admin-service.loadBalancer]
+        [[http.services.admin-service.loadBalancer.servers]]
+          url = "http://admin-backend:8080"
+
+      [http.services.user-service.loadBalancer]
+        [[http.services.user-service.loadBalancer.servers]]
+          url = "http://user-backend:8080"
+    ```
+
+    ```txt tab="KV (Consul/etcd/Redis/ZK)"
+    | Key                                                                    | Value                           |
+    |------------------------------------------------------------------------|---------------------------------|
+    | `traefik/http/routers/api-parent/rule`                                 | `PathPrefix(\`/api\`)`          |
+    | `traefik/http/routers/api-parent/middlewares/0`                        | `auth-middleware`               |
+    | `traefik/http/routers/api-parent/entrypoints/0`                        | `websecure`                     |
+    | `traefik/http/routers/api-parent/tls`                                  | `true`                          |
+    | `traefik/http/routers/api-admin/rule`                                  | `HeadersRegexp(\`X-User-Role\`, \`admin\`)` |
+    | `traefik/http/routers/api-admin/service`                               | `admin-service`                 |
+    | `traefik/http/routers/api-admin/parentrefs/0`                          | `api-parent`                    |
+    | `traefik/http/routers/api-user/rule`                                   | `HeadersRegexp(\`X-User-Role\`, \`user\`)` |
+    | `traefik/http/routers/api-user/service`                                | `user-service`                  |
+    | `traefik/http/routers/api-user/parentrefs/0`                           | `api-parent`                    |
+    | `traefik/http/middlewares/auth-middleware/forwardauth/address`         | `http://auth-service:8080/auth` |
+    | `traefik/http/middlewares/auth-middleware/forwardauth/authresponseheaders/0` | `X-User-Role`         |
+    | `traefik/http/middlewares/auth-middleware/forwardauth/authresponseheaders/1` | `X-User-Name`         |
+    | `traefik/http/services/admin-service/loadbalancer/servers/0/url`       | `http://admin-backend:8080`     |
+    | `traefik/http/services/user-service/loadbalancer/servers/0/url`        | `http://user-backend:8080`      |
+    ```
+
+    **How it works:**
+
+    1. Request to `/api/endpoint` matches `api-parent` router
+    2. `auth-middleware` (ForwardAuth) validates the request and adds `X-User-Role` header
+    3. Modified request is evaluated by child routers
+    4. If `X-User-Role: admin`, `api-admin` router matches and forwards to `admin-service`
+    5. If `X-User-Role: user`, `api-user` router matches and forwards to `user-service`
+
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/routing/router.md b/docs/content/reference/routing-configuration/http/routing/router.md
index 2e9a7eb56..6d322e121 100644
--- a/docs/content/reference/routing-configuration/http/routing/router.md
+++ b/docs/content/reference/routing-configuration/http/routing/router.md
@@ -32,6 +32,9 @@ http:
         metrics: true
         accessLogs: true
         tracing: true
+      parentRefs:
+        - "parent-router-1"
+        - "parent-router-2"
       service: my-service
 ```
 
@@ -43,6 +46,7 @@ http:
     priority = 10
     middlewares = ["auth", "ratelimit"]
     service = "my-service"
+    parentRefs = ["parent-router-1", "parent-router-2"]
 
     [http.routers.my-router.tls]
       certResolver = "letsencrypt"
@@ -88,15 +92,15 @@ labels:
     "traefik.http.routers.my-router.tls.domains[0].sans=www.example.com",
     "traefik.http.routers.my-router.observability.metrics=true",
     "traefik.http.routers.my-router.observability.accessLogs=true",
-    "traefik.http.routers.my-router.observability.tracing=true"
+    "traefik.http.routers.my-router.observability.tracing=true",
   ]
 }
 ```
 
 ## Configuration Options
 
-| Field                                                                                              | Description                                                                                                                                                                                                                                                                                                          | Default                     | Required |
-|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|----------|
+| Field                                                                                                          | Description                                                                                                                                                                                                                                                                                                          | Default                     | Required |
+|----------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|----------|
 | <a id="opt-entryPoints" href="#opt-entryPoints" title="#opt-entryPoints">`entryPoints`</a> | The list of entry points to which the router is attached. If not specified, HTTP routers are attached to all entry points.                                                                                                                                                                                           | All entry points            | No       |
 | <a id="opt-rule" href="#opt-rule" title="#opt-rule">`rule`</a> | Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria. If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service. See [Rules & Priority](./rules-and-priority.md) for details.              |                             | Yes      |
 | <a id="opt-priority" href="#opt-priority" title="#opt-priority">`priority`</a> | To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority. A value of `0` for the priority is ignored. See [Rules & Priority](./rules-and-priority.md) for details. | Rule length                 | No       |
@@ -106,6 +110,7 @@ labels:
 | <a id="opt-tls-options" href="#opt-tls-options" title="#opt-tls-options">`tls.options`</a> | The name of the TLS options to use for configuring TLS parameters (cipher suites, min/max TLS version, client authentication, etc.). See [TLS Options](../tls/tls-options.md) for detailed configuration.                                                                                                            | `default`                   | No       |
 | <a id="opt-tls-domains" href="#opt-tls-domains" title="#opt-tls-domains">`tls.domains`</a> | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. When using ACME certificate resolvers, domains are automatically extracted from router rules, making this option optional.                                                                                       |                             | No       |
 | <a id="opt-observability" href="#opt-observability" title="#opt-observability">`observability`</a> | Observability configuration for the router. Allows fine-grained control over access logs, metrics, and tracing per router. See [Observability](./observability.md) for details.                                                                                                                                      | Inherited from entry points | No       |
+| <a id="opt-parentRefs" href="#opt-parentRefs" title="#opt-parentRefs">`parentRefs`</a> | References to parent router names for multi-layer routing. When specified, this router becomes a child router that processes requests after parent routers have applied their middlewares. See [Multi-Layer Routing](../routing/multi-layer-routing.md) for details.                                        |                             | No       |
 | <a id="opt-service" href="#opt-service" title="#opt-service">`service`</a> | The name of the service that will handle the matched requests. Services can be load balancer services, weighted round robin, mirroring, or failover services. See [Service](../load-balancing/service.md) for details.                                                                                               |                             | Yes      |
 
 ## Router Naming
@@ -113,4 +118,4 @@ labels:
 - The character `@` is not authorized in the router name
 - In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names and rules
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/tls/overview.md b/docs/content/reference/routing-configuration/http/tls/overview.md
index c1e1a6892..7e05bf185 100644
--- a/docs/content/reference/routing-configuration/http/tls/overview.md
+++ b/docs/content/reference/routing-configuration/http/tls/overview.md
@@ -100,4 +100,4 @@ This provides fine-grained control over certificate generation and takes precede
 
 Every domain must have A/AAAA records pointing to Traefik.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/tls/tls-certificates.md b/docs/content/reference/routing-configuration/http/tls/tls-certificates.md
index 155dd1e4c..cb2f1a4ce 100644
--- a/docs/content/reference/routing-configuration/http/tls/tls-certificates.md
+++ b/docs/content/reference/routing-configuration/http/tls/tls-certificates.md
@@ -155,4 +155,4 @@ labels:
 }
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/http/tls/tls-options.md b/docs/content/reference/routing-configuration/http/tls/tls-options.md
index 939edf91e..0339ba70c 100644
--- a/docs/content/reference/routing-configuration/http/tls/tls-options.md
+++ b/docs/content/reference/routing-configuration/http/tls/tls-options.md
@@ -259,4 +259,4 @@ spec:
   disableSessionTickets: true
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
index 4328ebfd1..fc7ae06b2 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
@@ -23,6 +23,9 @@ metadata:
 spec:
   entryPoints:
     - web
+  parentRefs:
+    - name: parent-gateway
+      namespace: default  # Optional - defaults to same namespace
   routes:
   - kind: Rule
     # Rule on the Host
@@ -54,7 +57,7 @@ spec:
           httpOnly: true
           name: cookie
           secure: true
-      strategy: RoundRobin
+      strategy: wrr
       weight: 10
   tls:
     # Generate a TLS certificate using a certificate resolver
@@ -74,9 +77,12 @@ spec:
 
 ## Configuration Options
 
-| Field                                                                                                                                                                                | Description                                                                                                                                                                                                                                                                                                                                                                      | Default | Required |
-|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| Field                                                                                                                                                                                            | Description                                                                                                                                                                                                                                                                                                                                                                      | Default | Required |
+|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
 | <a id="opt-entryPoints" href="#opt-entryPoints" title="#opt-entryPoints">`entryPoints`</a> | List of [entry points](../../../../install-configuration/entrypoints.md) names.<br />If not specified, HTTP routers will accept requests from all EntryPoints in the list of default EntryPoints.                                                                                                                                                                                |         | No       |
+| <a id="opt-parentRefs" href="#opt-parentRefs" title="#opt-parentRefs">`parentRefs`</a> | List of references to parent IngressRoute resources for multi-layer routing. When specified, this IngressRoute's routers become children of the referenced parent IngressRoute's routers. See [Multi-Layer Routing](#multi-layer-routing-with-ingressroutes) section for details.                                                                                                |         | No       |
+| <a id="opt-parentRefsn-name" href="#opt-parentRefsn-name" title="#opt-parentRefsn-name">`parentRefs[n].name`</a> | Name of the referenced parent IngressRoute resource.                                                                                                                                                                                                                                                                                                                             |         | Yes      |
+| <a id="opt-parentRefsn-namespace" href="#opt-parentRefsn-namespace" title="#opt-parentRefsn-namespace">`parentRefs[n].namespace`</a> | Namespace of the referenced parent IngressRoute resource.<br />If not specified, defaults to the same namespace as the child IngressRoute.<br />Cross-namespace references require `allowCrossNamespace` provider option to be enabled.                                                                                                                                          |         | No       |
 | <a id="opt-routes" href="#opt-routes" title="#opt-routes">`routes`</a> | List of routes.                                                                                                                                                                                                                                                                                                                                                                  |         | Yes      |
 | <a id="opt-routesn-kind" href="#opt-routesn-kind" title="#opt-routesn-kind">`routes[n].kind`</a> | Kind of router matching, only `Rule` is allowed yet.                                                                                                                                                                                                                                                                                                                             | "Rule"  | No       |
 | <a id="opt-routesn-match" href="#opt-routesn-match" title="#opt-routesn-match">`routes[n].match`</a> | Defines the [rule](../../../http/routing/rules-and-priority.md#rules) corresponding to an underlying router.                                                                                                                                                                                                                                                                     |         | Yes      |
@@ -213,6 +219,162 @@ TLS options references, a conflict occurs, such as in the example below.
         ...
     ```
 
-If that happens, both mappings are discarded, and the host name 
+If that happens, both mappings are discarded, and the host name
 (`example.net` in the example) for these routers gets associated with
  the default TLS options instead.
+
+### Multi-Layer Routing with IngressRoutes
+
+Multi-layer routing allows creating hierarchical relationships between IngressRoutes,
+where parent IngressRoutes can apply middleware before child IngressRoutes make routing decisions.
+
+This is particularly useful for authentication-based routing,
+where a parent IngressRoute authenticates requests and adds context (e.g., user roles as headers),
+and child IngressRoutes route based on that context.
+
+When a child IngressRoute references a parent IngressRoute with multiple routes,
+**all** parent routers then become parents of **all** child routers.
+
+!!! info "Comprehensive Multi-Layer Routing Documentation"
+
+    For detailed information about multi-layer routing concepts, validation rules, and use cases, see the dedicated [Multi-Layer Routing](../../../../routing-configuration/http/routing/multi-layer-routing.md) page.
+
+#### Configuration Requirements
+
+### Root IngressRoutes
+
+- Have no `parentRefs` (top of the hierarchy)
+- **Can** have `entryPoints`, `tls`, and `observability` configuration
+- Can be either parent IngressRoutes (with children) or standalone IngressRoutes (with service)
+
+### Intermediate IngressRoutes
+
+- Reference their parent IngressRoute(s) via `parentRefs`
+- Have one or more child IngressRoutes
+- **Must not** have a `service` defined
+- **Must not** have `entryPoints`, `tls`, or `observability` configuration
+
+### Leaf IngressRoutes
+
+- Reference their parent IngressRoute(s) via `parentRefs`
+- **Must** have a `service` defined
+- **Must not** have `entryPoints`, `tls`, or `observability` configuration
+
+!!! warning "Cross-Namespace References"
+
+    Cross-namespace parent references require the `allowCrossNamespace` provider option to be enabled. 
+    If disabled, child IngressRoute creation will be skipped with an error logged.
+
+#### Example: Authentication-Based Routing
+
+??? example "Parent IngressRoute with ForwardAuth and Child IngressRoutes"
+
+    ```yaml tab="Parent IngressRoute"
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: api-parent
+      namespace: default
+    spec:
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      routes:
+        # Parent route with authentication - no services
+        - match: Host(`api.example.com`) && PathPrefix(`/api`)
+          kind: Rule
+          middlewares:
+            - name: auth-middleware
+              namespace: default
+    ---
+    apiVersion: traefik.io/v1alpha1
+    kind: Middleware
+    metadata:
+      name: auth-middleware
+      namespace: default
+    spec:
+      forwardAuth:
+        address: "http://auth-service.default.svc.cluster.local:8080/auth"
+        authResponseHeaders:
+          - X-User-Role
+          - X-User-Name
+    ```
+
+    ```yaml tab="Child IngressRoutes"
+    # Child IngressRoute for admin users
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: api-admin
+      namespace: default
+    spec:
+      parentRefs:
+        - name: api-parent
+          namespace: default  # Optional - defaults to same namespace
+      routes:
+        - match: HeadersRegexp(`X-User-Role`, `admin`)
+          kind: Rule
+          services:
+            - name: admin-service
+              port: 80
+    ---
+    # Child IngressRoute for regular users
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: api-user
+      namespace: default
+    spec:
+      parentRefs:
+        - name: api-parent
+      routes:
+        - match: HeadersRegexp(`X-User-Role`, `user`)
+          kind: Rule
+          services:
+            - name: user-service
+              port: 80
+    ```
+
+    ```yaml tab="Services"
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: auth-service
+      namespace: default
+    spec:
+      ports:
+        - port: 8080
+      selector:
+        app: auth-service
+    ---
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: admin-service
+      namespace: default
+    spec:
+      ports:
+        - port: 80
+      selector:
+        app: admin-backend
+    ---
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: user-service
+      namespace: default
+    spec:
+      ports:
+        - port: 80
+      selector:
+        app: user-backend
+    ```
+
+    **How it works:**
+
+    1. Request to `https://api.example.com/api/endpoint` matches the parent router
+    2. `auth-middleware` (ForwardAuth) validates the request with `auth-service`
+    3. `auth-service` returns 200 OK with `X-User-Role` header (e.g., `admin` or `user`)
+    4. Child routers evaluate rules against the modified request (with `X-User-Role` header)
+    5. Request is routed to `admin-service` or `user-service` based on the role
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md
index b69515b25..429b654c1 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md
@@ -47,7 +47,7 @@ spec:
           httpOnly: true
           name: cookie
           secure: true
-      strategy: RoundRobin
+      strategy: wrr
 ```
 
 ```yaml tab="TraefikService"
@@ -75,41 +75,41 @@ spec:
           httpOnly: true
           name: cookie
           secure: true
-      strategy: RoundRobin
+      strategy: wrr
 ```
 
 ## Configuration Options
 
-| Field                                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Default                                                              | Required |
-|:---------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
-| <a id="opt-kind" href="#opt-kind" title="#opt-kind">`kind`</a> | Kind of the service targeted.<br />Two values allowed:<br />- **Service**: Kubernetes Service<br /> **TraefikService**: Traefik Service.<br />More information [here](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                                                                  | "Service"                                                            | No       |
-| <a id="opt-name" href="#opt-name" title="#opt-name">`name`</a> | Service name.<br />The character `@` is not authorized. <br />More information [here](#middleware).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                      | Yes      |
-| <a id="opt-namespace" href="#opt-namespace" title="#opt-namespace">`namespace`</a> | Service namespace.<br />Can be empty if the service belongs to the same namespace as the IngressRoute. <br />More information [here](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                      | No       |
-| <a id="opt-port" href="#opt-port" title="#opt-port">`port`</a> | Service port (number or port name).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                      | No       |
-| <a id="opt-responseForwarding-flushInterval" href="#opt-responseForwarding-flushInterval" title="#opt-responseForwarding-flushInterval">`responseForwarding.`<br />`flushInterval`</a> | Interval, in milliseconds, in between flushes to the client while copying the response body.<br />A negative value means to flush immediately after each write to the client.<br />This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                    | 100ms                                                                | No       |
-| <a id="opt-scheme" href="#opt-scheme" title="#opt-scheme">`scheme`</a> | Scheme to use for the request to the upstream Kubernetes Service.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | "http"<br />"https" if `port` is 443 or contains the string *https*. | No       |
-| <a id="opt-serversTransport" href="#opt-serversTransport" title="#opt-serversTransport">`serversTransport`</a> | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                          | ""                                                                   | No       |
-| <a id="opt-passHostHeader" href="#opt-passHostHeader" title="#opt-passHostHeader">`passHostHeader`</a> | Forward client Host header to server.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | true                                                                 | No       |
-| <a id="opt-healthCheck-scheme" href="#opt-healthCheck-scheme" title="#opt-healthCheck-scheme">`healthCheck.scheme`</a> | Server URL scheme for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                           | ""                                                                   | No       |
-| <a id="opt-healthCheck-mode" href="#opt-healthCheck-mode" title="#opt-healthCheck-mode">`healthCheck.mode`</a> | Health check mode.<br /> If defined to grpc, will use the gRPC health check protocol to probe the server.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                  | "http"                                                               | No       |
-| <a id="opt-healthCheck-path" href="#opt-healthCheck-path" title="#opt-healthCheck-path">`healthCheck.path`</a> | Server URL path for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                             | ""                                                                   | No       |
-| <a id="opt-healthCheck-interval" href="#opt-healthCheck-interval" title="#opt-healthCheck-interval">`healthCheck.interval`</a> | Frequency of the health check calls for healthy targets.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                   | "100ms"                                                              | No       |
-| <a id="opt-healthCheck-unhealthyInterval" href="#opt-healthCheck-unhealthyInterval" title="#opt-healthCheck-unhealthyInterval">`healthCheck.unhealthyInterval`</a> | Frequency of the health check calls for unhealthy targets.<br />When not defined, it defaults to the `interval` value.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                     | "100ms"                                                              | No       |
-| <a id="opt-healthCheck-method" href="#opt-healthCheck-method" title="#opt-healthCheck-method">`healthCheck.method`</a> | HTTP method for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                 | "GET"                                                                | No       |
-| <a id="opt-healthCheck-status" href="#opt-healthCheck-status" title="#opt-healthCheck-status">`healthCheck.status`</a> | Expected HTTP status code of the response to the health check request.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.<br />If not set, expect a status between 200 and 399.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                        |                                                                      | No       |
-| <a id="opt-healthCheck-port" href="#opt-healthCheck-port" title="#opt-healthCheck-port">`healthCheck.port`</a> | URL port for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                    |                                                                      | No       |
-| <a id="opt-healthCheck-timeout" href="#opt-healthCheck-timeout" title="#opt-healthCheck-timeout">`healthCheck.timeout`</a> | Maximum duration to wait before considering the server unhealthy.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                          | "5s"                                                                 | No       |
-| <a id="opt-healthCheck-hostname" href="#opt-healthCheck-hostname" title="#opt-healthCheck-hostname">`healthCheck.hostname`</a> | Value in the Host header of the health check request.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                      | ""                                                                   | No       |
-| <a id="opt-healthCheck-followRedirect" href="#opt-healthCheck-followRedirect" title="#opt-healthCheck-followRedirect">`healthCheck.`<br />`followRedirect`</a> | Follow the redirections during the healtchcheck.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                                                           | true                                                                 | No       |
-| <a id="opt-healthCheck-headers" href="#opt-healthCheck-headers" title="#opt-healthCheck-headers">`healthCheck.headers`</a> | Map of header to send to the health check endpoint<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service)).                                                                                                                                                                                                                                                                                                                                                        |                                                                      | No       |
-| <a id="opt-sticky-cookie-name" href="#opt-sticky-cookie-name" title="#opt-sticky-cookie-name">`sticky.`<br />`cookie.name`</a> | Name of the cookie used for the stickiness.<br />When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.<br />On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.<br />If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).<br />Evaluated only if the kind is **Service**.                                                      | ""                                                                   | No       |
-| <a id="opt-sticky-cookie-httpOnly" href="#opt-sticky-cookie-httpOnly" title="#opt-sticky-cookie-httpOnly">`sticky.`<br />`cookie.httpOnly`</a> | Allow the cookie can be accessed by client-side APIs, such as JavaScript.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | false                                                                | No       |
-| <a id="opt-sticky-cookie-secure" href="#opt-sticky-cookie-secure" title="#opt-sticky-cookie-secure">`sticky.`<br />`cookie.secure`</a> | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | false                                                                | No       |
-| <a id="opt-sticky-cookie-sameSite" href="#opt-sticky-cookie-sameSite" title="#opt-sticky-cookie-sameSite">`sticky.`<br />`cookie.sameSite`</a> | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy<br />Allowed values:<br />-`none`<br />-`lax`<br />`strict`<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                   | ""                                                                   | No       |
-| <a id="opt-sticky-cookie-maxAge" href="#opt-sticky-cookie-maxAge" title="#opt-sticky-cookie-maxAge">`sticky.`<br />`cookie.maxAge`</a> | Number of seconds until the cookie expires.<br />Negative number, the cookie expires immediately.<br />0, the cookie never expires.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                            | 0                                                                    | No       |
-| <a id="opt-strategy" href="#opt-strategy" title="#opt-strategy">`strategy`</a> | Load balancing strategy between the servers.<br />RoundRobin is the only supported value yet.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | "RoundRobin"                                                         | No       |
-| <a id="opt-nativeLB" href="#opt-nativeLB" title="#opt-nativeLB">`nativeLB`</a> | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.<br /> Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                    | false                                                                | No       |
-| <a id="opt-nodePortLB" href="#opt-nodePortLB" title="#opt-nodePortLB">`nodePortLB`</a> | Use the nodePort IP address when the service type is NodePort.<br />It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                      | false                                                                | No       |
+| Field                                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Default                                                              | Required |
+|:---------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| <a id="opt-kind" href="#opt-kind" title="#opt-kind">`kind`</a> | Kind of the service targeted.<br />Two values allowed:<br />- **Service**: Kubernetes Service<br /> **TraefikService**: Traefik Service.<br />More information [here](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                  | "Service"                                                            | No       |
+| <a id="opt-name" href="#opt-name" title="#opt-name">`name`</a> | Service name.<br />The character `@` is not authorized. <br />More information [here](#middleware).                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                      | Yes      |
+| <a id="opt-namespace" href="#opt-namespace" title="#opt-namespace">`namespace`</a> | Service namespace.<br />Can be empty if the service belongs to the same namespace as the IngressRoute. <br />More information [here](#externalname-service).                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                      | No       |
+| <a id="opt-port" href="#opt-port" title="#opt-port">`port`</a> | Service port (number or port name).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                      | No       |
+| <a id="opt-responseForwarding-flushInterval" href="#opt-responseForwarding-flushInterval" title="#opt-responseForwarding-flushInterval">`responseForwarding.`<br />`flushInterval`</a> | Interval, in milliseconds, in between flushes to the client while copying the response body.<br />A negative value means to flush immediately after each write to the client.<br />This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                    | 100ms                                                                | No       |
+| <a id="opt-scheme" href="#opt-scheme" title="#opt-scheme">`scheme`</a> | Scheme to use for the request to the upstream Kubernetes Service.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                              | "http"<br />"https" if `port` is 443 or contains the string *https*. | No       |
+| <a id="opt-serversTransport" href="#opt-serversTransport" title="#opt-serversTransport">`serversTransport`</a> | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                          | ""                                                                   | No       |
+| <a id="opt-passHostHeader" href="#opt-passHostHeader" title="#opt-passHostHeader">`passHostHeader`</a> | Forward client Host header to server.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | true                                                                 | No       |
+| <a id="opt-healthCheck-scheme" href="#opt-healthCheck-scheme" title="#opt-healthCheck-scheme">`healthCheck.scheme`</a> | Server URL scheme for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                           | ""                                                                   | No       |
+| <a id="opt-healthCheck-mode" href="#opt-healthCheck-mode" title="#opt-healthCheck-mode">`healthCheck.mode`</a> | Health check mode.<br /> If defined to grpc, will use the gRPC health check protocol to probe the server.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                  | "http"                                                               | No       |
+| <a id="opt-healthCheck-path" href="#opt-healthCheck-path" title="#opt-healthCheck-path">`healthCheck.path`</a> | Server URL path for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                             | ""                                                                   | No       |
+| <a id="opt-healthCheck-interval" href="#opt-healthCheck-interval" title="#opt-healthCheck-interval">`healthCheck.interval`</a> | Frequency of the health check calls for healthy targets.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                   | "100ms"                                                              | No       |
+| <a id="opt-healthCheck-unhealthyInterval" href="#opt-healthCheck-unhealthyInterval" title="#opt-healthCheck-unhealthyInterval">`healthCheck.unhealthyInterval`</a> | Frequency of the health check calls for unhealthy targets.<br />When not defined, it defaults to the `interval` value.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                     | "100ms"                                                              | No       |
+| <a id="opt-healthCheck-method" href="#opt-healthCheck-method" title="#opt-healthCheck-method">`healthCheck.method`</a> | HTTP method for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                 | "GET"                                                                | No       |
+| <a id="opt-healthCheck-status" href="#opt-healthCheck-status" title="#opt-healthCheck-status">`healthCheck.status`</a> | Expected HTTP status code of the response to the health check request.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.<br />If not set, expect a status between 200 and 399.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                        |                                                                      | No       |
+| <a id="opt-healthCheck-port" href="#opt-healthCheck-port" title="#opt-healthCheck-port">`healthCheck.port`</a> | URL port for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                                    |                                                                      | No       |
+| <a id="opt-healthCheck-timeout" href="#opt-healthCheck-timeout" title="#opt-healthCheck-timeout">`healthCheck.timeout`</a> | Maximum duration to wait before considering the server unhealthy.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                          | "5s"                                                                 | No       |
+| <a id="opt-healthCheck-hostname" href="#opt-healthCheck-hostname" title="#opt-healthCheck-hostname">`healthCheck.hostname`</a> | Value in the Host header of the health check request.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                      | ""                                                                   | No       |
+| <a id="opt-healthCheck-followRedirect" href="#opt-healthCheck-followRedirect" title="#opt-healthCheck-followRedirect">`healthCheck.`<br />`followRedirect`</a> | Follow the redirections during the healtchcheck.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service).                                                                                                                                                                                                                                                                                                           | true                                                                 | No       |
+| <a id="opt-healthCheck-headers" href="#opt-healthCheck-headers" title="#opt-healthCheck-headers">`healthCheck.headers`</a> | Map of header to send to the health check endpoint<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service)).                                                                                                                                                                                                                                                                                                        |                                                                      | No       |
+| <a id="opt-sticky-cookie-name" href="#opt-sticky-cookie-name" title="#opt-sticky-cookie-name">`sticky.`<br />`cookie.name`</a> | Name of the cookie used for the stickiness.<br />When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.<br />On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.<br />If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).<br />Evaluated only if the kind is **Service**.      | ""                                                                   | No       |
+| <a id="opt-sticky-cookie-httpOnly" href="#opt-sticky-cookie-httpOnly" title="#opt-sticky-cookie-httpOnly">`sticky.`<br />`cookie.httpOnly`</a> | Allow the cookie can be accessed by client-side APIs, such as JavaScript.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                      | false                                                                | No       |
+| <a id="opt-sticky-cookie-secure" href="#opt-sticky-cookie-secure" title="#opt-sticky-cookie-secure">`sticky.`<br />`cookie.secure`</a> | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                            | false                                                                | No       |
+| <a id="opt-sticky-cookie-sameSite" href="#opt-sticky-cookie-sameSite" title="#opt-sticky-cookie-sameSite">`sticky.`<br />`cookie.sameSite`</a> | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy<br />Allowed values:<br />-`none`<br />-`lax`<br />`strict`<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                   | ""                                                                   | No       |
+| <a id="opt-sticky-cookie-maxAge" href="#opt-sticky-cookie-maxAge" title="#opt-sticky-cookie-maxAge">`sticky.`<br />`cookie.maxAge`</a> | Number of seconds until the cookie expires.<br />Negative number, the cookie expires immediately.<br />0, the cookie never expires.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                            | 0                                                                    | No       |
+| <a id="opt-strategy" href="#opt-strategy" title="#opt-strategy">`strategy`</a> | Strategy defines the load balancing strategy between the servers.<br />Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                   | "RoundRobin"                                                         | No       |
+| <a id="opt-nativeLB" href="#opt-nativeLB" title="#opt-nativeLB">`nativeLB`</a> | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.<br /> Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                    | false                                                                | No       |
+| <a id="opt-nodePortLB" href="#opt-nodePortLB" title="#opt-nodePortLB">`nodePortLB`</a> | Use the nodePort IP address when the service type is NodePort.<br />It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                      | false                                                                | No       |
 
 
 ### ExternalName Service
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
index 55bae513e..1d569aa54 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
@@ -3,11 +3,12 @@ title: "Traefik Kubernetes Services Documentation"
 description: "Learn how to configure routing and load balancing in Traefik Proxy to reach Services, which handle incoming requests. Read the technical documentation."
 --- 
 
-A `TraefikService` is a custom resource that sits on top of the Kubernetes Services. It enables advanced load-balancing features such as a [Weighted Round Robin](#weighted-round-robin) load balancing or a [Mirroring](#mirroring) between your Kubernetes Services.
+A `TraefikService` is a custom resource that sits on top of the Kubernetes Services. It enables advanced load-balancing features such as a [Weighted Round Robin](#weighted-round-robin) load balancing, a [Highest Random Weight](#highest-random-weight) load balancing, or a [Mirroring](#mirroring) between your Kubernetes Services.
 
 Services configure how to reach the actual endpoints that will eventually handle incoming requests. In Traefik, the target service can be either a standard [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)—which exposes a pod—or a TraefikService. The latter allows you to combine advanced load-balancing options like:
 
 - [Weighted Round Robin load balancing](#weighted-round-robin).
+- [Highest Random Weight load balancing](#highest-random-weight).
 - [Mirroring](#mirroring). 
 
 ## Weighted Round Robin
@@ -227,6 +228,143 @@ In the example above, to keep a session open with the same server, the client wo
 curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo
 ```
 
+## Highest Random Weight
+
+The HRW (Highest Random Weight) load balancer uses consistent hashing to ensure that requests from the same client IP are always routed to the same service. Unlike weighted round-robin which distributes requests based on weights, HRW provides consistent routing based on the client's remote address.
+
+This is particularly useful for maintaining session affinity without requiring sticky cookies, as clients will consistently reach the same backend service based on their IP address.
+
+### Configuration Example
+
+```yaml tab="IngressRoute"
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test-hrw
+  namespace: apps
+
+spec:
+  entryPoints:
+  - websecure
+  routes:
+  - match: Host(`example.com`) && PathPrefix(`/app`)
+    kind: Rule
+    services:
+    # Set an HRW TraefikService
+    - name: hrw1
+      namespace: apps
+      kind: TraefikService
+  tls:
+    secretName: supersecret
+```
+
+```yaml tab="TraefikService HRW"
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: hrw1
+  namespace: apps
+
+spec:
+  highestRandomWeight:
+    services:
+      # Kubernetes Service with weight 10
+      - name: svc1
+        namespace: apps
+        port: 80
+        weight: 10
+      # Kubernetes Service with weight 20
+      - name: svc2
+        namespace: apps
+        port: 80
+        weight: 20
+      # Another TraefikService
+      - name: wrr1
+        namespace: apps
+        kind: TraefikService
+        weight: 15
+```
+
+```yaml tab="Kubernetes Services"
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc1
+  namespace: apps
+
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: traefiklabs
+    task: app1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc2
+  namespace: apps
+
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: traefiklabs
+    task: app2
+```
+
+### Configuration Options
+
+| Field                                                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Default                                                              | Required |
+|:---------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| <a id="opt-services-2" href="#opt-services-2" title="#opt-services-2">`services`</a> | List of any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). Each service must have a weight assigned.                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                      | Yes      |
+| <a id="opt-servicesm-kind" href="#opt-servicesm-kind" title="#opt-servicesm-kind">`services[m].`<br />`kind`</a> | Kind of the service targeted.<br />Two values allowed:<br />- **Service**: Kubernetes Service<br /> - **TraefikService**: Traefik Service.                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | ""                                                                   | No       |
+| <a id="opt-servicesm-name" href="#opt-servicesm-name" title="#opt-servicesm-name">`services[m].`<br />`name`</a> | Service name.<br />The character `@` is not authorized.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | ""                                                                   | Yes      |
+| <a id="opt-servicesm-namespace" href="#opt-servicesm-namespace" title="#opt-servicesm-namespace">`services[m].`<br />`namespace`</a> | Service namespace.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | ""                                                                   | No       |
+| <a id="opt-servicesm-port" href="#opt-servicesm-port" title="#opt-servicesm-port">`services[m].`<br />`port`</a> | Service port (number or port name).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | ""                                                                   | No       |
+| <a id="opt-servicesm-weight-2" href="#opt-servicesm-weight-2" title="#opt-servicesm-weight-2">`services[m].`<br />`weight`</a> | Service weight used in the HRW algorithm. Higher weights increase the probability of selection for a given client IP.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | 1                                                                    | No       |
+| <a id="opt-servicesm-responseForwarding-flushInterval" href="#opt-servicesm-responseForwarding-flushInterval" title="#opt-servicesm-responseForwarding-flushInterval">`services[m].`<br />`responseForwarding.`<br />`flushInterval`</a> | Interval, in milliseconds, in between flushes to the client while copying the response body.<br />A negative value means to flush immediately after each write to the client.<br />This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                          | 100ms                                                                | No       |
+| <a id="opt-servicesm-scheme" href="#opt-servicesm-scheme" title="#opt-servicesm-scheme">`services[m].`<br />`scheme`</a> | Scheme to use for the request to the upstream Kubernetes Service.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | "http"<br />"https" if `port` is 443 or contains the string *https*. | No       |
+| <a id="opt-servicesm-serversTransport" href="#opt-servicesm-serversTransport" title="#opt-servicesm-serversTransport">`services[m].`<br />`serversTransport`</a> | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                | ""                                                                   | No       |
+| <a id="opt-servicesm-passHostHeader" href="#opt-servicesm-passHostHeader" title="#opt-servicesm-passHostHeader">`services[m].`<br />`passHostHeader`</a> | Forward client Host header to server.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | true                                                                 | No       |
+| <a id="opt-servicesm-healthCheck-scheme" href="#opt-servicesm-healthCheck-scheme" title="#opt-servicesm-healthCheck-scheme">`services[m].`<br />`healthCheck.scheme`</a> | Server URL scheme for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                        | ""                                                                   | No       |
+| <a id="opt-servicesm-healthCheck-mode" href="#opt-servicesm-healthCheck-mode" title="#opt-servicesm-healthCheck-mode">`services[m].`<br />`healthCheck.mode`</a> | Health check mode.<br /> If defined to grpc, will use the gRPC health check protocol to probe the server.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                               | "http"                                                               | No       |
+| <a id="opt-servicesm-healthCheck-path" href="#opt-servicesm-healthCheck-path" title="#opt-servicesm-healthCheck-path">`services[m].`<br />`healthCheck.path`</a> | Server URL path for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                          | ""                                                                   | No       |
+| <a id="opt-servicesm-healthCheck-interval" href="#opt-servicesm-healthCheck-interval" title="#opt-servicesm-healthCheck-interval">`services[m].`<br />`healthCheck.interval`</a> | Frequency of the health check calls for healthy targets.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                  | "100ms"                                                              | No       |
+| <a id="opt-servicesm-healthCheck-unhealthyInterval" href="#opt-servicesm-healthCheck-unhealthyInterval" title="#opt-servicesm-healthCheck-unhealthyInterval">`services[m].`<br />`healthCheck.unhealthyInterval`</a> | Frequency of the health check calls for unhealthy targets.<br />When not defined, it defaults to the `interval` value.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                    | "100ms"                                                              | No       |
+| <a id="opt-servicesm-healthCheck-method" href="#opt-servicesm-healthCheck-method" title="#opt-servicesm-healthCheck-method">`services[m].`<br />`healthCheck.method`</a> | HTTP method for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                              | "GET"                                                                | No       |
+| <a id="opt-servicesm-healthCheck-status" href="#opt-servicesm-healthCheck-status" title="#opt-servicesm-healthCheck-status">`services[m].`<br />`healthCheck.status`</a> | Expected HTTP status code of the response to the health check request.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.<br />If not set, expect a status between 200 and 399.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                              |                                                                      | No       |
+| <a id="opt-servicesm-healthCheck-port" href="#opt-servicesm-healthCheck-port" title="#opt-servicesm-healthCheck-port">`services[m].`<br />`healthCheck.port`</a> | URL port for the health check endpoint.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                      | No       |
+| <a id="opt-servicesm-healthCheck-timeout" href="#opt-servicesm-healthCheck-timeout" title="#opt-servicesm-healthCheck-timeout">`services[m].`<br />`healthCheck.timeout`</a> | Maximum duration to wait before considering the server unhealthy.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                       | "5s"                                                                 | No       |
+| <a id="opt-servicesm-healthCheck-hostname" href="#opt-servicesm-healthCheck-hostname" title="#opt-servicesm-healthCheck-hostname">`services[m].`<br />`healthCheck.hostname`</a> | Value in the Host header of the health check request.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                   | ""                                                                   | No       |
+| <a id="opt-servicesm-healthCheck-followRedirect" href="#opt-servicesm-healthCheck-followRedirect" title="#opt-servicesm-healthCheck-followRedirect">`services[m].`<br />`healthCheck.`<br />`followRedirect`</a> | Follow the redirections during the healtchcheck.<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                        | true                                                                 | No       |
+| <a id="opt-servicesm-healthCheck-headers" href="#opt-servicesm-healthCheck-headers" title="#opt-servicesm-healthCheck-headers">`services[m].`<br />`healthCheck.headers`</a> | Map of header to send to the health check endpoint<br />Evaluated only if the kind is **Service**.<br />Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`.                                                                                                                                                                                                                                                                                                                                                                                      |                                                                      | No       |
+| <a id="opt-servicesm-sticky-cookie-name" href="#opt-servicesm-sticky-cookie-name" title="#opt-servicesm-sticky-cookie-name">`services[m].`<br />`sticky.`<br />`cookie.name`</a> | Name of the cookie used for the stickiness.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Abbreviation of a sha1<br />(ex: `_1d52e`).                          | No       |
+| <a id="opt-servicesm-sticky-cookie-httpOnly" href="#opt-servicesm-sticky-cookie-httpOnly" title="#opt-servicesm-sticky-cookie-httpOnly">`services[m].`<br />`sticky.`<br />`cookie.httpOnly`</a> | Allow the cookie can be accessed by client-side APIs, such as JavaScript.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | false                                                                | No       |
+| <a id="opt-servicesm-sticky-cookie-secure" href="#opt-servicesm-sticky-cookie-secure" title="#opt-servicesm-sticky-cookie-secure">`services[m].`<br />`sticky.`<br />`cookie.secure`</a> | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | false                                                                | No       |
+| <a id="opt-servicesm-sticky-cookie-sameSite" href="#opt-servicesm-sticky-cookie-sameSite" title="#opt-servicesm-sticky-cookie-sameSite">`services[m].`<br />`sticky.`<br />`cookie.sameSite`</a> | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy.<br />Allowed values:<br />-`none`<br />-`lax`<br />`strict`<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                        | ""                                                                   | No       |
+| <a id="opt-servicesm-sticky-cookie-maxAge" href="#opt-servicesm-sticky-cookie-maxAge" title="#opt-servicesm-sticky-cookie-maxAge">`services[m].`<br />`sticky.`<br />`cookie.maxAge`</a> | Number of seconds until the cookie expires.<br />Negative number, the cookie expires immediately.<br />0, the cookie never expires.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                  | 0                                                                    | No       |
+| <a id="opt-servicesm-strategy" href="#opt-servicesm-strategy" title="#opt-servicesm-strategy">`services[m].`<br />`strategy`</a> | Load balancing strategy between the servers.<br />RoundRobin is the only supported value yet.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | "RoundRobin"                                                         | No       |
+| <a id="opt-servicesm-nativeLB" href="#opt-servicesm-nativeLB" title="#opt-servicesm-nativeLB">`services[m].`<br />`nativeLB`</a> | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                                                                                                                           | false                                                                | No       |
+| <a id="opt-servicesm-nodePortLB" href="#opt-servicesm-nodePortLB" title="#opt-servicesm-nodePortLB">`services[m].`<br />`nodePortLB`</a> | Use the nodePort IP address when the service type is NodePort.<br />It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.<br />Evaluated only if the kind is **Service**.                                                                                                                                                                                                                                                                                                                                                            | false                                                                | No       |
+
+### How HRW Works
+
+The Highest Random Weight algorithm combines consistent hashing with weighted load balancing:
+
+1. **Consistent Hashing**: For each incoming request, the client's remote address is hashed to ensure consistent routing.
+2. **Weighted Selection**: Each service is assigned a random value based on both the hash of the client IP and the service's weight.
+3. **Highest Selection**: The service with the highest calculated value receives the request.
+
+This approach provides several benefits:
+
+- **Session Affinity**: Clients consistently reach the same backend service
+- **Weighted Distribution**: Services with higher weights are more likely to be selected
+- **No State Required**: Unlike sticky cookies, no client-side or server-side state is needed
+- **Fault Tolerance**: If a service becomes unavailable, requests are redistributed consistently among remaining services
+
 ## Mirroring
 
 The mirroring is able to mirror requests sent to a service to other services.
diff --git a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
index a25e147c4..675fa7a8d 100644
--- a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
+++ b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
@@ -8,11 +8,12 @@ description: "The Kubernetes Gateway API can be used as a provider for routing a
 When using the Kubernetes Gateway API provider, Traefik leverages the Gateway API Custom Resource Definitions (CRDs) to obtain its routing configuration. 
 For detailed information on the Gateway API concepts and resources, refer to the official [documentation](https://gateway-api.sigs.k8s.io/).
 
-The Kubernetes Gateway API provider supports version [v1.2.1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1) of the specification.
+The Kubernetes Gateway API provider supports version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the specification.
 
-It fully supports all `HTTPRoute` core and some extended features, like `GRPCRoute`, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). 
+It fully supports all `HTTPRoute` core and some extended features, like `BackendTLSPolicy`, and `GRPCRoute` resources from the [Standard channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels), as well as `TCPRoute`, and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). 
+
+For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik).
 
-For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.2.1/traefik-traefik).
 
 ## Deploying a Gateway
 
@@ -762,4 +763,4 @@ spec:
 
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md
index af98d1b2b..ead159e18 100644
--- a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md
+++ b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md
@@ -5,21 +5,31 @@ description: "Understand the routing configuration for the Kubernetes Ingress NG
 
 # Traefik & Ingresses with NGINX Annotations
 
-The experimental Kubernetes Controller for Ingresses with NGINX annotations.
+Enable seamless migration from NGINX Ingress Controller to Traefik with NGINX annotation compatibility.
 {: .subtitle }
 
-!!! warning "Ingress Discovery"
+!!! warning "NGINX Ingress Controller Retirement"
 
-    The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster,
-    which may lead to duplicated routers if you are also using the Kubernetes Ingress provider.
-    We recommend to use IngressClass for the Ingresses you want to be handled by this provider,
-    or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces.
+    The Kubernetes NGINX Ingress Controller project has announced its retirement in **March 2026** and will no longer receive updates or security patches.
+    Traefik provides a migration path by supporting NGINX annotations, allowing you to transition your workloads without rewriting all your Ingress configurations.
+
+    **→ See the [NGINX to Traefik Migration Guide](../../../migrate/nginx-to-traefik.md) for step-by-step instructions.**
+
+    For more information about the NGINX Ingress Controller retirement, see the [official Kubernetes blog announcement](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement).
+
+## Ingress Discovery
+
+This provider discovers all Ingresses in the cluster by default, which may lead to duplicated routers if you are also using the standard Kubernetes Ingress provider.
+
+**Best Practices:**
+
+- Use IngressClass to specify which Ingresses should be handled by this provider
+- Configure `watchNamespace` to limit discovery to specific namespaces
+- Use `watchNamespaceSelector` to target Ingresses based on namespace labels
 
 ## Routing Configuration
 
-The Kubernetes Ingress NGINX provider watches for incoming ingresses events, such as the example below,
-and derives the corresponding dynamic configuration from it,
-which in turn will create the resulting routers, services, handlers, etc.
+This provider watches for incoming Ingress events and automatically translates NGINX annotations into Traefik's dynamic configuration, creating the corresponding routers, services, middlewares, and other components needed to handle your traffic.
 
 ## Configuration Example
 
@@ -138,7 +148,7 @@ which in turn will create the resulting routers, services, handlers, etc.
             serviceAccountName: traefik-ingress-controller
             containers:
               - name: traefik
-                image: traefik:v3.5
+                image: traefik:v3.6
                 args:
                   - --entryPoints.web.address=:80
                   - --providers.kubernetesingressnginx
@@ -239,32 +249,13 @@ which in turn will create the resulting routers, services, handlers, etc.
 
 ## Annotations Support
 
-This section lists all known NGINX Ingress annotations, split between those currently implemented (with limitations if any) and those not implemented. 
-Limitations or behavioral differences are indicated where relevant.
+This section lists all known NGINX Ingress annotations.
+The following annotations are organized by category for easier navigation.
 
-!!! warning "Global configuration"
-
-    Traefik does not expose all global configuration options to control default behaviors for ingresses. 
-    
-    Some behaviors that are globally configurable in NGINX (such as default SSL redirect, rate limiting, or affinity) are currently not supported and cannot be overridden per-ingress as in NGINX.
-
-### Caveats and Key Behavioral Differences
-
-- **Authentication**: Forward auth behaves differently and session caching is not supported. NGINX supports sub-request based auth, while Traefik forwards the original request.
-- **Session Affinity**: Only persistent mode is supported.
-- **Leader Election**: Not supported; no cluster mode with leader election.
-- **Default Backend**: Only `defaultBackend` in Ingress spec is supported; the annotation is ignored.
-- **Load Balancing**: Only round_robin is supported; EWMA and IP hash are not supported.
-- **CORS**: NGINX responds with all configured headers unconditionally; Traefik handles headers differently between pre-flight and regular requests.
-- **TLS/Backend Protocols**: AUTO_HTTP, FCGI and some TLS options are not supported in Traefik.
-- **Path Handling**: Traefik preserves trailing slashes by default; NGINX removes them unless configured otherwise.
-
-### Supported NGINX Annotations
+### Authentication
 
 | Annotation                                            | Limitations / Notes                                                                        |
 |-------------------------------------------------------|--------------------------------------------------------------------------------------------|
-| <a id="opt-nginx-ingress-kubernetes-ioaffinity" href="#opt-nginx-ingress-kubernetes-ioaffinity" title="#opt-nginx-ingress-kubernetes-ioaffinity">`nginx.ingress.kubernetes.io/affinity`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioaffinity-mode" href="#opt-nginx-ingress-kubernetes-ioaffinity-mode" title="#opt-nginx-ingress-kubernetes-ioaffinity-mode">`nginx.ingress.kubernetes.io/affinity-mode`</a> | Only persistent mode supported; balanced/canary not supported.                             |
 | <a id="opt-nginx-ingress-kubernetes-ioauth-type" href="#opt-nginx-ingress-kubernetes-ioauth-type" title="#opt-nginx-ingress-kubernetes-ioauth-type">`nginx.ingress.kubernetes.io/auth-type`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-ioauth-secret" href="#opt-nginx-ingress-kubernetes-ioauth-secret" title="#opt-nginx-ingress-kubernetes-ioauth-secret">`nginx.ingress.kubernetes.io/auth-secret`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-ioauth-secret-type" href="#opt-nginx-ingress-kubernetes-ioauth-secret-type" title="#opt-nginx-ingress-kubernetes-ioauth-secret-type">`nginx.ingress.kubernetes.io/auth-secret-type`</a> |                                                                                            |
@@ -272,29 +263,72 @@ Limitations or behavioral differences are indicated where relevant.
 | <a id="opt-nginx-ingress-kubernetes-ioauth-url" href="#opt-nginx-ingress-kubernetes-ioauth-url" title="#opt-nginx-ingress-kubernetes-ioauth-url">`nginx.ingress.kubernetes.io/auth-url`</a> | Only URL and response headers copy supported. Forward auth behaves differently than NGINX. |
 | <a id="opt-nginx-ingress-kubernetes-ioauth-method" href="#opt-nginx-ingress-kubernetes-ioauth-method" title="#opt-nginx-ingress-kubernetes-ioauth-method">`nginx.ingress.kubernetes.io/auth-method`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-ioauth-response-headers" href="#opt-nginx-ingress-kubernetes-ioauth-response-headers" title="#opt-nginx-ingress-kubernetes-ioauth-response-headers">`nginx.ingress.kubernetes.io/auth-response-headers`</a> |                                                                                            |
+
+### SSL/TLS
+
+| Annotation                                            | Limitations / Notes                                                                        |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
 | <a id="opt-nginx-ingress-kubernetes-iossl-redirect" href="#opt-nginx-ingress-kubernetes-iossl-redirect" title="#opt-nginx-ingress-kubernetes-iossl-redirect">`nginx.ingress.kubernetes.io/ssl-redirect`</a> | Cannot opt-out per route if enabled globally.                                              |
 | <a id="opt-nginx-ingress-kubernetes-ioforce-ssl-redirect" href="#opt-nginx-ingress-kubernetes-ioforce-ssl-redirect" title="#opt-nginx-ingress-kubernetes-ioforce-ssl-redirect">`nginx.ingress.kubernetes.io/force-ssl-redirect`</a> | Cannot opt-out per route if enabled globally.                                              |
 | <a id="opt-nginx-ingress-kubernetes-iossl-passthrough" href="#opt-nginx-ingress-kubernetes-iossl-passthrough" title="#opt-nginx-ingress-kubernetes-iossl-passthrough">`nginx.ingress.kubernetes.io/ssl-passthrough`</a> | Some differences in SNI/default backend handling.                                          |
-| <a id="opt-nginx-ingress-kubernetes-iouse-regex" href="#opt-nginx-ingress-kubernetes-iouse-regex" title="#opt-nginx-ingress-kubernetes-iouse-regex">`nginx.ingress.kubernetes.io/use-regex`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name">`nginx.ingress.kubernetes.io/proxy-ssl-server-name`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-name" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-name" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-name">`nginx.ingress.kubernetes.io/proxy-ssl-name`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-verify" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify">`nginx.ingress.kubernetes.io/proxy-ssl-verify`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-secret" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-secret" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-secret">`nginx.ingress.kubernetes.io/proxy-ssl-secret`</a> |                                                                                            |
+
+### Session Affinity
+
+| Annotation                                            | Limitations / Notes                                                                        |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
+| <a id="opt-nginx-ingress-kubernetes-ioaffinity" href="#opt-nginx-ingress-kubernetes-ioaffinity" title="#opt-nginx-ingress-kubernetes-ioaffinity">`nginx.ingress.kubernetes.io/affinity`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-ioaffinity-mode" href="#opt-nginx-ingress-kubernetes-ioaffinity-mode" title="#opt-nginx-ingress-kubernetes-ioaffinity-mode">`nginx.ingress.kubernetes.io/affinity-mode`</a> | Only persistent mode supported; balanced/canary not supported.                             |
 | <a id="opt-nginx-ingress-kubernetes-iosession-cookie-name" href="#opt-nginx-ingress-kubernetes-iosession-cookie-name" title="#opt-nginx-ingress-kubernetes-iosession-cookie-name">`nginx.ingress.kubernetes.io/session-cookie-name`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-secure" href="#opt-nginx-ingress-kubernetes-iosession-cookie-secure" title="#opt-nginx-ingress-kubernetes-iosession-cookie-secure">`nginx.ingress.kubernetes.io/session-cookie-secure`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iosession-cookie-path" href="#opt-nginx-ingress-kubernetes-iosession-cookie-path" title="#opt-nginx-ingress-kubernetes-iosession-cookie-path">`nginx.ingress.kubernetes.io/session-cookie-path`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iosession-cookie-domain" href="#opt-nginx-ingress-kubernetes-iosession-cookie-domain" title="#opt-nginx-ingress-kubernetes-iosession-cookie-domain">`nginx.ingress.kubernetes.io/session-cookie-domain`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iosession-cookie-samesite" href="#opt-nginx-ingress-kubernetes-iosession-cookie-samesite" title="#opt-nginx-ingress-kubernetes-iosession-cookie-samesite">`nginx.ingress.kubernetes.io/session-cookie-samesite`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-max-age" href="#opt-nginx-ingress-kubernetes-iosession-cookie-max-age" title="#opt-nginx-ingress-kubernetes-iosession-cookie-max-age">`nginx.ingress.kubernetes.io/session-cookie-max-age`</a> |                                                                                            |
+
+### Load Balancing & Backend
+
+| Annotation                                            | Limitations / Notes                                                                        |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
 | <a id="opt-nginx-ingress-kubernetes-ioload-balance" href="#opt-nginx-ingress-kubernetes-ioload-balance" title="#opt-nginx-ingress-kubernetes-ioload-balance">`nginx.ingress.kubernetes.io/load-balance`</a> | Only round_robin supported; ewma and IP hash not supported.                                |
 | <a id="opt-nginx-ingress-kubernetes-iobackend-protocol" href="#opt-nginx-ingress-kubernetes-iobackend-protocol" title="#opt-nginx-ingress-kubernetes-iobackend-protocol">`nginx.ingress.kubernetes.io/backend-protocol`</a> | FCGI and AUTO_HTTP not supported.                                                          |
+| <a id="opt-nginx-ingress-kubernetes-ioservice-upstream" href="#opt-nginx-ingress-kubernetes-ioservice-upstream" title="#opt-nginx-ingress-kubernetes-ioservice-upstream">`nginx.ingress.kubernetes.io/service-upstream`</a> |                                                                                            |
+
+### CORS
+
+| Annotation                                            | Limitations / Notes                                                                        |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
 | <a id="opt-nginx-ingress-kubernetes-ioenable-cors" href="#opt-nginx-ingress-kubernetes-ioenable-cors" title="#opt-nginx-ingress-kubernetes-ioenable-cors">`nginx.ingress.kubernetes.io/enable-cors`</a> | Partial support.                                                                           |
 | <a id="opt-nginx-ingress-kubernetes-iocors-allow-credentials" href="#opt-nginx-ingress-kubernetes-iocors-allow-credentials" title="#opt-nginx-ingress-kubernetes-iocors-allow-credentials">`nginx.ingress.kubernetes.io/cors-allow-credentials`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iocors-allow-headers" href="#opt-nginx-ingress-kubernetes-iocors-allow-headers" title="#opt-nginx-ingress-kubernetes-iocors-allow-headers">`nginx.ingress.kubernetes.io/cors-allow-headers`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iocors-allow-methods" href="#opt-nginx-ingress-kubernetes-iocors-allow-methods" title="#opt-nginx-ingress-kubernetes-iocors-allow-methods">`nginx.ingress.kubernetes.io/cors-allow-methods`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iocors-allow-origin" href="#opt-nginx-ingress-kubernetes-iocors-allow-origin" title="#opt-nginx-ingress-kubernetes-iocors-allow-origin">`nginx.ingress.kubernetes.io/cors-allow-origin`</a> |                                                                                            |
+| <a id="opt-nginx-ingress-kubernetes-iocors-expose-headers" href="#opt-nginx-ingress-kubernetes-iocors-expose-headers" title="#opt-nginx-ingress-kubernetes-iocors-expose-headers">`nginx.ingress.kubernetes.io/cors-expose-headers`</a> |                                                                                            |
 | <a id="opt-nginx-ingress-kubernetes-iocors-max-age" href="#opt-nginx-ingress-kubernetes-iocors-max-age" title="#opt-nginx-ingress-kubernetes-iocors-max-age">`nginx.ingress.kubernetes.io/cors-max-age`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-server-name">`nginx.ingress.kubernetes.io/proxy-ssl-server-name`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-name" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-name" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-name">`nginx.ingress.kubernetes.io/proxy-ssl-name`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-verify" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify">`nginx.ingress.kubernetes.io/proxy-ssl-verify`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-secret" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-secret" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-secret">`nginx.ingress.kubernetes.io/proxy-ssl-secret`</a> |                                                                                            |
-| <a id="opt-nginx-ingress-kubernetes-ioservice-upstream" href="#opt-nginx-ingress-kubernetes-ioservice-upstream" title="#opt-nginx-ingress-kubernetes-ioservice-upstream">`nginx.ingress.kubernetes.io/service-upstream`</a> |                                                                                            |
 
-### Unsupported NGINX Annotations
+### Routing
+
+| Annotation                                            | Limitations / Notes                                                                        |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
+| <a id="opt-nginx-ingress-kubernetes-iouse-regex" href="#opt-nginx-ingress-kubernetes-iouse-regex" title="#opt-nginx-ingress-kubernetes-iouse-regex">`nginx.ingress.kubernetes.io/use-regex`</a> |                                                                                            |
+
+## Limitations
+
+### Caveats and Key Behavioral Differences
+
+- **Authentication**: Forward auth behaves differently and session caching is not supported. NGINX supports sub-request based auth, while Traefik forwards the original request.
+- **Session Affinity**: Only persistent mode is supported.
+- **Leader Election**: Not supported; no cluster mode with leader election.
+- **Default Backend**: Only defaultBackend in Ingress spec is supported; the annotation is ignored.
+- **Load Balancing**: Only round_robin is supported; EWMA and IP hash are not supported.
+- **CORS**: NGINX responds with all configured headers unconditionally; Traefik handles headers differently between pre-flight and regular requests.
+- **TLS/Backend Protocols**: AUTO_HTTP, FCGI and some TLS options are not supported in Traefik.
+- **Path Handling**: Traefik preserves trailing slashes by default; NGINX removes them unless configured otherwise
+
+### Unsupported Annotations
 
 !!! question "Want to Add Support for More Annotations?"
 
@@ -305,98 +339,104 @@ Limitations or behavioral differences are indicated where relevant.
 
     All contributions and suggestions are welcome — let's build this together!
 
-
 | Annotation                                                                  | Notes                                                |
 |-----------------------------------------------------------------------------|------------------------------------------------------|
-| <a id="opt-nginx-ingress-kubernetes-ioapp-root" href="#opt-nginx-ingress-kubernetes-ioapp-root" title="#opt-nginx-ingress-kubernetes-ioapp-root">`nginx.ingress.kubernetes.io/app-root`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior" href="#opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior" title="#opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior">`nginx.ingress.kubernetes.io/affinity-canary-behavior`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-secret" href="#opt-nginx-ingress-kubernetes-ioauth-tls-secret" title="#opt-nginx-ingress-kubernetes-ioauth-tls-secret">`nginx.ingress.kubernetes.io/auth-tls-secret`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth" href="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth" title="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth">`nginx.ingress.kubernetes.io/auth-tls-verify-depth`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-verify-client" href="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-client" title="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-client">`nginx.ingress.kubernetes.io/auth-tls-verify-client`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-error-page" href="#opt-nginx-ingress-kubernetes-ioauth-tls-error-page" title="#opt-nginx-ingress-kubernetes-ioauth-tls-error-page">`nginx.ingress.kubernetes.io/auth-tls-error-page`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream" href="#opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream" title="#opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream">`nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-match-cn" href="#opt-nginx-ingress-kubernetes-ioauth-tls-match-cn" title="#opt-nginx-ingress-kubernetes-ioauth-tls-match-cn">`nginx.ingress.kubernetes.io/auth-tls-match-cn`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-cache-key" href="#opt-nginx-ingress-kubernetes-ioauth-cache-key" title="#opt-nginx-ingress-kubernetes-ioauth-cache-key">`nginx.ingress.kubernetes.io/auth-cache-key`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-cache-duration" href="#opt-nginx-ingress-kubernetes-ioauth-cache-duration" title="#opt-nginx-ingress-kubernetes-ioauth-cache-duration">`nginx.ingress.kubernetes.io/auth-cache-duration`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive">`nginx.ingress.kubernetes.io/auth-keepalive`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars">`nginx.ingress.kubernetes.io/auth-keepalive-share-vars`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-requests" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-requests" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-requests">`nginx.ingress.kubernetes.io/auth-keepalive-requests`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout">`nginx.ingress.kubernetes.io/auth-keepalive-timeout`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers" href="#opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers" title="#opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers">`nginx.ingress.kubernetes.io/auth-proxy-set-headers`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioauth-snippet" href="#opt-nginx-ingress-kubernetes-ioauth-snippet" title="#opt-nginx-ingress-kubernetes-ioauth-snippet">`nginx.ingress.kubernetes.io/auth-snippet`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-global-auth" href="#opt-nginx-ingress-kubernetes-ioenable-global-auth" title="#opt-nginx-ingress-kubernetes-ioenable-global-auth">`nginx.ingress.kubernetes.io/enable-global-auth`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary" href="#opt-nginx-ingress-kubernetes-iocanary" title="#opt-nginx-ingress-kubernetes-iocanary">`nginx.ingress.kubernetes.io/canary`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header" href="#opt-nginx-ingress-kubernetes-iocanary-by-header" title="#opt-nginx-ingress-kubernetes-iocanary-by-header">`nginx.ingress.kubernetes.io/canary-by-header`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header-value" href="#opt-nginx-ingress-kubernetes-iocanary-by-header-value" title="#opt-nginx-ingress-kubernetes-iocanary-by-header-value">`nginx.ingress.kubernetes.io/canary-by-header-value`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header-pattern" href="#opt-nginx-ingress-kubernetes-iocanary-by-header-pattern" title="#opt-nginx-ingress-kubernetes-iocanary-by-header-pattern">`nginx.ingress.kubernetes.io/canary-by-header-pattern`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-by-cookie" href="#opt-nginx-ingress-kubernetes-iocanary-by-cookie" title="#opt-nginx-ingress-kubernetes-iocanary-by-cookie">`nginx.ingress.kubernetes.io/canary-by-cookie`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-weight" href="#opt-nginx-ingress-kubernetes-iocanary-weight" title="#opt-nginx-ingress-kubernetes-iocanary-weight">`nginx.ingress.kubernetes.io/canary-weight`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocanary-weight-total" href="#opt-nginx-ingress-kubernetes-iocanary-weight-total" title="#opt-nginx-ingress-kubernetes-iocanary-weight-total">`nginx.ingress.kubernetes.io/canary-weight-total`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioclient-body-buffer-size" href="#opt-nginx-ingress-kubernetes-ioclient-body-buffer-size" title="#opt-nginx-ingress-kubernetes-ioclient-body-buffer-size">`nginx.ingress.kubernetes.io/client-body-buffer-size`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioconfiguration-snippet" href="#opt-nginx-ingress-kubernetes-ioconfiguration-snippet" title="#opt-nginx-ingress-kubernetes-ioconfiguration-snippet">`nginx.ingress.kubernetes.io/configuration-snippet`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iocustom-http-errors" href="#opt-nginx-ingress-kubernetes-iocustom-http-errors" title="#opt-nginx-ingress-kubernetes-iocustom-http-errors">`nginx.ingress.kubernetes.io/custom-http-errors`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors" href="#opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors" title="#opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors">`nginx.ingress.kubernetes.io/disable-proxy-intercept-errors`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iodefault-backend" href="#opt-nginx-ingress-kubernetes-iodefault-backend" title="#opt-nginx-ingress-kubernetes-iodefault-backend">`nginx.ingress.kubernetes.io/default-backend`</a> | Not supported yet; use `defaultBackend` in Ingress spec. |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-rate-after" href="#opt-nginx-ingress-kubernetes-iolimit-rate-after" title="#opt-nginx-ingress-kubernetes-iolimit-rate-after">`nginx.ingress.kubernetes.io/limit-rate-after`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-rate" href="#opt-nginx-ingress-kubernetes-iolimit-rate" title="#opt-nginx-ingress-kubernetes-iolimit-rate">`nginx.ingress.kubernetes.io/limit-rate`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-whitelist" href="#opt-nginx-ingress-kubernetes-iolimit-whitelist" title="#opt-nginx-ingress-kubernetes-iolimit-whitelist">`nginx.ingress.kubernetes.io/limit-whitelist`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-rps" href="#opt-nginx-ingress-kubernetes-iolimit-rps" title="#opt-nginx-ingress-kubernetes-iolimit-rps">`nginx.ingress.kubernetes.io/limit-rps`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-rpm" href="#opt-nginx-ingress-kubernetes-iolimit-rpm" title="#opt-nginx-ingress-kubernetes-iolimit-rpm">`nginx.ingress.kubernetes.io/limit-rpm`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-burst-multiplier" href="#opt-nginx-ingress-kubernetes-iolimit-burst-multiplier" title="#opt-nginx-ingress-kubernetes-iolimit-burst-multiplier">`nginx.ingress.kubernetes.io/limit-burst-multiplier`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iolimit-connections" href="#opt-nginx-ingress-kubernetes-iolimit-connections" title="#opt-nginx-ingress-kubernetes-iolimit-connections">`nginx.ingress.kubernetes.io/limit-connections`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit">`nginx.ingress.kubernetes.io/global-rate-limit`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window">`nginx.ingress.kubernetes.io/global-rate-limit-window`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key">`nginx.ingress.kubernetes.io/global-rate-limit-key`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs">`nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iopermanent-redirect" href="#opt-nginx-ingress-kubernetes-iopermanent-redirect" title="#opt-nginx-ingress-kubernetes-iopermanent-redirect">`nginx.ingress.kubernetes.io/permanent-redirect`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iopermanent-redirect-code" href="#opt-nginx-ingress-kubernetes-iopermanent-redirect-code" title="#opt-nginx-ingress-kubernetes-iopermanent-redirect-code">`nginx.ingress.kubernetes.io/permanent-redirect-code`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iotemporal-redirect" href="#opt-nginx-ingress-kubernetes-iotemporal-redirect" title="#opt-nginx-ingress-kubernetes-iotemporal-redirect">`nginx.ingress.kubernetes.io/temporal-redirect`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iopreserve-trailing-slash" href="#opt-nginx-ingress-kubernetes-iopreserve-trailing-slash" title="#opt-nginx-ingress-kubernetes-iopreserve-trailing-slash">`nginx.ingress.kubernetes.io/preserve-trailing-slash`</a> | Not supported yet; Traefik preserves by default.         |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-cookie-domain" href="#opt-nginx-ingress-kubernetes-ioproxy-cookie-domain" title="#opt-nginx-ingress-kubernetes-ioproxy-cookie-domain">`nginx.ingress.kubernetes.io/proxy-cookie-domain`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-cookie-path" href="#opt-nginx-ingress-kubernetes-ioproxy-cookie-path" title="#opt-nginx-ingress-kubernetes-ioproxy-cookie-path">`nginx.ingress.kubernetes.io/proxy-cookie-path`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-connect-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-connect-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-connect-timeout">`nginx.ingress.kubernetes.io/proxy-connect-timeout`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-send-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-send-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-send-timeout">`nginx.ingress.kubernetes.io/proxy-send-timeout`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-read-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-read-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-read-timeout">`nginx.ingress.kubernetes.io/proxy-read-timeout`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream">`nginx.ingress.kubernetes.io/proxy-next-upstream`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout">`nginx.ingress.kubernetes.io/proxy-next-upstream-timeout`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries">`nginx.ingress.kubernetes.io/proxy-next-upstream-tries`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-request-buffering" href="#opt-nginx-ingress-kubernetes-ioproxy-request-buffering" title="#opt-nginx-ingress-kubernetes-ioproxy-request-buffering">`nginx.ingress.kubernetes.io/proxy-request-buffering`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-redirect-from" href="#opt-nginx-ingress-kubernetes-ioproxy-redirect-from" title="#opt-nginx-ingress-kubernetes-ioproxy-redirect-from">`nginx.ingress.kubernetes.io/proxy-redirect-from`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-redirect-to" href="#opt-nginx-ingress-kubernetes-ioproxy-redirect-to" title="#opt-nginx-ingress-kubernetes-ioproxy-redirect-to">`nginx.ingress.kubernetes.io/proxy-redirect-to`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-http-version" href="#opt-nginx-ingress-kubernetes-ioproxy-http-version" title="#opt-nginx-ingress-kubernetes-ioproxy-http-version">`nginx.ingress.kubernetes.io/proxy-http-version`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers">`nginx.ingress.kubernetes.io/proxy-ssl-ciphers`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth">`nginx.ingress.kubernetes.io/proxy-ssl-verify-depth`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols">`nginx.ingress.kubernetes.io/proxy-ssl-protocols`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-rewrite-log" href="#opt-nginx-ingress-kubernetes-ioenable-rewrite-log" title="#opt-nginx-ingress-kubernetes-ioenable-rewrite-log">`nginx.ingress.kubernetes.io/enable-rewrite-log`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iorewrite-target" href="#opt-nginx-ingress-kubernetes-iorewrite-target" title="#opt-nginx-ingress-kubernetes-iorewrite-target">`nginx.ingress.kubernetes.io/rewrite-target`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iosatisfy" href="#opt-nginx-ingress-kubernetes-iosatisfy" title="#opt-nginx-ingress-kubernetes-iosatisfy">`nginx.ingress.kubernetes.io/satisfy`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioserver-alias" href="#opt-nginx-ingress-kubernetes-ioserver-alias" title="#opt-nginx-ingress-kubernetes-ioserver-alias">`nginx.ingress.kubernetes.io/server-alias`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioserver-snippet" href="#opt-nginx-ingress-kubernetes-ioserver-snippet" title="#opt-nginx-ingress-kubernetes-ioserver-snippet">`nginx.ingress.kubernetes.io/server-snippet`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none" href="#opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none" title="#opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none">`nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-expires" href="#opt-nginx-ingress-kubernetes-iosession-cookie-expires" title="#opt-nginx-ingress-kubernetes-iosession-cookie-expires">`nginx.ingress.kubernetes.io/session-cookie-expires`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure" href="#opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure" title="#opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure">`nginx.ingress.kubernetes.io/session-cookie-change-on-failure`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iossl-ciphers" href="#opt-nginx-ingress-kubernetes-iossl-ciphers" title="#opt-nginx-ingress-kubernetes-iossl-ciphers">`nginx.ingress.kubernetes.io/ssl-ciphers`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers" href="#opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers" title="#opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers">`nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioconnection-proxy-header" href="#opt-nginx-ingress-kubernetes-ioconnection-proxy-header" title="#opt-nginx-ingress-kubernetes-ioconnection-proxy-header">`nginx.ingress.kubernetes.io/connection-proxy-header`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-access-log" href="#opt-nginx-ingress-kubernetes-ioenable-access-log" title="#opt-nginx-ingress-kubernetes-ioenable-access-log">`nginx.ingress.kubernetes.io/enable-access-log`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-opentracing" href="#opt-nginx-ingress-kubernetes-ioenable-opentracing" title="#opt-nginx-ingress-kubernetes-ioenable-opentracing">`nginx.ingress.kubernetes.io/enable-opentracing`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span" href="#opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span" title="#opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span">`nginx.ingress.kubernetes.io/opentracing-trust-incoming-span`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-opentelemetry" href="#opt-nginx-ingress-kubernetes-ioenable-opentelemetry" title="#opt-nginx-ingress-kubernetes-ioenable-opentelemetry">`nginx.ingress.kubernetes.io/enable-opentelemetry`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span" href="#opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span" title="#opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span">`nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-modsecurity" href="#opt-nginx-ingress-kubernetes-ioenable-modsecurity" title="#opt-nginx-ingress-kubernetes-ioenable-modsecurity">`nginx.ingress.kubernetes.io/enable-modsecurity`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules" href="#opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules" title="#opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules">`nginx.ingress.kubernetes.io/enable-owasp-core-rules`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id" href="#opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id" title="#opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id">`nginx.ingress.kubernetes.io/modsecurity-transaction-id`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iomodsecurity-snippet" href="#opt-nginx-ingress-kubernetes-iomodsecurity-snippet" title="#opt-nginx-ingress-kubernetes-iomodsecurity-snippet">`nginx.ingress.kubernetes.io/modsecurity-snippet`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iomirror-request-body" href="#opt-nginx-ingress-kubernetes-iomirror-request-body" title="#opt-nginx-ingress-kubernetes-iomirror-request-body">`nginx.ingress.kubernetes.io/mirror-request-body`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iomirror-target" href="#opt-nginx-ingress-kubernetes-iomirror-target" title="#opt-nginx-ingress-kubernetes-iomirror-target">`nginx.ingress.kubernetes.io/mirror-target`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iomirror-host" href="#opt-nginx-ingress-kubernetes-iomirror-host" title="#opt-nginx-ingress-kubernetes-iomirror-host">`nginx.ingress.kubernetes.io/mirror-host`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iox-forwarded-prefix" href="#opt-nginx-ingress-kubernetes-iox-forwarded-prefix" title="#opt-nginx-ingress-kubernetes-iox-forwarded-prefix">`nginx.ingress.kubernetes.io/x-forwarded-prefix`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioupstream-hash-by" href="#opt-nginx-ingress-kubernetes-ioupstream-hash-by" title="#opt-nginx-ingress-kubernetes-ioupstream-hash-by">`nginx.ingress.kubernetes.io/upstream-hash-by`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioupstream-vhost" href="#opt-nginx-ingress-kubernetes-ioupstream-vhost" title="#opt-nginx-ingress-kubernetes-ioupstream-vhost">`nginx.ingress.kubernetes.io/upstream-vhost`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iodenylist-source-range" href="#opt-nginx-ingress-kubernetes-iodenylist-source-range" title="#opt-nginx-ingress-kubernetes-iodenylist-source-range">`nginx.ingress.kubernetes.io/denylist-source-range`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iowhitelist-source-range" href="#opt-nginx-ingress-kubernetes-iowhitelist-source-range" title="#opt-nginx-ingress-kubernetes-iowhitelist-source-range">`nginx.ingress.kubernetes.io/whitelist-source-range`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffering" href="#opt-nginx-ingress-kubernetes-ioproxy-buffering" title="#opt-nginx-ingress-kubernetes-ioproxy-buffering">`nginx.ingress.kubernetes.io/proxy-buffering`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffers-number" href="#opt-nginx-ingress-kubernetes-ioproxy-buffers-number" title="#opt-nginx-ingress-kubernetes-ioproxy-buffers-number">`nginx.ingress.kubernetes.io/proxy-buffers-number`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffer-size" href="#opt-nginx-ingress-kubernetes-ioproxy-buffer-size" title="#opt-nginx-ingress-kubernetes-ioproxy-buffer-size">`nginx.ingress.kubernetes.io/proxy-buffer-size`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size" href="#opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size" title="#opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size">`nginx.ingress.kubernetes.io/proxy-max-temp-file-size`</a> | Not supported yet.                                    |
-| <a id="opt-nginx-ingress-kubernetes-iostream-snippet" href="#opt-nginx-ingress-kubernetes-iostream-snippet" title="#opt-nginx-ingress-kubernetes-iostream-snippet">`nginx.ingress.kubernetes.io/stream-snippet`</a> | Not supported yet.                                    |
+| <a id="opt-nginx-ingress-kubernetes-ioapp-root" href="#opt-nginx-ingress-kubernetes-ioapp-root" title="#opt-nginx-ingress-kubernetes-ioapp-root">`nginx.ingress.kubernetes.io/app-root`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior" href="#opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior" title="#opt-nginx-ingress-kubernetes-ioaffinity-canary-behavior">`nginx.ingress.kubernetes.io/affinity-canary-behavior`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-signin" href="#opt-nginx-ingress-kubernetes-ioauth-signin" title="#opt-nginx-ingress-kubernetes-ioauth-signin">`nginx.ingress.kubernetes.io/auth-signin`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-secret" href="#opt-nginx-ingress-kubernetes-ioauth-tls-secret" title="#opt-nginx-ingress-kubernetes-ioauth-tls-secret">`nginx.ingress.kubernetes.io/auth-tls-secret`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth" href="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth" title="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-depth">`nginx.ingress.kubernetes.io/auth-tls-verify-depth`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-verify-client" href="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-client" title="#opt-nginx-ingress-kubernetes-ioauth-tls-verify-client">`nginx.ingress.kubernetes.io/auth-tls-verify-client`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-error-page" href="#opt-nginx-ingress-kubernetes-ioauth-tls-error-page" title="#opt-nginx-ingress-kubernetes-ioauth-tls-error-page">`nginx.ingress.kubernetes.io/auth-tls-error-page`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream" href="#opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream" title="#opt-nginx-ingress-kubernetes-ioauth-tls-pass-certificate-to-upstream">`nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-tls-match-cn" href="#opt-nginx-ingress-kubernetes-ioauth-tls-match-cn" title="#opt-nginx-ingress-kubernetes-ioauth-tls-match-cn">`nginx.ingress.kubernetes.io/auth-tls-match-cn`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-cache-key" href="#opt-nginx-ingress-kubernetes-ioauth-cache-key" title="#opt-nginx-ingress-kubernetes-ioauth-cache-key">`nginx.ingress.kubernetes.io/auth-cache-key`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-cache-duration" href="#opt-nginx-ingress-kubernetes-ioauth-cache-duration" title="#opt-nginx-ingress-kubernetes-ioauth-cache-duration">`nginx.ingress.kubernetes.io/auth-cache-duration`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive">`nginx.ingress.kubernetes.io/auth-keepalive`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-share-vars">`nginx.ingress.kubernetes.io/auth-keepalive-share-vars`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-requests" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-requests" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-requests">`nginx.ingress.kubernetes.io/auth-keepalive-requests`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout" href="#opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout" title="#opt-nginx-ingress-kubernetes-ioauth-keepalive-timeout">`nginx.ingress.kubernetes.io/auth-keepalive-timeout`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers" href="#opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers" title="#opt-nginx-ingress-kubernetes-ioauth-proxy-set-headers">`nginx.ingress.kubernetes.io/auth-proxy-set-headers`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioauth-snippet" href="#opt-nginx-ingress-kubernetes-ioauth-snippet" title="#opt-nginx-ingress-kubernetes-ioauth-snippet">`nginx.ingress.kubernetes.io/auth-snippet`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-global-auth" href="#opt-nginx-ingress-kubernetes-ioenable-global-auth" title="#opt-nginx-ingress-kubernetes-ioenable-global-auth">`nginx.ingress.kubernetes.io/enable-global-auth`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary" href="#opt-nginx-ingress-kubernetes-iocanary" title="#opt-nginx-ingress-kubernetes-iocanary">`nginx.ingress.kubernetes.io/canary`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header" href="#opt-nginx-ingress-kubernetes-iocanary-by-header" title="#opt-nginx-ingress-kubernetes-iocanary-by-header">`nginx.ingress.kubernetes.io/canary-by-header`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header-value" href="#opt-nginx-ingress-kubernetes-iocanary-by-header-value" title="#opt-nginx-ingress-kubernetes-iocanary-by-header-value">`nginx.ingress.kubernetes.io/canary-by-header-value`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-by-header-pattern" href="#opt-nginx-ingress-kubernetes-iocanary-by-header-pattern" title="#opt-nginx-ingress-kubernetes-iocanary-by-header-pattern">`nginx.ingress.kubernetes.io/canary-by-header-pattern`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-by-cookie" href="#opt-nginx-ingress-kubernetes-iocanary-by-cookie" title="#opt-nginx-ingress-kubernetes-iocanary-by-cookie">`nginx.ingress.kubernetes.io/canary-by-cookie`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-weight" href="#opt-nginx-ingress-kubernetes-iocanary-weight" title="#opt-nginx-ingress-kubernetes-iocanary-weight">`nginx.ingress.kubernetes.io/canary-weight`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocanary-weight-total" href="#opt-nginx-ingress-kubernetes-iocanary-weight-total" title="#opt-nginx-ingress-kubernetes-iocanary-weight-total">`nginx.ingress.kubernetes.io/canary-weight-total`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioclient-body-buffer-size" href="#opt-nginx-ingress-kubernetes-ioclient-body-buffer-size" title="#opt-nginx-ingress-kubernetes-ioclient-body-buffer-size">`nginx.ingress.kubernetes.io/client-body-buffer-size`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioconfiguration-snippet" href="#opt-nginx-ingress-kubernetes-ioconfiguration-snippet" title="#opt-nginx-ingress-kubernetes-ioconfiguration-snippet">`nginx.ingress.kubernetes.io/configuration-snippet`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iocustom-http-errors" href="#opt-nginx-ingress-kubernetes-iocustom-http-errors" title="#opt-nginx-ingress-kubernetes-iocustom-http-errors">`nginx.ingress.kubernetes.io/custom-http-errors`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors" href="#opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors" title="#opt-nginx-ingress-kubernetes-iodisable-proxy-intercept-errors">`nginx.ingress.kubernetes.io/disable-proxy-intercept-errors`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iodefault-backend" href="#opt-nginx-ingress-kubernetes-iodefault-backend" title="#opt-nginx-ingress-kubernetes-iodefault-backend">`nginx.ingress.kubernetes.io/default-backend`</a> | Use `defaultBackend` in Ingress spec. |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-rate-after" href="#opt-nginx-ingress-kubernetes-iolimit-rate-after" title="#opt-nginx-ingress-kubernetes-iolimit-rate-after">`nginx.ingress.kubernetes.io/limit-rate-after`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-rate" href="#opt-nginx-ingress-kubernetes-iolimit-rate" title="#opt-nginx-ingress-kubernetes-iolimit-rate">`nginx.ingress.kubernetes.io/limit-rate`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-whitelist" href="#opt-nginx-ingress-kubernetes-iolimit-whitelist" title="#opt-nginx-ingress-kubernetes-iolimit-whitelist">`nginx.ingress.kubernetes.io/limit-whitelist`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-rps" href="#opt-nginx-ingress-kubernetes-iolimit-rps" title="#opt-nginx-ingress-kubernetes-iolimit-rps">`nginx.ingress.kubernetes.io/limit-rps`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-rpm" href="#opt-nginx-ingress-kubernetes-iolimit-rpm" title="#opt-nginx-ingress-kubernetes-iolimit-rpm">`nginx.ingress.kubernetes.io/limit-rpm`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-burst-multiplier" href="#opt-nginx-ingress-kubernetes-iolimit-burst-multiplier" title="#opt-nginx-ingress-kubernetes-iolimit-burst-multiplier">`nginx.ingress.kubernetes.io/limit-burst-multiplier`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iolimit-connections" href="#opt-nginx-ingress-kubernetes-iolimit-connections" title="#opt-nginx-ingress-kubernetes-iolimit-connections">`nginx.ingress.kubernetes.io/limit-connections`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit">`nginx.ingress.kubernetes.io/global-rate-limit`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-window">`nginx.ingress.kubernetes.io/global-rate-limit-window`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-key">`nginx.ingress.kubernetes.io/global-rate-limit-key`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs" href="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs" title="#opt-nginx-ingress-kubernetes-ioglobal-rate-limit-ignored-cidrs">`nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iopermanent-redirect" href="#opt-nginx-ingress-kubernetes-iopermanent-redirect" title="#opt-nginx-ingress-kubernetes-iopermanent-redirect">`nginx.ingress.kubernetes.io/permanent-redirect`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iopermanent-redirect-code" href="#opt-nginx-ingress-kubernetes-iopermanent-redirect-code" title="#opt-nginx-ingress-kubernetes-iopermanent-redirect-code">`nginx.ingress.kubernetes.io/permanent-redirect-code`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iotemporal-redirect" href="#opt-nginx-ingress-kubernetes-iotemporal-redirect" title="#opt-nginx-ingress-kubernetes-iotemporal-redirect">`nginx.ingress.kubernetes.io/temporal-redirect`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iopreserve-trailing-slash" href="#opt-nginx-ingress-kubernetes-iopreserve-trailing-slash" title="#opt-nginx-ingress-kubernetes-iopreserve-trailing-slash">`nginx.ingress.kubernetes.io/preserve-trailing-slash`</a> | Traefik preserves trailing slash by default.         |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-cookie-domain" href="#opt-nginx-ingress-kubernetes-ioproxy-cookie-domain" title="#opt-nginx-ingress-kubernetes-ioproxy-cookie-domain">`nginx.ingress.kubernetes.io/proxy-cookie-domain`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-cookie-path" href="#opt-nginx-ingress-kubernetes-ioproxy-cookie-path" title="#opt-nginx-ingress-kubernetes-ioproxy-cookie-path">`nginx.ingress.kubernetes.io/proxy-cookie-path`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-connect-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-connect-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-connect-timeout">`nginx.ingress.kubernetes.io/proxy-connect-timeout`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-send-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-send-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-send-timeout">`nginx.ingress.kubernetes.io/proxy-send-timeout`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-read-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-read-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-read-timeout">`nginx.ingress.kubernetes.io/proxy-read-timeout`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream">`nginx.ingress.kubernetes.io/proxy-next-upstream`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-timeout">`nginx.ingress.kubernetes.io/proxy-next-upstream-timeout`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries" href="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries" title="#opt-nginx-ingress-kubernetes-ioproxy-next-upstream-tries">`nginx.ingress.kubernetes.io/proxy-next-upstream-tries`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-request-buffering" href="#opt-nginx-ingress-kubernetes-ioproxy-request-buffering" title="#opt-nginx-ingress-kubernetes-ioproxy-request-buffering">`nginx.ingress.kubernetes.io/proxy-request-buffering`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-redirect-from" href="#opt-nginx-ingress-kubernetes-ioproxy-redirect-from" title="#opt-nginx-ingress-kubernetes-ioproxy-redirect-from">`nginx.ingress.kubernetes.io/proxy-redirect-from`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-redirect-to" href="#opt-nginx-ingress-kubernetes-ioproxy-redirect-to" title="#opt-nginx-ingress-kubernetes-ioproxy-redirect-to">`nginx.ingress.kubernetes.io/proxy-redirect-to`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-http-version" href="#opt-nginx-ingress-kubernetes-ioproxy-http-version" title="#opt-nginx-ingress-kubernetes-ioproxy-http-version">`nginx.ingress.kubernetes.io/proxy-http-version`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-ciphers">`nginx.ingress.kubernetes.io/proxy-ssl-ciphers`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-verify-depth">`nginx.ingress.kubernetes.io/proxy-ssl-verify-depth`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols" href="#opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols" title="#opt-nginx-ingress-kubernetes-ioproxy-ssl-protocols">`nginx.ingress.kubernetes.io/proxy-ssl-protocols`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-rewrite-log" href="#opt-nginx-ingress-kubernetes-ioenable-rewrite-log" title="#opt-nginx-ingress-kubernetes-ioenable-rewrite-log">`nginx.ingress.kubernetes.io/enable-rewrite-log`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iorewrite-target" href="#opt-nginx-ingress-kubernetes-iorewrite-target" title="#opt-nginx-ingress-kubernetes-iorewrite-target">`nginx.ingress.kubernetes.io/rewrite-target`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iosatisfy" href="#opt-nginx-ingress-kubernetes-iosatisfy" title="#opt-nginx-ingress-kubernetes-iosatisfy">`nginx.ingress.kubernetes.io/satisfy`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioserver-alias" href="#opt-nginx-ingress-kubernetes-ioserver-alias" title="#opt-nginx-ingress-kubernetes-ioserver-alias">`nginx.ingress.kubernetes.io/server-alias`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioserver-snippet" href="#opt-nginx-ingress-kubernetes-ioserver-snippet" title="#opt-nginx-ingress-kubernetes-ioserver-snippet">`nginx.ingress.kubernetes.io/server-snippet`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none" href="#opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none" title="#opt-nginx-ingress-kubernetes-iosession-cookie-conditional-samesite-none">`nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-expires" href="#opt-nginx-ingress-kubernetes-iosession-cookie-expires" title="#opt-nginx-ingress-kubernetes-iosession-cookie-expires">`nginx.ingress.kubernetes.io/session-cookie-expires`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure" href="#opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure" title="#opt-nginx-ingress-kubernetes-iosession-cookie-change-on-failure">`nginx.ingress.kubernetes.io/session-cookie-change-on-failure`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iossl-ciphers" href="#opt-nginx-ingress-kubernetes-iossl-ciphers" title="#opt-nginx-ingress-kubernetes-iossl-ciphers">`nginx.ingress.kubernetes.io/ssl-ciphers`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers" href="#opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers" title="#opt-nginx-ingress-kubernetes-iossl-prefer-server-ciphers">`nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioconnection-proxy-header" href="#opt-nginx-ingress-kubernetes-ioconnection-proxy-header" title="#opt-nginx-ingress-kubernetes-ioconnection-proxy-header">`nginx.ingress.kubernetes.io/connection-proxy-header`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-access-log" href="#opt-nginx-ingress-kubernetes-ioenable-access-log" title="#opt-nginx-ingress-kubernetes-ioenable-access-log">`nginx.ingress.kubernetes.io/enable-access-log`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-opentracing" href="#opt-nginx-ingress-kubernetes-ioenable-opentracing" title="#opt-nginx-ingress-kubernetes-ioenable-opentracing">`nginx.ingress.kubernetes.io/enable-opentracing`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span" href="#opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span" title="#opt-nginx-ingress-kubernetes-ioopentracing-trust-incoming-span">`nginx.ingress.kubernetes.io/opentracing-trust-incoming-span`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-opentelemetry" href="#opt-nginx-ingress-kubernetes-ioenable-opentelemetry" title="#opt-nginx-ingress-kubernetes-ioenable-opentelemetry">`nginx.ingress.kubernetes.io/enable-opentelemetry`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span" href="#opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span" title="#opt-nginx-ingress-kubernetes-ioopentelemetry-trust-incoming-span">`nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-modsecurity" href="#opt-nginx-ingress-kubernetes-ioenable-modsecurity" title="#opt-nginx-ingress-kubernetes-ioenable-modsecurity">`nginx.ingress.kubernetes.io/enable-modsecurity`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules" href="#opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules" title="#opt-nginx-ingress-kubernetes-ioenable-owasp-core-rules">`nginx.ingress.kubernetes.io/enable-owasp-core-rules`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id" href="#opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id" title="#opt-nginx-ingress-kubernetes-iomodsecurity-transaction-id">`nginx.ingress.kubernetes.io/modsecurity-transaction-id`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iomodsecurity-snippet" href="#opt-nginx-ingress-kubernetes-iomodsecurity-snippet" title="#opt-nginx-ingress-kubernetes-iomodsecurity-snippet">`nginx.ingress.kubernetes.io/modsecurity-snippet`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iomirror-request-body" href="#opt-nginx-ingress-kubernetes-iomirror-request-body" title="#opt-nginx-ingress-kubernetes-iomirror-request-body">`nginx.ingress.kubernetes.io/mirror-request-body`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iomirror-target" href="#opt-nginx-ingress-kubernetes-iomirror-target" title="#opt-nginx-ingress-kubernetes-iomirror-target">`nginx.ingress.kubernetes.io/mirror-target`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iomirror-host" href="#opt-nginx-ingress-kubernetes-iomirror-host" title="#opt-nginx-ingress-kubernetes-iomirror-host">`nginx.ingress.kubernetes.io/mirror-host`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iox-forwarded-prefix" href="#opt-nginx-ingress-kubernetes-iox-forwarded-prefix" title="#opt-nginx-ingress-kubernetes-iox-forwarded-prefix">`nginx.ingress.kubernetes.io/x-forwarded-prefix`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioupstream-hash-by" href="#opt-nginx-ingress-kubernetes-ioupstream-hash-by" title="#opt-nginx-ingress-kubernetes-ioupstream-hash-by">`nginx.ingress.kubernetes.io/upstream-hash-by`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioupstream-vhost" href="#opt-nginx-ingress-kubernetes-ioupstream-vhost" title="#opt-nginx-ingress-kubernetes-ioupstream-vhost">`nginx.ingress.kubernetes.io/upstream-vhost`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iodenylist-source-range" href="#opt-nginx-ingress-kubernetes-iodenylist-source-range" title="#opt-nginx-ingress-kubernetes-iodenylist-source-range">`nginx.ingress.kubernetes.io/denylist-source-range`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iowhitelist-source-range" href="#opt-nginx-ingress-kubernetes-iowhitelist-source-range" title="#opt-nginx-ingress-kubernetes-iowhitelist-source-range">`nginx.ingress.kubernetes.io/whitelist-source-range`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffering" href="#opt-nginx-ingress-kubernetes-ioproxy-buffering" title="#opt-nginx-ingress-kubernetes-ioproxy-buffering">`nginx.ingress.kubernetes.io/proxy-buffering`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffers-number" href="#opt-nginx-ingress-kubernetes-ioproxy-buffers-number" title="#opt-nginx-ingress-kubernetes-ioproxy-buffers-number">`nginx.ingress.kubernetes.io/proxy-buffers-number`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-buffer-size" href="#opt-nginx-ingress-kubernetes-ioproxy-buffer-size" title="#opt-nginx-ingress-kubernetes-ioproxy-buffer-size">`nginx.ingress.kubernetes.io/proxy-buffer-size`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size" href="#opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size" title="#opt-nginx-ingress-kubernetes-ioproxy-max-temp-file-size">`nginx.ingress.kubernetes.io/proxy-max-temp-file-size`</a> |                                                      |
+| <a id="opt-nginx-ingress-kubernetes-iostream-snippet" href="#opt-nginx-ingress-kubernetes-iostream-snippet" title="#opt-nginx-ingress-kubernetes-iostream-snippet">`nginx.ingress.kubernetes.io/stream-snippet`</a> |                                                      |
+
+### Global Configuration
+
+Traefik does not expose all global configuration options to control default behaviors for Ingresses in the same way NGINX does.
+
+Some behaviors that are globally configurable in NGINX (such as default SSL redirect, rate limiting, or affinity) are currently not supported and cannot be overridden per-Ingress as in NGINX. These limitations are noted in the annotation tables below where applicable.
diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress.md b/docs/content/reference/routing-configuration/kubernetes/ingress.md
index a9b0aab71..f614b80b9 100644
--- a/docs/content/reference/routing-configuration/kubernetes/ingress.md
+++ b/docs/content/reference/routing-configuration/kubernetes/ingress.md
@@ -402,7 +402,7 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v3.5
+              image: traefik:v3.6
               args:
                 - --entryPoints.websecure.address=:443
                 - --entryPoints.websecure.http.tls
@@ -619,4 +619,4 @@ This will allow users to create a "default router" that will match all unmatched
 
     To do this, use the `traefik.ingress.kubernetes.io/router.priority` annotation (as seen in [Annotations on Ingress](#on-ingress)) on your ingresses accordingly.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/kubernetes/knative.md b/docs/content/reference/routing-configuration/kubernetes/knative.md
new file mode 100644
index 000000000..c4ac719a0
--- /dev/null
+++ b/docs/content/reference/routing-configuration/kubernetes/knative.md
@@ -0,0 +1,96 @@
+---
+title: "Traefik Knative Documentation"
+description: "The Knative provider can be used for routing and load balancing in Traefik Proxy. View examples in the technical documentation."
+---
+
+# Traefik & Knative
+
+When using the Knative provider, Traefik leverages Knative's Custom Resource Definitions (CRDs) to obtain its routing configuration. 
+For detailed information on Knative concepts and resources, refer to the official [documentation](https://knative.dev/docs/).
+
+The Knative provider supports version [v1.19.0](https://github.com/knative/serving/releases/tag/knative-v1.19.0) of the specification.
+
+## Deploying a Knative Service
+
+A `Service` is a core resource in the Knative specification that defines the entry point for traffic into a Knative application. 
+It is linked to a `Ingress`, which specifies the Knative networking controller responsible for managing and handling the traffic, 
+ensuring that it is directed to the appropriate Knative backend services.
+
+The following `Service` manifest configures the running Traefik controller to handle the incoming traffic.
+
+```yaml
+---
+apiVersion: serving.knative.dev/v1
+kind: Service
+metadata:
+  name: helloworld-go
+  namespace: default
+spec:
+  template:
+    spec:
+      containers:
+        - image: gcr.io/knative-samples/helloworld-go
+          env:
+            - name: TARGET
+              value: "Go Sample v1"
+```
+
+Once everything is deployed, sending a `GET` request to the HTTP endpoint should return the following response:
+
+```shell
+$ curl http://helloworld-go.default.example.com
+
+Hello Go Sample v1!
+```
+
+!!! Note
+
+    The `example.com` domain is the public domain configured when deploying the Traefik controller.
+    Check out [the install configuration](../../install-configuration/providers/kubernetes/knative.md) for more details.
+
+### Tag based routing
+
+To add tag-based routing with percentage in Knative, you can define the `traffic` section in your `Service` manifest to include different revisions with specific tags and percentages. 
+Here is an example:
+
+```yaml
+apiVersion: serving.knative.dev/v1
+kind: Service
+metadata:
+  name: helloworld-go
+  namespace: default
+spec:
+  template:
+    spec:
+      containers:
+        - image: gcr.io/knative-samples/helloworld-go
+          env:
+            - name: TARGET
+              value: "Go Sample v2"
+  traffic:
+    - tag: v1
+      revisionName: helloworld-go-00001
+      percent: 50
+    - tag: v2
+      revisionName: helloworld-go-00002
+      percent: 50
+```
+
+In this example:
+- The `traffic` section specifies two revisions (`helloworld-go-00001` and `helloworld-go-00002`) with tags `v1` and `v2`, each receiving 50% of the traffic.
+- The `tag` field allows you to route traffic to specific revisions using the tag.
+
+You can access the tagged revisions using these URLs:
+
+- `http://v1-helloworld-go.default.example.com`
+- `http://v2-helloworld-go.default.example.com`
+
+Use the default URL to access percentage-based routing:
+
+- `http://helloworld-go.default.example.com`
+
+### HTTP/HTTPS
+
+Check out the Knative documentation for [HTTP/HTTPS configuration](https://knative.dev/docs/serving/encryption/external-domain-tls/#configure-external-domain-encryption).
+
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/other-providers/docker.md b/docs/content/reference/routing-configuration/other-providers/docker.md
index a6773b190..4cc633bd1 100644
--- a/docs/content/reference/routing-configuration/other-providers/docker.md
+++ b/docs/content/reference/routing-configuration/other-providers/docker.md
@@ -285,6 +285,15 @@ you'd add the label `traefik.http.services.<name-of-your-choice>.loadbalancer.pa
      "traefik.http.services.myservice.loadbalancer.server.scheme=http"
     ```
 
+??? info "`traefik.http.services.<service_name>.loadbalancer.server.url`"
+
+    Defines the service URL.
+    This option cannot be used in combination with `port` or `scheme` definition.
+
+    ```yaml
+    traefik.http.services.<service_name>.loadbalancer.server.url=http://foobar:8080
+    ```
+
 ??? info "`traefik.http.services.<service_name>.loadbalancer.serverstransport`"
 
     Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
@@ -688,6 +697,27 @@ You can tell Traefik to consider (or not) the container by setting `traefik.enab
 
 This option overrides the value of `exposedByDefault`.
 
+#### `traefik.docker.allownonrunning`
+
+```yaml
+- "traefik.docker.allownonrunning=true"
+```
+
+By default, Traefik only considers containers in "running" state.
+This option controls whether containers that are not in "running" state (e.g., stopped, paused, exited) should still be visible to Traefik for service discovery.
+
+When this label is set to true, Traefik will:
+
+- Keep the router and service configuration even when the container is not running
+- Create services with empty backend server lists
+- Return 503 Service Unavailable for requests to stopped containers (instead of 404 Not Found)
+- Execute the full middleware chain, allowing middlewares to intercept requests
+
+!!! warning "Configuration Collision"
+    
+    As the `traefik.docker.allownonrunning` enables the discovery of all containers exposing this option disregarding their state,
+    if multiple stopped containers expose the same router but their configurations diverge, then the routers will be dropped.
+
 #### `traefik.docker.network`
 
 ```yaml
@@ -700,4 +730,5 @@ If a container is linked to several networks, be sure to set the proper network
 otherwise it will randomly pick one (depending on how docker is returning them).
 
 !!! warning
+
     When deploying a stack from a compose file `stack`, the networks defined are prefixed with `stack`.
diff --git a/docs/content/reference/routing-configuration/other-providers/file.toml b/docs/content/reference/routing-configuration/other-providers/file.toml
index 985f96e21..9e00b358f 100644
--- a/docs/content/reference/routing-configuration/other-providers/file.toml
+++ b/docs/content/reference/routing-configuration/other-providers/file.toml
@@ -7,6 +7,7 @@
       middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
+      parentRefs = ["foobar", "foobar"]
       ruleSyntax = "foobar"
       priority = 42
       [http.routers.Router0.tls]
@@ -30,6 +31,7 @@
       middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
+      parentRefs = ["foobar", "foobar"]
       ruleSyntax = "foobar"
       priority = 42
       [http.routers.Router1.tls]
@@ -55,12 +57,23 @@
         fallback = "foobar"
         [http.services.Service01.failover.healthCheck]
     [http.services.Service02]
-      [http.services.Service02.loadBalancer]
+      [http.services.Service02.highestRandomWeight]
+
+        [[http.services.Service02.highestRandomWeight.services]]
+          name = "foobar"
+          weight = 42
+
+        [[http.services.Service02.highestRandomWeight.services]]
+          name = "foobar"
+          weight = 42
+        [http.services.Service02.highestRandomWeight.healthCheck]
+    [http.services.Service03]
+      [http.services.Service03.loadBalancer]
         strategy = "foobar"
         passHostHeader = true
         serversTransport = "foobar"
-        [http.services.Service02.loadBalancer.sticky]
-          [http.services.Service02.loadBalancer.sticky.cookie]
+        [http.services.Service03.loadBalancer.sticky]
+          [http.services.Service03.loadBalancer.sticky.cookie]
             name = "foobar"
             secure = true
             httpOnly = true
@@ -69,16 +82,16 @@
             path = "foobar"
             domain = "foobar"
 
-        [[http.services.Service02.loadBalancer.servers]]
+        [[http.services.Service03.loadBalancer.servers]]
           url = "foobar"
           weight = 42
           preservePath = true
 
-        [[http.services.Service02.loadBalancer.servers]]
+        [[http.services.Service03.loadBalancer.servers]]
           url = "foobar"
           weight = 42
           preservePath = true
-        [http.services.Service02.loadBalancer.healthCheck]
+        [http.services.Service03.loadBalancer.healthCheck]
           scheme = "foobar"
           mode = "foobar"
           path = "foobar"
@@ -90,37 +103,40 @@
           timeout = "42s"
           hostname = "foobar"
           followRedirects = true
-          [http.services.Service02.loadBalancer.healthCheck.headers]
+          [http.services.Service03.loadBalancer.healthCheck.headers]
             name0 = "foobar"
             name1 = "foobar"
-        [http.services.Service02.loadBalancer.responseForwarding]
+        [http.services.Service03.loadBalancer.passiveHealthCheck]
+          failureWindow = "42s"
+          maxFailedAttempts = 42
+        [http.services.Service03.loadBalancer.responseForwarding]
           flushInterval = "42s"
-    [http.services.Service03]
-      [http.services.Service03.mirroring]
+    [http.services.Service04]
+      [http.services.Service04.mirroring]
         service = "foobar"
         mirrorBody = true
         maxBodySize = 42
 
-        [[http.services.Service03.mirroring.mirrors]]
+        [[http.services.Service04.mirroring.mirrors]]
           name = "foobar"
           percent = 42
 
-        [[http.services.Service03.mirroring.mirrors]]
+        [[http.services.Service04.mirroring.mirrors]]
           name = "foobar"
           percent = 42
-        [http.services.Service03.mirroring.healthCheck]
-    [http.services.Service04]
-      [http.services.Service04.weighted]
+        [http.services.Service04.mirroring.healthCheck]
+    [http.services.Service05]
+      [http.services.Service05.weighted]
 
-        [[http.services.Service04.weighted.services]]
+        [[http.services.Service05.weighted.services]]
           name = "foobar"
           weight = 42
 
-        [[http.services.Service04.weighted.services]]
+        [[http.services.Service05.weighted.services]]
           name = "foobar"
           weight = 42
-        [http.services.Service04.weighted.sticky]
-          [http.services.Service04.weighted.sticky.cookie]
+        [http.services.Service05.weighted.sticky]
+          [http.services.Service05.weighted.sticky.cookie]
             name = "foobar"
             secure = true
             httpOnly = true
@@ -128,7 +144,7 @@
             maxAge = 42
             path = "foobar"
             domain = "foobar"
-        [http.services.Service04.weighted.healthCheck]
+        [http.services.Service05.weighted.healthCheck]
   [http.middlewares]
     [http.middlewares.Middleware01]
       [http.middlewares.Middleware01.addPrefix]
@@ -464,6 +480,13 @@
           tls = true
         [tcp.services.TCPService01.loadBalancer.proxyProtocol]
           version = 42
+        [tcp.services.TCPService01.loadBalancer.healthCheck]
+          port = 42
+          send = "foobar"
+          expect = "foobar"
+          interval = "42s"
+          unhealthyInterval = "42s"
+          timeout = "42s"
     [tcp.services.TCPService02]
       [tcp.services.TCPService02.weighted]
 
@@ -474,6 +497,7 @@
         [[tcp.services.TCPService02.weighted.services]]
           name = "foobar"
           weight = 42
+        [tcp.services.TCPService02.weighted.healthCheck]
   [tcp.middlewares]
     [tcp.middlewares.TCPMiddleware01]
       [tcp.middlewares.TCPMiddleware01.ipAllowList]
diff --git a/docs/content/reference/routing-configuration/other-providers/file.yaml b/docs/content/reference/routing-configuration/other-providers/file.yaml
index 29822fddb..fdb8f2c1e 100644
--- a/docs/content/reference/routing-configuration/other-providers/file.yaml
+++ b/docs/content/reference/routing-configuration/other-providers/file.yaml
@@ -11,6 +11,9 @@ http:
         - foobar
       service: foobar
       rule: foobar
+      parentRefs:
+        - foobar
+        - foobar
       ruleSyntax: foobar
       priority: 42
       tls:
@@ -39,6 +42,9 @@ http:
         - foobar
       service: foobar
       rule: foobar
+      parentRefs:
+        - foobar
+        - foobar
       ruleSyntax: foobar
       priority: 42
       tls:
@@ -65,6 +71,14 @@ http:
         fallback: foobar
         healthCheck: {}
     Service02:
+      highestRandomWeight:
+        services:
+          - name: foobar
+            weight: 42
+          - name: foobar
+            weight: 42
+        healthCheck: {}
+    Service03:
       loadBalancer:
         sticky:
           cookie:
@@ -98,11 +112,14 @@ http:
           headers:
             name0: foobar
             name1: foobar
+        passiveHealthCheck:
+          failureWindow: 42s
+          maxFailedAttempts: 42
         passHostHeader: true
         responseForwarding:
           flushInterval: 42s
         serversTransport: foobar
-    Service03:
+    Service04:
       mirroring:
         service: foobar
         mirrorBody: true
@@ -113,7 +130,7 @@ http:
           - name: foobar
             percent: 42
         healthCheck: {}
-    Service04:
+    Service05:
       weighted:
         services:
           - name: foobar
@@ -527,6 +544,13 @@ tcp:
         proxyProtocol:
           version: 42
         terminationDelay: 42
+        healthCheck:
+          port: 42
+          send: foobar
+          expect: foobar
+          interval: 42s
+          unhealthyInterval: 42s
+          timeout: 42s
     TCPService02:
       weighted:
         services:
@@ -534,6 +558,7 @@ tcp:
             weight: 42
           - name: foobar
             weight: 42
+        healthCheck: {}
   middlewares:
     TCPMiddleware01:
       ipAllowList:
diff --git a/docs/content/reference/routing-configuration/other-providers/swarm.md b/docs/content/reference/routing-configuration/other-providers/swarm.md
index 427484d8d..2885b1e48 100644
--- a/docs/content/reference/routing-configuration/other-providers/swarm.md
+++ b/docs/content/reference/routing-configuration/other-providers/swarm.md
@@ -301,6 +301,15 @@ you'd add the label `traefik.http.services.<name-of-your-choice>.loadbalancer.pa
     - "traefik.http.services.myservice.loadbalancer.server.scheme=http"
     ```
 
+??? info "`traefik.http.services.<service_name>.loadbalancer.server.url`"
+
+    Defines the service URL.
+    This option cannot be used in combination with `port` or `scheme` definition.
+
+    ```yaml
+    traefik.http.services.<service_name>.loadbalancer.server.url=http://foobar:8080
+    ```
+
 ??? info "`traefik.http.services.<service_name>.loadbalancer.server.weight`"
 
     Overrides the default weight.
diff --git a/docs/content/reference/routing-configuration/tcp/routing/router.md b/docs/content/reference/routing-configuration/tcp/routing/router.md
index 4761ebf5c..54eeb09d2 100644
--- a/docs/content/reference/routing-configuration/tcp/routing/router.md
+++ b/docs/content/reference/routing-configuration/tcp/routing/router.md
@@ -101,4 +101,4 @@ labels:
 - Router names should be descriptive and follow your naming conventions
 - In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names and rules
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/tcp/service.md b/docs/content/reference/routing-configuration/tcp/service.md
index d85a75102..e719ddf42 100644
--- a/docs/content/reference/routing-configuration/tcp/service.md
+++ b/docs/content/reference/routing-configuration/tcp/service.md
@@ -23,6 +23,12 @@ tcp:
         servers:
         - address: "xx.xx.xx.xx:xx"
         - address: "xx.xx.xx.xx:xx"
+        healthCheck:
+          send: "PING"
+          expect: "PONG"
+          interval: "10s"
+          timeout: "3s"
+        serversTransport: "customTransport@file"
 ```
 
 ```toml tab="Structured (TOML)"
@@ -32,26 +38,79 @@ tcp:
       address = "xx.xx.xx.xx:xx"
     [[tcp.services.my-service.loadBalancer.servers]]
         address = "xx.xx.xx.xx:xx"
+
+    [tcp.services.my-service.loadBalancer.healthCheck]
+      send = "PING"
+      expect = "PONG"
+      interval = "10s"
+      timeout = "3s"
+
+    serversTransport = "customTransport@file"
 ```
 
-## Configuration Options
+```yaml tab="Labels"
+labels:
+  - "traefik.tcp.services.my-service.loadBalancer.servers[0].address=xx.xx.xx.xx:xx"
+  - "traefik.tcp.services.my-service.loadBalancer.servers[1].address=xx.xx.xx.xx:xx"
+  - "traefik.tcp.services.my-service.loadBalancer.healthCheck.send=PING"
+  - "traefik.tcp.services.my-service.loadBalancer.healthCheck.expect=PONG"
+  - "traefik.tcp.services.my-service.loadBalancer.healthCheck.interval=10s"
+  - "traefik.tcp.services.my-service.loadBalancer.healthCheck.timeout=3s"
+  - "traefik.tcp.services.my-service.loadBalancer.serversTransport=customTransport@file"
+```
+
+```json tab="Tags"
+{
+  "Tags": [
+    "traefik.tcp.services.my-service.loadBalancer.servers[0].address=xx.xx.xx.xx:xx",
+    "traefik.tcp.services.my-service.loadBalancer.servers[1].address=xx.xx.xx.xx:xx",
+    "traefik.tcp.services.my-service.loadBalancer.healthCheck.send=PING",
+    "traefik.tcp.services.my-service.loadBalancer.healthCheck.expect=PONG",
+    "traefik.tcp.services.my-service.loadBalancer.healthCheck.interval=10s",
+    "traefik.tcp.services.my-service.loadBalancer.healthCheck.timeout=3s",
+    "traefik.tcp.services.my-service.loadBalancer.serversTransport=customTransport@file"
+  ]
+}
+```
+
+### Configuration Options
 
 | Field | Description                                 | Default |
 |----------|------------------------------------------|--------- |
 | <a id="opt-servers" href="#opt-servers" title="#opt-servers">`servers`</a> |  Servers declare a single instance of your program.  | "" |
 | <a id="opt-servers-address" href="#opt-servers-address" title="#opt-servers-address">`servers.address`</a> |   The address option (IP:Port) point to a specific instance. | "" |
 | <a id="opt-servers-tls" href="#opt-servers-tls" title="#opt-servers-tls">`servers.tls`</a> | The `tls` option determines whether to use TLS when dialing with the backend. | false |
-| <a id="opt-servers-serversTransport" href="#opt-servers-serversTransport" title="#opt-servers-serversTransport">`servers.serversTransport`</a> | `serversTransport` allows to reference a TCP [ServersTransport](./serverstransport.md configuration for the communication between Traefik and your servers. If no serversTransport is specified, the default@internal will be used. |  "" |
+| <a id="opt-serversTransport" href="#opt-serversTransport" title="#opt-serversTransport">`serversTransport`</a> | `serversTransport` allows to reference a TCP [ServersTransport](./serverstransport.md) configuration for the communication between Traefik and your servers. If no serversTransport is specified, the default@internal will be used. |  "" |
+| <a id="opt-healthCheck" href="#opt-healthCheck" title="#opt-healthCheck">`healthCheck`</a> | Configures health check to remove unhealthy servers from the load balancing rotation. See [HealthCheck](#health-check) for details. | | No |
+
+### Health Check
+
+The `healthCheck` option configures health check to remove unhealthy servers from the load balancing rotation.
+Traefik will consider TCP servers healthy as long as the connection to the target server succeeds.
+For advanced health checks, you can configure TCP payload exchange by specifying `send` and `expect` parameters.
+
+To propagate status changes (e.g. all servers of this service are down) upwards, HealthCheck must also be enabled on the parent(s) of this service.
+
+Below are the available options for the health check mechanism:
+
+| Field | Description | Default | Required |
+|-------|-------------|---------|----------|
+| <a id="opt-port" href="#opt-port" title="#opt-port">`port`</a> | Replaces the server address port for the health check endpoint. | | No |
+| <a id="opt-send" href="#opt-send" title="#opt-send">`send`</a> | Defines the payload to send to the server during the health check. | "" | No |
+| <a id="opt-expect" href="#opt-expect" title="#opt-expect">`expect`</a> | Defines the expected response payload from the server. | "" | No |
+| <a id="opt-interval" href="#opt-interval" title="#opt-interval">`interval`</a> | Defines the frequency of the health check calls for healthy targets. | 30s | No |
+| <a id="opt-unhealthyInterval" href="#opt-unhealthyInterval" title="#opt-unhealthyInterval">`unhealthyInterval`</a> | Defines the frequency of the health check calls for unhealthy targets. When not defined, it defaults to the `interval` value. | 30s | No |
+| <a id="opt-timeout" href="#opt-timeout" title="#opt-timeout">`timeout`</a> | Defines the maximum duration Traefik will wait for a health check connection before considering the server unhealthy. | 5s | No |
 
 ## Weighted Round Robin
 
-The Weighted Round Robin (alias `WRR`) load-balancer of services is in charge of balancing the requests between multiple services based on provided weights.
+The Weighted Round Robin (alias `WRR`) load-balancer of services is in charge of balancing the connections between multiple services based on provided weights.
 
 This strategy is only available to load balance between [services](./service.md) and not between servers.
 
 !!! info "Supported Providers"
 
-    This strategy can be defined currently with the [File](../../install-configuration/providers/others/file.md) or [IngressRoute](../../install-configuration/providers/kubernetes/kubernetes-crd.md) providers.
+    This strategy can be defined currently with the [File provider](../../install-configuration/providers/others/file.md).
 
 ```yaml tab="Structured (YAML)"
 tcp:
@@ -95,4 +154,83 @@ tcp:
       [[tcp.services.appv2.loadBalancer.servers]]
         address = "private-ip-server-2:8080/"
 ```
- 
+
+### Health Check
+
+HealthCheck enables automatic self-healthcheck for this service, i.e. whenever one of its children is reported as down, 
+this service becomes aware of it, and takes it into account (i.e. it ignores the down child) when running the load-balancing algorithm.
+In addition, if the parent of this service also has HealthCheck enabled, this service reports to its parent any status change.
+
+!!! note "Behavior"
+
+    If HealthCheck is enabled for a given service and any of its descendants does not have it enabled, the creation of the service will fail.
+
+    HealthCheck on Weighted services can be defined currently only with the [File provider](../../install-configuration/providers/others/file.md).
+
+```yaml tab="Structured (YAML)"
+## Dynamic configuration
+tcp:
+  services:
+    app:
+      weighted:
+        healthCheck: {}
+        services:
+        - name: appv1
+          weight: 3
+        - name: appv2
+          weight: 1
+
+    appv1:
+      loadBalancer:
+        healthCheck:
+          send: "PING"
+          expect: "PONG"
+          interval: 10s
+          timeout: 3s
+        servers:
+        - address: "192.168.1.10:6379"
+
+    appv2:
+      loadBalancer:
+        healthCheck:
+          send: "PING"
+          expect: "PONG"
+          interval: 10s
+          timeout: 3s
+        servers:
+        - address: "192.168.1.11:6379"
+```
+
+```toml tab="Structured (TOML)"
+## Dynamic configuration
+[tcp.services]
+  [tcp.services.app]
+    [tcp.services.app.weighted.healthCheck]
+    [[tcp.services.app.weighted.services]]
+      name = "appv1"
+      weight = 3
+    [[tcp.services.app.weighted.services]]
+      name = "appv2"
+      weight = 1
+
+  [tcp.services.appv1]
+    [tcp.services.appv1.loadBalancer]
+      [tcp.services.appv1.loadBalancer.healthCheck]
+        send = "PING"
+        expect = "PONG"
+        interval = "10s"
+        timeout = "3s"
+      [[tcp.services.appv1.loadBalancer.servers]]
+        address = "192.168.1.10:6379"
+
+  [tcp.services.appv2]
+    [tcp.services.appv2.loadBalancer]
+      [tcp.services.appv2.loadBalancer.healthCheck]
+        send = "PING"
+        expect = "PONG"
+        interval = "10s"
+        timeout = "3s"
+      [[tcp.services.appv2.loadBalancer.servers]]
+        address = "192.168.1.11:6379"
+```
+
diff --git a/docs/content/reference/routing-configuration/tcp/tls.md b/docs/content/reference/routing-configuration/tcp/tls.md
index ccaf54dfb..c4d45c79d 100644
--- a/docs/content/reference/routing-configuration/tcp/tls.md
+++ b/docs/content/reference/routing-configuration/tcp/tls.md
@@ -123,4 +123,4 @@ This provides fine-grained control over certificate generation and takes precede
 
 Every domain must have A/AAAA records pointing to Traefik.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/udp/routing/rules-priority.md b/docs/content/reference/routing-configuration/udp/routing/rules-priority.md
index a43d3653e..54e5f4000 100644
--- a/docs/content/reference/routing-configuration/udp/routing/rules-priority.md
+++ b/docs/content/reference/routing-configuration/udp/routing/rules-priority.md
@@ -109,4 +109,4 @@ labels:
     There must be one (and only one) UDP [service](../service.md) referenced per UDP router.
     Services are the target for the router.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/routing-configuration/udp/service.md b/docs/content/reference/routing-configuration/udp/service.md
index f792d0b2c..671ce6283 100644
--- a/docs/content/reference/routing-configuration/udp/service.md
+++ b/docs/content/reference/routing-configuration/udp/service.md
@@ -41,4 +41,4 @@ udp:
       address = "xx.xx.xx.xx:xx"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/reference/static-configuration/cli-ref.md b/docs/content/reference/static-configuration/cli-ref.md
index b06e80721..9f71fe776 100644
--- a/docs/content/reference/static-configuration/cli-ref.md
+++ b/docs/content/reference/static-configuration/cli-ref.md
@@ -135,6 +135,9 @@ Timeout for receiving the response headers when communicating with the ACME serv
 `--certificatesresolvers.<name>.acme.clienttimeout`:  
 Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
 
+`--certificatesresolvers.<name>.acme.disablecommonname`:  
+Disable the common name in the CSR. (Default: ```false```)
+
 `--certificatesresolvers.<name>.acme.dnschallenge`:  
 Activate DNS-01 Challenge. (Default: ```false```)
 
@@ -199,7 +202,10 @@ Certificate profile to use.
 Storage to use. (Default: ```acme.json```)
 
 `--certificatesresolvers.<name>.acme.tlschallenge`:  
-Activate TLS-ALPN-01 Challenge. (Default: ```true```)
+Activate TLS-ALPN-01 Challenge. (Default: ```false```)
+
+`--certificatesresolvers.<name>.acme.tlschallenge.delay`:  
+Delay between the creation of the challenge and the validation. (Default: ```0```)
 
 `--certificatesresolvers.<name>.tailscale`:  
 Enables Tailscale certificate resolution. (Default: ```true```)
@@ -231,6 +237,27 @@ Trust only forwarded headers from selected IPs.
 `--entrypoints.<name>.http`:  
 HTTP configuration.
 
+`--entrypoints.<name>.http.encodedcharacters.allowencodedbackslash`:  
+Defines whether requests with encoded back slash characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodedhash`:  
+Defines whether requests with encoded hash characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodednullcharacter`:  
+Defines whether requests with encoded null characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodedpercent`:  
+Defines whether requests with encoded percent characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodedquestionmark`:  
+Defines whether requests with encoded question mark characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodedsemicolon`:  
+Defines whether requests with encoded semicolon characters in the path are allowed. (Default: ```true```)
+
+`--entrypoints.<name>.http.encodedcharacters.allowencodedslash`:  
+Defines whether requests with encoded slash characters in the path are allowed. (Default: ```true```)
+
 `--entrypoints.<name>.http.encodequerysemicolons`:  
 Defines whether request query semicolons should be URLEncoded. (Default: ```false```)
 
@@ -361,7 +388,7 @@ Environment variables to forward to the wasm guest.
 Directory to mount to the wasm guest.
 
 `--experimental.localplugins.<name>.settings.useunsafe`:  
-Allow the plugin to use unsafe package. (Default: ```false```)
+Allow the plugin to use unsafe and syscall packages. (Default: ```false```)
 
 `--experimental.otlplogs`:  
 Enables the OpenTelemetry logs integration. (Default: ```false```)
@@ -379,7 +406,7 @@ Environment variables to forward to the wasm guest.
 Directory to mount to the wasm guest.
 
 `--experimental.plugins.<name>.settings.useunsafe`:  
-Allow the plugin to use unsafe package. (Default: ```false```)
+Allow the plugin to use unsafe and syscall packages. (Default: ```false```)
 
 `--experimental.plugins.<name>.version`:  
 plugin's version.
diff --git a/docs/content/reference/static-configuration/env-ref.md b/docs/content/reference/static-configuration/env-ref.md
index 65c009454..daf50f481 100644
--- a/docs/content/reference/static-configuration/env-ref.md
+++ b/docs/content/reference/static-configuration/env-ref.md
@@ -135,6 +135,9 @@ Timeout for receiving the response headers when communicating with the ACME serv
 `TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_CLIENTTIMEOUT`:  
 Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
 
+`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_DISABLECOMMONNAME`:  
+Disable the common name in the CSR. (Default: ```false```)
+
 `TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_DNSCHALLENGE`:  
 Activate DNS-01 Challenge. (Default: ```false```)
 
@@ -199,7 +202,10 @@ Certificate profile to use.
 Storage to use. (Default: ```acme.json```)
 
 `TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_TLSCHALLENGE`:  
-Activate TLS-ALPN-01 Challenge. (Default: ```true```)
+Activate TLS-ALPN-01 Challenge. (Default: ```false```)
+
+`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_TLSCHALLENGE_DELAY`:  
+Delay between the creation of the challenge and the validation. (Default: ```0```)
 
 `TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_TAILSCALE`:  
 Enables Tailscale certificate resolution. (Default: ```true```)
@@ -240,6 +246,27 @@ HTTP/3 configuration. (Default: ```false```)
 `TRAEFIK_ENTRYPOINTS_<NAME>_HTTP3_ADVERTISEDPORT`:  
 UDP port to advertise, on which HTTP/3 is available. (Default: ```0```)
 
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDBACKSLASH`:  
+Defines whether requests with encoded back slash characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDHASH`:  
+Defines whether requests with encoded hash characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDNULLCHARACTER`:  
+Defines whether requests with encoded null characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDPERCENT`:  
+Defines whether requests with encoded percent characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDQUESTIONMARK`:  
+Defines whether requests with encoded question mark characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDSEMICOLON`:  
+Defines whether requests with encoded semicolon characters in the path are allowed. (Default: ```true```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDSLASH`:  
+Defines whether requests with encoded slash characters in the path are allowed. (Default: ```true```)
+
 `TRAEFIK_ENTRYPOINTS_<NAME>_HTTP_ENCODEQUERYSEMICOLONS`:  
 Defines whether request query semicolons should be URLEncoded. (Default: ```false```)
 
@@ -361,7 +388,7 @@ Environment variables to forward to the wasm guest.
 Directory to mount to the wasm guest.
 
 `TRAEFIK_EXPERIMENTAL_LOCALPLUGINS_<NAME>_SETTINGS_USEUNSAFE`:  
-Allow the plugin to use unsafe package. (Default: ```false```)
+Allow the plugin to use unsafe and syscall packages. (Default: ```false```)
 
 `TRAEFIK_EXPERIMENTAL_OTLPLOGS`:  
 Enables the OpenTelemetry logs integration. (Default: ```false```)
@@ -379,7 +406,7 @@ Environment variables to forward to the wasm guest.
 Directory to mount to the wasm guest.
 
 `TRAEFIK_EXPERIMENTAL_PLUGINS_<NAME>_SETTINGS_USEUNSAFE`:  
-Allow the plugin to use unsafe package. (Default: ```false```)
+Allow the plugin to use unsafe and syscall packages. (Default: ```false```)
 
 `TRAEFIK_EXPERIMENTAL_PLUGINS_<NAME>_VERSION`:  
 plugin's version.
diff --git a/docs/content/reference/static-configuration/file.toml b/docs/content/reference/static-configuration/file.toml
index 7d22522e1..43f4cdc53 100644
--- a/docs/content/reference/static-configuration/file.toml
+++ b/docs/content/reference/static-configuration/file.toml
@@ -73,6 +73,14 @@
         [[entryPoints.EntryPoint0.http.tls.domains]]
           main = "foobar"
           sans = ["foobar", "foobar"]
+      [entryPoints.EntryPoint0.http.encodedCharacters]
+        allowEncodedSlash = true
+        allowEncodedBackSlash = true
+        allowEncodedNullCharacter = true
+        allowEncodedSemicolon = true
+        allowEncodedPercent = true
+        allowEncodedQuestionMark = true
+        allowEncodedHash = true
     [entryPoints.EntryPoint0.http2]
       maxConcurrentStreams = 42
     [entryPoints.EntryPoint0.http3]
@@ -549,6 +557,7 @@
       preferredChain = "foobar"
       profile = "foobar"
       emailAddresses = ["foobar", "foobar"]
+      disableCommonName = true
       storage = "foobar"
       keyType = "foobar"
       certificatesDuration = 42
@@ -574,6 +583,7 @@
         entryPoint = "foobar"
         delay = "42s"
       [certificatesResolvers.CertificateResolver0.acme.tlsChallenge]
+        delay = "42s"
     [certificatesResolvers.CertificateResolver0.tailscale]
   [certificatesResolvers.CertificateResolver1]
     [certificatesResolvers.CertificateResolver1.acme]
@@ -582,6 +592,7 @@
       preferredChain = "foobar"
       profile = "foobar"
       emailAddresses = ["foobar", "foobar"]
+      disableCommonName = true
       storage = "foobar"
       keyType = "foobar"
       certificatesDuration = 42
@@ -607,6 +618,7 @@
         entryPoint = "foobar"
         delay = "42s"
       [certificatesResolvers.CertificateResolver1.acme.tlsChallenge]
+        delay = "42s"
     [certificatesResolvers.CertificateResolver1.tailscale]
 
 [experimental]
diff --git a/docs/content/reference/static-configuration/file.yaml b/docs/content/reference/static-configuration/file.yaml
index 64aae401b..11cf01c88 100644
--- a/docs/content/reference/static-configuration/file.yaml
+++ b/docs/content/reference/static-configuration/file.yaml
@@ -86,6 +86,14 @@ entryPoints:
             sans:
               - foobar
               - foobar
+      encodedCharacters:
+        allowEncodedSlash: true
+        allowEncodedBackSlash: true
+        allowEncodedNullCharacter: true
+        allowEncodedSemicolon: true
+        allowEncodedPercent: true
+        allowEncodedQuestionMark: true
+        allowEncodedHash: true
       encodeQuerySemicolons: true
       sanitizePath: true
       maxHeaderBytes: 42
@@ -590,6 +598,7 @@ certificatesResolvers:
       emailAddresses:
         - foobar
         - foobar
+      disableCommonName: true
       storage: foobar
       keyType: foobar
       eab:
@@ -618,7 +627,8 @@ certificatesResolvers:
       httpChallenge:
         entryPoint: foobar
         delay: 42s
-      tlsChallenge: {}
+      tlsChallenge:
+        delay: 42s
     tailscale: {}
   CertificateResolver1:
     acme:
@@ -629,6 +639,7 @@ certificatesResolvers:
       emailAddresses:
         - foobar
         - foobar
+      disableCommonName: true
       storage: foobar
       keyType: foobar
       eab:
@@ -657,7 +668,8 @@ certificatesResolvers:
       httpChallenge:
         entryPoint: foobar
         delay: 42s
-      tlsChallenge: {}
+      tlsChallenge:
+        delay: 42s
     tailscale: {}
 experimental:
   plugins:
diff --git a/docs/content/routing/entrypoints.md b/docs/content/routing/entrypoints.md
index 6911f43b9..5a426f7a5 100644
--- a/docs/content/routing/entrypoints.md
+++ b/docs/content/routing/entrypoints.md
@@ -107,6 +107,8 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
         address: ":8888" # same as ":8888/tcp"
         http2:
           maxConcurrentStreams: 42
+          maxDecoderHeaderTableSize: 42
+          maxEncoderHeaderTableSize: 42
         http3:
           advertisedPort: 8888
         transport:
@@ -127,6 +129,15 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
           trustedIPs:
             - "127.0.0.1"
             - "192.168.0.1"
+        http:
+          encodedCharacters:
+            allowEncodedSlash: false
+            allowEncodedBackSlash: false
+            allowEncodedNullCharacter: false
+            allowEncodedSemicolon: false
+            allowEncodedPercent: false
+            allowEncodedQuestionMark: false
+            allowEncodedHash: false
     ```
 
     ```toml tab="File (TOML)"
@@ -136,6 +147,8 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
         address = ":8888" # same as ":8888/tcp"
         [entryPoints.name.http2]
           maxConcurrentStreams = 42
+          maxDecoderHeaderTableSize = 42
+          maxEncoderHeaderTableSize = 42
         [entryPoints.name.http3]
           advertisedPort = 8888
         [entryPoints.name.transport]
@@ -152,12 +165,22 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
         [entryPoints.name.forwardedHeaders]
           insecure = true
           trustedIPs = ["127.0.0.1", "192.168.0.1"]
+        [entryPoints.name.http.encodedCharacters]
+          allowEncodedSlash = false
+          allowEncodedBackSlash = false
+          allowEncodedNullCharacter = false
+          allowEncodedSemicolon = false
+          allowEncodedPercent = false
+          allowEncodedQuestionMark = false
+          allowEncodedHash = false
     ```
 
     ```bash tab="CLI"
     ## Static configuration
     --entryPoints.name.address=:8888 # same as :8888/tcp
     --entryPoints.name.http2.maxConcurrentStreams=42
+    --entryPoints.name.http2.maxDecoderHeaderTableSize=42
+    --entryPoints.name.http2.maxEncoderHeaderTableSize=42
     --entryPoints.name.http3.advertisedport=8888
     --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
     --entryPoints.name.transport.lifeCycle.graceTimeOut=42
@@ -168,6 +191,13 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     --entryPoints.name.proxyProtocol.trustedIPs=127.0.0.1,192.168.0.1
     --entryPoints.name.forwardedHeaders.insecure=true
     --entryPoints.name.forwardedHeaders.trustedIPs=127.0.0.1,192.168.0.1
+    --entryPoints.name.http.encodedCharacters.allowEncodedSlash=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedBackSlash=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedNullCharacter=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedSemicolon=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedPercent=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedQuestionMark=false
+    --entryPoints.name.http.encodedCharacters.allowEncodedHash=false
     ```
 
 ### Address
@@ -408,6 +438,52 @@ entryPoints:
 --entryPoints.name.http2.maxConcurrentStreams=250
 ```
 
+#### `maxDecoderHeaderTableSize`
+
+_Optional, Default=4096_
+
+`maxDecoderHeaderTableSize` specifies the maximum size of the HTTP2 HPACK header table on the decoding (receiving from client) side.
+
+```yaml tab="File (YAML)"
+entryPoints:
+  foo:
+    http2:
+      maxDecoderHeaderTableSize: 4096
+```
+
+```toml tab="File (TOML)"
+[entryPoints.foo]
+  [entryPoints.foo.http2]
+    maxDecoderHeaderTableSize = 4096
+```
+
+```bash tab="CLI"
+--entryPoints.name.http2.maxDecoderHeaderTableSize=4096
+```
+
+#### `maxEncoderHeaderTableSize`
+
+_Optional, Default=4096_
+
+`maxEncoderHeaderTableSize` specifies the maximum size of the HTTP2 HPACK header table on the encoding (sending to client) side.
+
+```yaml tab="File (YAML)"
+entryPoints:
+  foo:
+    http2:
+      maxEncoderHeaderTableSize: 4096
+```
+
+```toml tab="File (TOML)"
+[entryPoints.foo]
+  [entryPoints.foo.http2]
+    maxEncoderHeaderTableSize = 4096
+```
+
+```bash tab="CLI"
+--entryPoints.name.http2.maxEncoderHeaderTableSize=4096
+```
+
 ### HTTP/3
 
 #### `http3`
@@ -1101,6 +1177,245 @@ entryPoints:
 | false                 | foo=bar&baz=bar;foo | foo=bar&baz=bar&foo     |
 | true                  | foo=bar&baz=bar;foo | foo=bar&baz=bar%3Bfoo   |
 
+### Encoded Characters
+
+You can configure Traefik to control the handling of encoded characters in request paths for security purposes.
+By default, Traefik do not reject requests with path containing certain encoded characters that could be used in path traversal or other security attacks.
+
+!!! info 
+    
+    This check is not done against the request query parameters,
+    but only against the request path as defined in [RFC3986 section-3](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
+
+!!! info "Security Considerations"
+
+    When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) and notably decode encoded reserved characters in the requets path,
+    it is recommended to set these options to `false` to avoid split-view situation and helps prevent path traversal attacks or other malicious attempts to bypass security controls.
+
+??? info "`encodedCharacters.allowEncodedSlash`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded slash characters (`%2F` or `%2f`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedSlash: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedSlash = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedSlash=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedBackSlash`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded back slash characters (`%5C` or `%5c`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedBackSlash: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedBackSlash = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedBackSlash=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedNullCharacter`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded null characters (`%00`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedNullCharacter: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedNullCharacter = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedNullCharacter=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedSemicolon`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded semicolon characters (`%3B` or `%3b`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedSemicolon: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedSemicolon = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedSemicolon=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedPercent`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded percent characters (`%25`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedPercent: false   
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedPercent = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedPercent=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedQuestionMark`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded question mark characters (`%3F` or `%3f`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          encodedCharacters:
+            allowEncodedQuestionMark: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedQuestionMark = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedQuestionMark=false
+    ```
+
+??? info "`encodedCharacters.allowEncodedHash`"
+
+    _Optional, Default=true_
+
+    Controls whether requests with encoded hash characters (`%23`) in the path are allowed.
+
+    ```yaml tab="File (YAML)"
+    ## Static configuration
+    entryPoints:
+      web:
+        address: ":80"
+        http:    
+          encodedCharacters:
+            allowEncodedHash: false
+    ```
+
+    ```toml tab="File (TOML)"
+    ## Static configuration
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+
+        [entryPoints.web.http.encodedCharacters]
+          allowEncodedHash = false
+    ```
+
+    ```bash tab="CLI"
+    ## Static configuration
+    --entryPoints.web.address=:80
+    --entryPoints.web.http.encodedCharacters.allowEncodedHash=false
+    ```
+
 ### SanitizePath
 
 _Optional, Default=true_
@@ -1408,4 +1723,4 @@ entryPoints:
 --entryPoints.foo.observability.tracing=false
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/overview.md b/docs/content/routing/overview.md
index dd1d0342f..989a2704a 100644
--- a/docs/content/routing/overview.md
+++ b/docs/content/routing/overview.md
@@ -651,4 +651,4 @@ tcpServersTransport:
 --tcpServersTransport.spiffe.trustDomain=spiffe://trust-domain
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/providers/kubernetes-crd.md b/docs/content/routing/providers/kubernetes-crd.md
index 095691e14..1fd5028ea 100644
--- a/docs/content/routing/providers/kubernetes-crd.md
+++ b/docs/content/routing/providers/kubernetes-crd.md
@@ -48,7 +48,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v3.5
+              image: traefik:v3.6
               args:
                 - --log.level=DEBUG
                 - --api
@@ -2039,4 +2039,4 @@ If the ServersTransportTCP CRD is defined in another provider the cross-provider
 
 Also see the [full example](../../user-guides/crd-acme/index.md) with Let's Encrypt.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/providers/kubernetes-gateway.md b/docs/content/routing/providers/kubernetes-gateway.md
index f658ca4ba..4ff202e50 100644
--- a/docs/content/routing/providers/kubernetes-gateway.md
+++ b/docs/content/routing/providers/kubernetes-gateway.md
@@ -8,11 +8,11 @@ description: "The Kubernetes Gateway API can be used as a provider for routing a
 When using the Kubernetes Gateway API provider, Traefik leverages the Gateway API Custom Resource Definitions (CRDs) to obtain its routing configuration. 
 For detailed information on the Gateway API concepts and resources, refer to the official [documentation](https://gateway-api.sigs.k8s.io/).
 
-The Kubernetes Gateway API provider supports version [v1.3.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0) of the specification.
+The Kubernetes Gateway API provider supports version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the specification.
 
 It fully supports all `HTTPRoute` core and some extended features, like `GRPCRoute`, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). 
 
-For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.3.0/traefik-traefik).
+For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik).
 
 ## Deploying a Gateway
 
@@ -750,4 +750,4 @@ spec:
 [...]
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/providers/kubernetes-ingress.md b/docs/content/routing/providers/kubernetes-ingress.md
index ff02ae929..1d8f8e0ef 100644
--- a/docs/content/routing/providers/kubernetes-ingress.md
+++ b/docs/content/routing/providers/kubernetes-ingress.md
@@ -130,7 +130,7 @@ which in turn will create the resulting routers, services, handlers, etc.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v3.5
+              image: traefik:v3.6
               args:
                 - --entryPoints.web.address=:80
                 - --providers.kubernetesingress
@@ -593,7 +593,7 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v3.5
+              image: traefik:v3.6
               args:
                 - --entryPoints.websecure.address=:443
                 - --entryPoints.websecure.http.tls
@@ -786,7 +786,7 @@ For more options, please refer to the available [annotations](#on-ingress).
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v3.5
+              image: traefik:v3.6
               args:
                 - --entryPoints.websecure.address=:443
                 - --providers.kubernetesingress
@@ -960,4 +960,4 @@ This will allow users to create a "default router" that will match all unmatched
 
     To do this, use the `traefik.ingress.kubernetes.io/router.priority` annotation (as seen in [Annotations on Ingress](#on-ingress)) on your ingresses accordingly.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/routers/index.md b/docs/content/routing/routers/index.md
index 06cd3f05b..9b0807f07 100644
--- a/docs/content/routing/routers/index.md
+++ b/docs/content/routing/routers/index.md
@@ -1790,4 +1790,4 @@ Services are the target for the router.
 
 !!! important "UDP routers can only target UDP services (and not HTTP or TCP services)."
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/routing/services/index.md b/docs/content/routing/services/index.md
index 3a4cc5c0a..7ae01c5c1 100644
--- a/docs/content/routing/services/index.md
+++ b/docs/content/routing/services/index.md
@@ -175,6 +175,7 @@ Two load balancing algorithms are supported:
 
 - Weighed round-robin (wrr)
 - Power of two choices (p2c)
+- Highest Random Weight (hrw)
 
 ##### WRR
 
@@ -242,6 +243,34 @@ Power of two choices algorithm is a load balancing strategy that selects two ser
           url = "http://private-ip-server-3/"
     ```
 
+##### HRW
+
+HighestRandomWeight, also called RendezVous hashing allows to loadbalance clients in a pool of services or servers.
+
+??? example "Load Balancing HRW with-- Using the [File Provider](../../providers/file.md)"
+
+    ```yaml tab="YAML"
+    ## Dynamic configuration
+    http:
+      services:
+        my-service:
+          loadBalancer:
+            strategy: hrw
+            servers:
+            - url: "http://private-ip-server-1/"
+            - url: "http://private-ip-server-2/"
+    ```
+
+    ```toml tab="TOML"
+    ## Dynamic configuration
+    [http.services]
+      [http.services.my-service.loadBalancer]
+        [[http.services.my-service.loadBalancer.servers]]
+          url = "http://private-ip-server-1/"
+        [[http.services.my-service.loadBalancer.servers]]
+          url = "http://private-ip-server-2/"
+    ```
+
 #### Sticky sessions
 
 When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
@@ -1253,6 +1282,147 @@ http:
         url = "http://private-ip-server-2/"
 ```
 
+### Highest Random Weight (service)
+
+The HRW is able to load balance the requests between multiple services based on weights.
+
+This strategy is only available to load balance between [services](./index.md) and not between [servers](./index.md#servers).
+
+!!! info "Supported Providers"
+
+    This strategy can be defined currently with the [File](../../providers/file.md) or [IngressRoute](../../providers/kubernetes-crd.md) providers.
+
+```yaml tab="YAML"
+## Dynamic configuration
+http:
+  services:
+    app:
+      highestRandomWeight:
+        services:
+        - name: appv1
+          weight: 3
+        - name: appv2
+          weight: 1
+
+    appv1:
+      loadBalancer:
+        strategy: hrw
+        servers:
+        - url: "http://private-ip-server-1/"
+
+    appv2:
+      loadBalancer:
+        strategy: hrw
+        servers:
+        - url: "http://private-ip-server-2/"
+```
+
+```toml tab="TOML"
+## Dynamic configuration
+[http.services]
+  [http.services.app]
+    [[http.services.app.highestRandomWeight.services]]
+      name = "appv1"
+      weight = 3
+    [[http.services.app.highestRandomWeight.services]]
+      name = "appv2"
+      weight = 1
+
+  [http.services.appv1]
+    [http.services.appv1.loadBalancer]
+      strategy = "hrw"
+      [[http.services.appv1.loadBalancer.servers]]
+        url = "http://private-ip-server-1/"
+
+  [http.services.appv2]
+    [http.services.appv2.loadBalancer]
+      strategy = "hrw"
+      [[http.services.appv2.loadBalancer.servers]]
+        url = "http://private-ip-server-2/"
+```
+
+#### Health Check
+
+HealthCheck enables automatic self-healthcheck for this service, i.e. whenever
+one of its children is reported as down, this service becomes aware of it, and
+takes it into account (i.e. it ignores the down child) when running the
+load-balancing algorithm. In addition, if the parent of this service also has
+HealthCheck enabled, this service reports to its parent any status change.
+
+!!! info "All or nothing"
+
+    If HealthCheck is enabled for a given service, but any of its descendants does
+    not have it enabled, the creation of the service will fail.
+
+    HealthCheck on Weighted services can be defined currently only with the [File](../../providers/file.md) provider.
+
+```yaml tab="YAML"
+## Dynamic configuration
+http:
+  services:
+    app:
+      highestRandomWeight:
+        healthCheck: {}
+        services:
+        - name: appv1
+          weight: 3
+        - name: appv2
+          weight: 1
+
+    appv1:
+      loadBalancer:
+        strategy: hrw
+        healthCheck:
+          path: /status
+          interval: 10s
+          timeout: 3s
+        servers:
+        - url: "http://private-ip-server-1/"
+
+    appv2:
+      loadBalancer:
+        strategy: hrw
+        healthCheck:
+          path: /status
+          interval: 10s
+          timeout: 3s
+        servers:
+        - url: "http://private-ip-server-2/"
+```
+
+```toml tab="TOML"
+## Dynamic configuration
+[http.services]
+  [http.services.app]
+    [http.services.app.highestRandomWeight.healthCheck]
+    [[http.services.app.highestRandomWeight.services]]
+      name = "appv1"
+      weight = 3
+    [[http.services.app.highestRandomWeight.services]]
+      name = "appv2"
+      weight = 1
+
+  [http.services.appv1]
+    [http.services.appv1.loadBalancer]
+      strategy="hrw"
+      [http.services.appv1.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv1.loadBalancer.servers]]
+        url = "http://private-ip-server-1/"
+
+  [http.services.appv2]
+    [http.services.appv2.loadBalancer]
+      strategy="hrw"
+      [http.services.appv2.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv2.loadBalancer.servers]]
+        url = "http://private-ip-server-2/"
+```
+
 ### Mirroring (service)
 
 The mirroring is able to mirror requests sent to a service to other services.
@@ -2225,4 +2395,4 @@ udp:
         address = "private-ip-server-2:8080/"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/secure/secure-api-access-with-jwt.md b/docs/content/secure/secure-api-access-with-jwt.md
index 5e853a637..4c9b8eb65 100644
--- a/docs/content/secure/secure-api-access-with-jwt.md
+++ b/docs/content/secure/secure-api-access-with-jwt.md
@@ -201,4 +201,4 @@ spec:
     For example, the metadata recovered from the Identity Provider can be used to restrict the access to the applications.
     To do so, you can use the `claims` option, more information in the [dedicated section](../reference/routing-configuration/http/middlewares/jwt.md#claims).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/secure/secure-api-access-with-oidc.md b/docs/content/secure/secure-api-access-with-oidc.md
index f7b18def9..62347442c 100644
--- a/docs/content/secure/secure-api-access-with-oidc.md
+++ b/docs/content/secure/secure-api-access-with-oidc.md
@@ -107,4 +107,4 @@ spec:
     - Using a cookie ([Options `session`](../reference/routing-configuration/http/middlewares/oidc.md#configuration-options) (default behavior))
     - Using a [Redis store](../reference/routing-configuration/http/middlewares/oidc.md#sessionstore).  
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/secure/secure-api-access-with-waf.md b/docs/content/secure/secure-api-access-with-waf.md
index 455839b99..6ca34e39a 100644
--- a/docs/content/secure/secure-api-access-with-waf.md
+++ b/docs/content/secure/secure-api-access-with-waf.md
@@ -187,4 +187,4 @@ spec:
 
     The WAF middleware supports extensive customization through Coraza directives. You can create custom rules, tune detection thresholds, configure logging levels, and integrate with external threat intelligence feeds. For comprehensive rule writing guidance, consult the [Coraza documentation](https://coraza.io/docs/tutorials/introduction/) and [OWASP CRS documentation](https://coreruleset.org/docs/).
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/security/content-length.md b/docs/content/security/content-length.md
index fff161881..2e6c90706 100644
--- a/docs/content/security/content-length.md
+++ b/docs/content/security/content-length.md
@@ -3,7 +3,8 @@ title: "Content-Length"
 description: "Enforce strict Content‑Length validation in Traefik by streaming or full buffering to prevent truncated or over‑long requests and responses. Read the technical documentation."
 ---
 
-Traefik acts as a streaming proxy. By default, it checks each chunk of data against the `Content-Length` header as it passes it on to the backend or client. This live check blocks truncated or over‑long streams without holding the entire message.
+Traefik acts as a streaming proxy. By default, it checks each chunk of data against the `Content-Length` header as it passes it on to the backend or client.
+This live check blocks truncated or over‑long streams without holding the entire message.
 
 If you need Traefik to read and verify the full body before any data moves on, add the [buffering middleware](../middlewares/http/buffering.md):
 
@@ -20,5 +21,7 @@ With buffering enabled, Traefik will:
 - Compare the actual byte count to the `Content-Length` header.
 - Reject the message if the counts do not match.
 
-!!!warning 
-    Buffering adds overhead. Every request and response is held in full before forwarding, which can increase memory use and latency. Use it when strict content validation is critical to your security posture.
+!!! warning
+
+    Buffering adds overhead. Every request and response is held in full before forwarding, which can increase memory use and latency.
+    Use it when strict content validation is critical to your security posture.
diff --git a/docs/content/security/tls-certs-in-multi-tenant-kubernetes.md b/docs/content/security/multi-tenant-kubernetes.md
similarity index 55%
rename from docs/content/security/tls-certs-in-multi-tenant-kubernetes.md
rename to docs/content/security/multi-tenant-kubernetes.md
index 8fd7ef959..5ff606282 100644
--- a/docs/content/security/tls-certs-in-multi-tenant-kubernetes.md
+++ b/docs/content/security/multi-tenant-kubernetes.md
@@ -1,13 +1,20 @@
 ---
-title: "TLS Certificates in Multi‑Tenant Kubernetes"
-description: "Isolate TLS certificates in multi‑tenant clusters by keeping Secrets and routes in the same namespace and disabling cross‑namespace look‑ups in Traefik. Read the technical guidelines."
+title: "Traefik in Multi-Tenant Kubernetes Clusterss"
+description: "Traefik is not recommended for multi-tenant Kubernetes clusters due to TLS certificate management and broader isolation, traffic, and security concerns. Read the technical guidelines."
 ---
 
-# TLS Certificates in Multi‑Tenant Kubernetes
+# Traefik in Multi-Tenant Kubernetes Clusters
 
-In a shared cluster, different teams can create `Ingress` or `IngressRoute` objects that Traefik consumes.
+Traefik is primarily designed as a cluster-wide ingress controller. For this reason, when using the Kubernetes `Ingress` or `IngressRoute` specifications, **it is not recommended to use Traefik in multi-tenant Kubernetes clusters**, where multiple teams or tenants share the same cluster.
 
-Traefik does not support multi-tenancy when using the Kubernetes `Ingress` or `IngressRoute` specifications due to the way TLS certificate management is handled.
+The main reasons include:
+
+* **Resource visibility and isolation**: Traefik requires cluster-level permissions and watches resources across namespaces. Misconfigurations in one tenant’s resources may affect others.
+* **Shared CRDs**: Advanced configuration resources, like Middleware or TLSOptions, are cluster-scoped. Conflicting definitions can impact multiple tenants.
+* **Traffic and availability risks**: Routing rules, middleware, or heavy traffic from one tenant can interfere with others, affecting reliability and performance.
+* **Observability and privacy**: Logs, metrics, and traces are shared by default, which may expose sensitive information across tenants.
+
+## TLS Certificates Management
 
 At the core of this limitation is the TLS Store, which holds all the TLS certificates used by Traefik. 
 As this Store is global in Traefik, it is shared across all namespaces, meaning any `Ingress` or `IngressRoute` in the cluster can potentially reference or affect TLS configurations intended for other tenants.
diff --git a/docs/content/security/request-path.md b/docs/content/security/request-path.md
new file mode 100644
index 000000000..fe88c3142
--- /dev/null
+++ b/docs/content/security/request-path.md
@@ -0,0 +1,135 @@
+---
+title: "Request Path"
+description: "Learn how Traefik processes and secures request paths through sanitization and encoded character filtering to protect against path traversal and injection attacks."
+---
+
+# Request Path
+
+Protecting Against Path-Based Attacks Through Sanitization and Filtering
+{: .subtitle }
+
+Traefik implements multiple layers of security when processing incoming request paths.
+This includes path sanitization to normalize potentially dangerous sequences and encoded character filtering to prevent attack vectors that use URL encoding.
+Understanding how Traefik handles request paths is crucial for maintaining a secure routing infrastructure.
+
+## How Traefik Processes Request Paths
+
+When Traefik receives an HTTP request, it processes the request path through several security-focused stages:
+
+### 1. Encoded Character Filtering
+
+Traefik inspects the path for potentially dangerous encoded characters and rejects requests containing them unless explicitly allowed.
+
+Here is the list of the encoded characters that are allowed by default:
+
+| Encoded Character | Character               |
+|-------------------|-------------------------|
+| `%2f` or `%2F`    | `/` (slash)             |
+| `%5c` or `%5C`    | `\` (backslash)         |
+| `%00`             | `NULL` (null character) |
+| `%3b` or `%3B`    | `;` (semicolon)         |
+| `%25`             | `%` (percent)           |
+| `%3f` or `%3F`    | `?` (question mark)     |
+| `%23`             | `#` (hash)              |
+
+### 2. Path Normalization
+
+Traefik normalizes the request path by decoding the unreserved percent-encoded characters,
+as they are equivalent to their non-encoded form (according to [rfc3986#section-2.3](https://datatracker.ietf.org/doc/html/rfc3986#section-2.3)),
+and capitalizing the percent-encoded characters (according to [rfc3986#section-6.2.2.1](https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.2.1)).
+
+### 3. Path Sanitization
+
+Traefik sanitizes request paths to prevent common attack vectors,
+by removing the `..`, `.` and duplicate slash segments from the URL (according to [rfc3986#section-6.2.2.3](https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.2.3)).
+
+## Path Security Configuration
+
+Traefik provides two main mechanisms for path security that work together to protect your applications.
+
+### Path Sanitization
+
+Path sanitization is enabled by default and helps prevent directory traversal attacks by normalizing request paths.
+Configure it in the [EntryPoints](../routing/entrypoints.md#sanitizepath) HTTP section:
+
+```yaml tab="File (YAML)"
+entryPoints:
+  websecure:
+    address: ":443"
+    http:
+      sanitizePath: true  # Default: true (recommended)
+```
+
+```toml tab="File (TOML)"
+[entryPoints.websecure]
+  address = ":443"
+
+  [entryPoints.websecure.http]
+    sanitizePath = true
+```
+
+```bash tab="CLI"
+--entryPoints.websecure.address=:443
+--entryPoints.websecure.http.sanitizePath=true
+```
+
+**Sanitization behavior:**
+
+- `./foo/bar` → `/foo/bar` (removes relative current directory)
+- `/foo/../bar` → `/bar` (resolves parent directory traversal)
+- `/foo/bar//` → `/foo/bar/` (removes duplicate slashes)
+- `/./foo/../bar//` → `/bar/` (combines all normalizations)
+
+### Encoded Character Filtering
+
+Encoded character filtering provides an additional security layer by rejecting potentially dangerous URL-encoded characters.
+Configure it in the [EntryPoints](../routing/entrypoints.md#encoded-characters) HTTP section.
+
+This filtering occurs before path sanitization and catches attack attempts that use encoding to bypass other security controls.
+
+All encoded character filtering is disabled by default (`true` means encoded characters are allowed).
+
+!!! info "Security Considerations"
+
+    When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) and notably decode encoded reserved characters in the requets path,
+    it is recommended to set these options to `false` to avoid split-view situation and helps prevent path traversal attacks or other malicious attempts to bypass security controls.
+
+```yaml tab="File (YAML)"
+entryPoints:
+  websecure:
+    address: ":443"
+    http:
+      encodedCharacters:
+        allowEncodedSlash: false          # %2F - Default: true
+        allowEncodedBackSlash: false      # %5C - Default: true
+        allowEncodedNullCharacter: false  # %00 - Default: true
+        allowEncodedSemicolon: false      # %3B - Default: true
+        allowEncodedPercent: false        # %25 - Default: true
+        allowEncodedQuestionMark: false   # %3F - Default: true
+        allowEncodedHash: false           # %23 - Default: true
+```
+
+```toml tab="File (TOML)"
+[entryPoints.websecure]
+  address = ":443"
+
+  [entryPoints.websecure.http.encodedCharacters]
+    allowEncodedSlash = false
+    allowEncodedBackSlash = false
+    allowEncodedNullCharacter = false
+    allowEncodedSemicolon = false
+    allowEncodedPercent = false
+    allowEncodedQuestionMark = false
+    allowEncodedHash = false
+```
+
+```bash tab="CLI"
+--entryPoints.websecure.address=:443
+--entryPoints.websecure.http.encodedCharacters.allowEncodedSlash=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedBackSlash=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedNullCharacter=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedSemicolon=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedPercent=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedQuestionMark=false
+--entryPoints.websecure.http.encodedCharacters.allowEncodedHash=false
+```
diff --git a/docs/content/setup/docker.md b/docs/content/setup/docker.md
index beaf29f9d..e270b318c 100644
--- a/docs/content/setup/docker.md
+++ b/docs/content/setup/docker.md
@@ -296,4 +296,4 @@ This enables access logs to the container's standard output (viewable via `docke
 
 You now have a basic Traefik setup in Docker with secure dashboard access and HTTP-to-HTTPS redirection.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/setup/kubernetes.md b/docs/content/setup/kubernetes.md
index c54853e8c..4cdd6def0 100644
--- a/docs/content/setup/kubernetes.md
+++ b/docs/content/setup/kubernetes.md
@@ -126,7 +126,7 @@ ingressRoute:
     middlewares:
       - name: dashboard-auth
 
-# Creates a BasiAuth Middleware and Secret for the Dashboard Security
+# Creates a BasicAuth Middleware and Secret for the Dashboard Security
 extraObjects:
   - apiVersion: v1
     kind: Secret
@@ -397,4 +397,4 @@ This enables OTel tracing and specifies the collector endpoint. Consult the [Tra
 
 This setup establishes Traefik with secure dashboard access and HTTPS redirection, along with pointers to enable observability & TLS.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/setup/swarm.md b/docs/content/setup/swarm.md
index 1b097831d..1d3237153 100644
--- a/docs/content/setup/swarm.md
+++ b/docs/content/setup/swarm.md
@@ -61,7 +61,7 @@ In the same directory, create `docker‑compose‑swarm.yaml`:
 ```yaml
 services:
   traefik:
-    image: traefik:v3.4
+    image: traefik:v3.6
     
     networks:
     # Connect to the 'traefik_proxy' overlay network for inter-container communication across nodes
@@ -327,4 +327,4 @@ command:
 
 You now have Traefik running on Docker Swarm with HTTPS, a secured dashboard, automatic HTTP → HTTPS redirects, and foundational observability. Expand this stack with Let’s Encrypt, additional middlewares, or multiple Traefik replicas as your Swarm grows.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/user-guides/cert-manager.md b/docs/content/user-guides/cert-manager.md
index fbb90d918..c6edd855f 100644
--- a/docs/content/user-guides/cert-manager.md
+++ b/docs/content/user-guides/cert-manager.md
@@ -180,4 +180,4 @@ There are multiple event sources available to investigate when using cert-manage
 
 cert-manager documentation provides a [detailed guide](https://cert-manager.io/docs/troubleshooting/) on how to troubleshoot a certificate request.
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/user-guides/crd-acme/03-deployments.yml b/docs/content/user-guides/crd-acme/03-deployments.yml
index b2d15b3b7..7318b0daf 100644
--- a/docs/content/user-guides/crd-acme/03-deployments.yml
+++ b/docs/content/user-guides/crd-acme/03-deployments.yml
@@ -26,7 +26,7 @@ spec:
       serviceAccountName: traefik-ingress-controller
       containers:
         - name: traefik
-          image: traefik:v3.5
+          image: traefik:v3.6
           args:
             - --api.insecure
             - --accesslog
diff --git a/docs/content/user-guides/crd-acme/index.md b/docs/content/user-guides/crd-acme/index.md
index 49c9db013..f408b03c5 100644
--- a/docs/content/user-guides/crd-acme/index.md
+++ b/docs/content/user-guides/crd-acme/index.md
@@ -49,10 +49,10 @@ and the RBAC authorization resources which will be referenced through the `servi
 
 ```bash
 # Install Traefik Resource Definitions:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
 
 # Install RBAC for Traefik:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
 ```
 
 ### Services
@@ -60,7 +60,7 @@ kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/con
 Then, the services. One for Traefik itself, and one for the app it routes for, i.e. in this case our demo HTTP server: [whoami](https://github.com/traefik/whoami).
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/user-guides/crd-acme/02-services.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/user-guides/crd-acme/02-services.yml
 ```
 
 ```yaml
@@ -73,7 +73,7 @@ Next, the deployments, i.e. the actual pods behind the services.
 Again, one pod for Traefik, and one for the whoami app.
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/user-guides/crd-acme/03-deployments.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/user-guides/crd-acme/03-deployments.yml
 ```
 
 ```yaml
@@ -100,7 +100,7 @@ Look it up.
 We can now finally apply the actual ingressRoutes, with:
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/user-guides/crd-acme/04-ingressroutes.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/user-guides/crd-acme/04-ingressroutes.yml
 ```
 
 ```yaml
@@ -126,7 +126,7 @@ Nowadays, TLS v1.0 and v1.1 are deprecated.
 In order to force TLS v1.2 or later on all your IngressRoute, you can define the `default` TLSOption:
 
 ```bash
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/user-guides/crd-acme/05-tlsoption.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/user-guides/crd-acme/05-tlsoption.yml
 ```
 
 ```yaml
diff --git a/docs/content/user-guides/crd-acme/k3s.yml b/docs/content/user-guides/crd-acme/k3s.yml
index 23190c461..8701d7305 100644
--- a/docs/content/user-guides/crd-acme/k3s.yml
+++ b/docs/content/user-guides/crd-acme/k3s.yml
@@ -1,5 +1,5 @@
 server:
-  image: rancher/k3s:v1.17.2-k3s1
+  image: rancher/k3s:v1.34.2-k3s1
   command: server --disable-agent --no-deploy traefik
   environment:
     - K3S_CLUSTER_SECRET=somethingtotallyrandom
@@ -17,7 +17,7 @@ server:
     - 6443:6443
 
 node:
-  image: rancher/k3s:v1.17.2-k3s1
+  image: rancher/k3s:v1.34.2-k3s1
   privileged: true
   links:
     - server
@@ -26,5 +26,5 @@ node:
     - K3S_CLUSTER_SECRET=somethingtotallyrandom
   volumes:
     # this is where you would place a alternative traefik image (saved as a .tar file with
-    # 'docker save'), if you want to use it, instead of the traefik:v3.5 image.
+    # 'docker save'), if you want to use it, instead of the traefik:v3.6 image.
     - /somewhere/on/your/host/custom-image:/var/lib/rancher/k3s/agent/images
diff --git a/docs/content/user-guides/docker-compose/acme-dns/docker-compose.yml b/docs/content/user-guides/docker-compose/acme-dns/docker-compose.yml
index 2bcb322e6..d2e93d105 100644
--- a/docs/content/user-guides/docker-compose/acme-dns/docker-compose.yml
+++ b/docs/content/user-guides/docker-compose/acme-dns/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
 
   traefik:
-    image: "traefik:v3.5"
+    image: "traefik:v3.6"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"
diff --git a/docs/content/user-guides/docker-compose/acme-dns/docker-compose_secrets.yml b/docs/content/user-guides/docker-compose/acme-dns/docker-compose_secrets.yml
index 63487e067..752f28755 100644
--- a/docs/content/user-guides/docker-compose/acme-dns/docker-compose_secrets.yml
+++ b/docs/content/user-guides/docker-compose/acme-dns/docker-compose_secrets.yml
@@ -11,7 +11,7 @@ secrets:
 services:
 
   traefik:
-    image: "traefik:v3.5"
+    image: "traefik:v3.6"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"
diff --git a/docs/content/user-guides/docker-compose/acme-dns/index.md b/docs/content/user-guides/docker-compose/acme-dns/index.md
index 78f25f8d4..eb6178d82 100644
--- a/docs/content/user-guides/docker-compose/acme-dns/index.md
+++ b/docs/content/user-guides/docker-compose/acme-dns/index.md
@@ -187,4 +187,4 @@ environment:
   - "OVH_CONSUMER_KEY_FILE=/run/secrets/ovh_consumer_key"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/user-guides/docker-compose/acme-http/docker-compose.yml b/docs/content/user-guides/docker-compose/acme-http/docker-compose.yml
index 3deb01ca2..7684098d2 100644
--- a/docs/content/user-guides/docker-compose/acme-http/docker-compose.yml
+++ b/docs/content/user-guides/docker-compose/acme-http/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
 
   traefik:
-    image: "traefik:v3.5"
+    image: "traefik:v3.6"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"
diff --git a/docs/content/user-guides/docker-compose/acme-tls/docker-compose.yml b/docs/content/user-guides/docker-compose/acme-tls/docker-compose.yml
index c95bb5eb9..b91269fe3 100644
--- a/docs/content/user-guides/docker-compose/acme-tls/docker-compose.yml
+++ b/docs/content/user-guides/docker-compose/acme-tls/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
 
   traefik:
-    image: "traefik:v3.5"
+    image: "traefik:v3.6"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"
diff --git a/docs/content/user-guides/docker-compose/acme-tls/index.md b/docs/content/user-guides/docker-compose/acme-tls/index.md
index 942d17cc1..937664081 100644
--- a/docs/content/user-guides/docker-compose/acme-tls/index.md
+++ b/docs/content/user-guides/docker-compose/acme-tls/index.md
@@ -83,4 +83,4 @@ labels:
   - "traefik.http.routers.whoami.tls.certresolver=myresolver"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/content/user-guides/docker-compose/basic-example/docker-compose.yml b/docs/content/user-guides/docker-compose/basic-example/docker-compose.yml
index 842478ac8..fba201c4a 100644
--- a/docs/content/user-guides/docker-compose/basic-example/docker-compose.yml
+++ b/docs/content/user-guides/docker-compose/basic-example/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
 
   traefik:
-    image: "traefik:v3.5"
+    image: "traefik:v3.6"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"
diff --git a/docs/content/user-guides/docker-compose/basic-example/index.md b/docs/content/user-guides/docker-compose/basic-example/index.md
index 6aef0c804..b29b84925 100644
--- a/docs/content/user-guides/docker-compose/basic-example/index.md
+++ b/docs/content/user-guides/docker-compose/basic-example/index.md
@@ -29,7 +29,7 @@ Create a `docker-compose.yml` file with the following content:
     services:
 
       traefik:
-        image: "traefik:v3.5"
+        image: "traefik:v3.6"
         ...
         networks:
           - traefiknet
@@ -131,4 +131,4 @@ whoami:
     - "traefik.http.routers.whoami.entrypoints=web"
 ```
 
-{!traefik-for-business-applications.md!}
+{% include-markdown "includes/traefik-for-business-applications.md" %}
diff --git a/docs/docs.Dockerfile b/docs/docs.Dockerfile
index 99e963cf4..bd9886863 100644
--- a/docs/docs.Dockerfile
+++ b/docs/docs.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.22
+FROM alpine:3.23
 
 ENV PATH="${PATH}:/venv/bin"
 
diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml
index dca15910d..77e5ce866 100644
--- a/docs/mkdocs.yml
+++ b/docs/mkdocs.yml
@@ -2,24 +2,27 @@ site_name: Traefik
 site_description: Traefik Documentation
 site_author: traefik.io
 site_url: https://doc.traefik.io/traefik
-dev_addr: 0.0.0.0:8000
+dev_addr: localhost:8000
 
 repo_name: 'GitHub'
 repo_url: 'https://github.com/traefik/traefik'
 
 docs_dir: 'content'
 
-product: proxy
 
-# https://squidfunk.github.io/mkdocs-material/
+# Use custom version of mkdocs-material
+# See https://github.com/traefik/mkdocs-material
 theme:
   name: 'traefik-labs'
+  product: proxy
   language: en
   include_sidebar: true
   favicon: assets/img/traefikproxy-icon-color.png
   logo: assets/img/traefikproxy-vertical-logo-color.svg
   feature:
     tabs: false
+  features:
+    - content.code.copy
   palette:
     primary: 'cyan'
     accent: 'cyan'
@@ -27,7 +30,7 @@ theme:
     prev: 'Previous'
     next: 'Next'
 
-copyright: 'Traefik Labs • Copyright &copy; 2016-2025'
+copyright: 'Traefik Labs • Copyright &copy; 2016-2026'
 
 extra_javascript:
   - assets/js/hljs/highlight.pack.js # Download from https://highlightjs.org/download/ and enable YAML, TOML and Dockerfile
@@ -35,12 +38,15 @@ extra_javascript:
 
 extra_css:
   - assets/css/menu-icons.css
+  - assets/css/code-copy.css
 
 plugins:
   - search
   - exclude:
       glob:
         - "**/include-*.md"
+  - include-markdown:
+      encoding: utf-8
   - redirects:
       redirect_maps:
         # Providers
@@ -176,21 +182,19 @@ markdown_extensions:
   - pymdownx.tasklist
   - pymdownx.snippets:
       check_paths: true
-  - markdown_include.include:
-      base_path: content/includes/
-      encoding: utf-8
   - toc:
       permalink: true
 
 # Page tree
 nav:
   - 'What is Traefik': 'index.md'
+  - 'Features': 'features/index.md'
   - 'Getting Started':
       - 'Overview': 'getting-started/index.md'
+      - 'Configuration Introduction': 'getting-started/configuration-overview.md'
       - 'Quick Start':
         - 'Kubernetes': 'getting-started/kubernetes.md'
         - 'Docker': 'getting-started/docker.md'
-      - 'Configuration Introduction': 'getting-started/configuration-overview.md'
   - 'Setup':
       - 'Kubernetes': 'setup/kubernetes.md'
       - 'Docker': 'setup/docker.md'
@@ -212,6 +216,7 @@ nav:
   - 'Extend': 'extend/extend-traefik.md'
   - '<span class="nav-link-with-icon">Govern <img src="https://doc.traefik.io/traefik-hub/img/ps-traefik-hub-logo-light.svg" class="menu-icon" alt="Traefik Hub API Gateway"></span>': 'govern/index.md'
   - 'Migrate':
+      - 'Ingress NGINX to Traefik': 'migrate/nginx-to-traefik.md'
       - 'Traefik v3 minor migrations': 'migrate/v3.md'
       - 'Traefik v2 to v3':
         - 'Migration guide': 'migrate/v2-to-v3.md'
@@ -228,6 +233,7 @@ nav:
           - 'Kubernetes CRD' : 'reference/install-configuration/providers/kubernetes/kubernetes-crd.md'
           - 'Kubernetes Ingress' : 'reference/install-configuration/providers/kubernetes/kubernetes-ingress.md'
           - 'Kubernetes Ingress NGINX' : 'reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md'
+          - 'Knative': 'reference/install-configuration/providers/kubernetes/knative.md'
         - 'Docker': 'reference/install-configuration/providers/docker.md'
         - 'Swarm': 'reference/install-configuration/providers/swarm.md'
         - 'Hashicorp':
@@ -266,6 +272,7 @@ nav:
               - 'Router' : 'reference/routing-configuration/http/routing/router.md'
               - 'Rules & Priority' : 'reference/routing-configuration/http/routing/rules-and-priority.md'
               - 'Observability': 'reference/routing-configuration/http/routing/observability.md'
+              - 'Multi-Layer Routing': 'reference/routing-configuration/http/routing/multi-layer-routing.md'
             - 'Load Balancing' :
               - 'Service' : 'reference/routing-configuration/http/load-balancing/service.md'
               - 'ServersTransport' : 'reference/routing-configuration/http/load-balancing/serverstransport.md'
@@ -345,6 +352,7 @@ nav:
                 - 'IngressRouteUDP' : 'reference/routing-configuration/kubernetes/crd/udp/ingressrouteudp.md'
           - 'Ingress' : 'reference/routing-configuration/kubernetes/ingress.md'
           - 'Ingress NGINX' : 'reference/routing-configuration/kubernetes/ingress-nginx.md'
+          - 'Knative': 'reference/routing-configuration/kubernetes/knative.md'
         - 'Label & Tag Providers' :
           - 'Docker' : 'reference/routing-configuration/other-providers/docker.md'
           - 'Swarm' : 'reference/routing-configuration/other-providers/swarm.md'
@@ -354,13 +362,16 @@ nav:
           - 'KV' : 'reference/routing-configuration/other-providers/kv.md'
         - 'File' : 'reference/routing-configuration/other-providers/file.md'
     - 'Security':
-          - 'Content-Length': 'security/content-length.md'
-          - 'TLS in Multi-Tenant Kubernetes': 'security/tls-certs-in-multi-tenant-kubernetes.md'
+        - 'Request Path': 'security/request-path.md'
+        - 'Content-Length': 'security/content-length.md'
+        - 'Multi-Tenant Kubernetes': 'security/multi-tenant-kubernetes.md'
     - 'Deprecation Notices':
         - 'Releases': 'deprecation/releases.md'
         - 'Features': 'deprecation/features.md'
   - 'User Guides':
       - 'FastProxy': 'user-guides/fastproxy.md'
+      - 'Kubernetes and Let''s Encrypt': 'user-guides/crd-acme/index.md'
+      - 'Kubernetes and cert-manager': 'user-guides/cert-manager.md'
       - 'gRPC Examples': 'user-guides/grpc.md'
       - 'WebSocket Examples': 'user-guides/websocket.md'
   - 'Contributing':
diff --git a/docs/readme.md b/docs/readme.md
index de1d8b677..822c1cd6a 100644
--- a/docs/readme.md
+++ b/docs/readme.md
@@ -16,3 +16,15 @@
 
 [pymdown-extensions]: https://facelessuser.github.io/pymdown-extensions "PyMdown Extensions"
 [pymdown-extensions-src]: https://github.com/facelessuser/pymdown-extensions "PyMdown Extensions - Sources"
+
+## Build locally without docker
+
+```sh
+# Pre-requisite: python3, pip and virtualenv
+DOCS="/tmp/traefik-docs"
+mkdir "$DOCS"
+virtualenv "$DOCS"
+source "$DOCS/bin/activate"
+pip install -r requirements.txt
+mkdocs serve # or mkdocs build
+```
diff --git a/docs/requirements.txt b/docs/requirements.txt
index d2dff6242..f0d99127c 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,5 +1,5 @@
-markdown-include==0.5.1
-mkdocs==1.2.4
+mkdocs==1.4.3
+mkdocs-include-markdown-plugin==7.2.0
 mkdocs-exclude==1.0.2
 mkdocs-traefiklabs>=100.0.7
 mkdocs-redirects==1.2.2
diff --git a/docs/scripts/lint-yaml.sh b/docs/scripts/lint-yaml.sh
new file mode 100755
index 000000000..d48e8b1a9
--- /dev/null
+++ b/docs/scripts/lint-yaml.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+# This script checks that YAML files with multiple Kubernetes resources
+# do not start with '---'
+#
+# Rule: If a YAML file contains more than one Kubernetes resource
+# (indicated by '---' separator in the middle of the file),
+# it should NOT start with '---'
+
+set -eu
+
+BASE_DIR="${1:-/app}"
+
+echo "== Linting YAML files (Kubernetes multi-resource format)"
+
+# Find all YAML files in the content directory
+find "${BASE_DIR}/content" -type f \( -name "*.yml" -o -name "*.yaml" \) | while read -r file; do
+    # Count the number of '---' lines in the file
+    separator_count=$(grep -c "^---" "$file" || true)
+
+    # Check if file starts with '---'
+    starts_with_separator=false
+    if head -1 "$file" | grep -q "^---"; then
+        starts_with_separator=true
+    fi
+
+    # If file has multiple resources (separator_count >= 1 when starting with ---, or >= 2 otherwise)
+    # and starts with '---', it's an error
+    #
+    # Logic:
+    # - If starts with '---' and has more than 1 separator -> multiple resources, error
+    # - If doesn't start with '---' and has 1+ separators -> multiple resources, ok
+    if [ "$starts_with_separator" = true ] && [ "$separator_count" -gt 1 ]; then
+        echo "ERROR: $file starts with '---' but contains multiple Kubernetes resources"
+        echo "       Files with multiple resources should not start with '---'"
+        # We need to signal error but can't use EXIT_CODE in subshell
+        # So we output to a temp file
+        echo "1" > /tmp/yaml_lint_error
+    fi
+done
+
+# Check if any errors were found
+if [ -f /tmp/yaml_lint_error ]; then
+    rm -f /tmp/yaml_lint_error
+    exit 1
+fi
+
+echo "YAML lint passed"
+exit 0
diff --git a/docs/scripts/lint.sh b/docs/scripts/lint.sh
index a46066df8..89035b002 100755
--- a/docs/scripts/lint.sh
+++ b/docs/scripts/lint.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # This script will run a couple of linter on the documentation
 
 set -eu
@@ -6,14 +6,17 @@ set -eu
 # We want to run all linters before returning success (exit 0) or failure (exit 1)
 # So this variable holds the global exit code
 EXIT_CODE=0
-readonly BASE_DIR=/app
+readonly BASE_DIR="${1:-/app}"
+
+# Run YAML linter for Kubernetes multi-resource files
+./docs/scripts/lint-yaml.sh "${BASE_DIR}" || EXIT_CODE=1
 
 echo "== Linting Markdown"
 # Uses the file ".markdownlint.json" for setup
 cd "${BASE_DIR}" || exit 1
 
-LINTER_EXCLUSIONS="$(find "${BASE_DIR}/content" -type f -name '.markdownlint.json')"
-GLOBAL_LINT_OPTIONS="--config ${BASE_DIR}/.markdownlint.json"
+LINTER_EXCLUSIONS="$(find "content" -type f -name '.markdownlint.json')"
+GLOBAL_LINT_OPTIONS="--config .markdownlint.json"
 
 # Lint the specific folders (containing linter specific rulesets)
 for LINTER_EXCLUSION in ${LINTER_EXCLUSIONS}
@@ -24,6 +27,6 @@ do
 done
 
 # Lint all the content, excluding the previously done`
-eval markdownlint "${GLOBAL_LINT_OPTIONS}" "${BASE_DIR}/content/**/*.md" || EXIT_CODE=1
+eval markdownlint "${GLOBAL_LINT_OPTIONS}" "content/**/*.md" || EXIT_CODE=1
 
 exit "${EXIT_CODE}"
diff --git a/go.mod b/go.mod
index 3d00ed55b..d3ceb8d09 100644
--- a/go.mod
+++ b/go.mod
@@ -3,18 +3,18 @@ module github.com/traefik/traefik/v3
 go 1.24.0
 
 require (
-	github.com/BurntSushi/toml v1.5.0
+	github.com/BurntSushi/toml v1.6.0
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/abbot/go-http-auth v0.0.0-00010101000000-000000000000 // No tag on the repo.
 	github.com/andybalholm/brotli v1.1.1
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
-	github.com/aws/aws-sdk-go-v2 v1.39.2
-	github.com/aws/aws-sdk-go-v2/config v1.31.12
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.16
+	github.com/aws/aws-sdk-go-v2 v1.41.0
+	github.com/aws/aws-sdk-go-v2/config v1.32.6
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.6
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.203.1
 	github.com/aws/aws-sdk-go-v2/service/ecs v1.53.15
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.56.13
-	github.com/aws/smithy-go v1.23.0
+	github.com/aws/smithy-go v1.24.0
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/containous/alice v0.0.0-20181107144136-d83ebdd94cbd // No tag on the repo.
 	github.com/coreos/go-systemd/v22 v22.5.0
@@ -23,18 +23,18 @@ require (
 	github.com/docker/go-connections v0.5.0
 	github.com/fatih/structs v1.1.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/go-acme/lego/v4 v4.27.0
+	github.com/go-acme/lego/v4 v4.31.0
 	github.com/go-kit/kit v0.13.0
 	github.com/go-kit/log v0.2.1
 	github.com/golang/protobuf v1.5.4
 	github.com/google/go-github/v28 v28.1.1
 	github.com/gorilla/mux v1.8.1
-	github.com/gorilla/websocket v1.5.3
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 	github.com/hashicorp/consul/api v1.26.1
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-retryablehttp v0.7.8
-	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/go-version v1.8.0
 	github.com/hashicorp/nomad/api v0.0.0-20231213195942-64e3dca9274b // No tag on the repo.
 	github.com/http-wasm/http-wasm-host-go v0.7.0
 	github.com/influxdata/influxdb-client-go/v2 v2.7.0
@@ -46,24 +46,24 @@ require (
 	github.com/kvtools/valkeyrie v1.0.0
 	github.com/kvtools/zookeeper v1.0.2
 	github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f // No tag on the repo.
-	github.com/miekg/dns v1.1.68
+	github.com/miekg/dns v1.1.69
 	github.com/mitchellh/copystructure v1.2.0
 	github.com/mitchellh/hashstructure v1.0.0
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // No tag on the repo.
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pires/go-proxyproto v0.8.1
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // No tag on the repo.
-	github.com/prometheus/client_golang v1.22.0
-	github.com/prometheus/client_model v0.6.1
-	github.com/quic-go/quic-go v0.55.0
+	github.com/prometheus/client_golang v1.23.0
+	github.com/prometheus/client_model v0.6.2
+	github.com/quic-go/quic-go v0.58.0
 	github.com/redis/go-redis/v9 v9.8.0
 	github.com/rs/zerolog v1.33.0
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spiffe/go-spiffe/v2 v2.5.0
+	github.com/spiffe/go-spiffe/v2 v2.6.0
 	github.com/stealthrocket/wasi-go v0.8.0
 	github.com/stealthrocket/wazergo v0.19.1
 	github.com/stretchr/testify v1.11.1
-	github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154 // No tag on the repo.
+	github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807 // No tag on the repo.
 	github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 // No tag on the repo.
 	github.com/testcontainers/testcontainers-go v0.32.0
 	github.com/testcontainers/testcontainers-go/modules/k3s v0.32.0
@@ -95,37 +95,40 @@ require (
 	go.opentelemetry.io/otel/sdk/log v0.14.0
 	go.opentelemetry.io/otel/sdk/metric v1.38.0
 	go.opentelemetry.io/otel/trace v1.38.0
-	golang.org/x/crypto v0.43.0
-	golang.org/x/mod v0.28.0
-	golang.org/x/net v0.46.0
-	golang.org/x/sync v0.17.0
-	golang.org/x/sys v0.37.0
-	golang.org/x/text v0.30.0
+	golang.org/x/crypto v0.46.0
+	golang.org/x/mod v0.31.0
+	golang.org/x/net v0.48.0
+	golang.org/x/sync v0.19.0
+	golang.org/x/sys v0.39.0
+	golang.org/x/text v0.32.0
 	golang.org/x/time v0.14.0
-	golang.org/x/tools v0.37.0
-	google.golang.org/grpc v1.75.1
+	golang.org/x/tools v0.40.0
+	google.golang.org/grpc v1.78.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.32.3
-	k8s.io/apiextensions-apiserver v0.32.3
-	k8s.io/apimachinery v0.32.3
-	k8s.io/client-go v0.32.3
-	k8s.io/utils v0.0.0-20241210054802-24370beab758 // No tag on the repo.
+	k8s.io/api v0.34.3
+	k8s.io/apiextensions-apiserver v0.34.3
+	k8s.io/apimachinery v0.34.3
+	k8s.io/client-go v0.34.3
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // No tag on the repo.
+	knative.dev/networking v0.0.0-20241022012959-60e29ff520dc
+	knative.dev/pkg v0.0.0-20241021183759-9b9d535af5ad
 	mvdan.cc/xurls/v2 v2.5.0
-	sigs.k8s.io/controller-runtime v0.20.4
-	sigs.k8s.io/gateway-api v1.3.0
-	sigs.k8s.io/yaml v1.4.0
+	sigs.k8s.io/controller-runtime v0.22.1
+	sigs.k8s.io/gateway-api v1.4.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.1
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
-	cloud.google.com/go/auth v0.17.0 // indirect
+	cloud.google.com/go/auth v0.18.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/AdamSLevy/jsonrpc2/v14 v14.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.3.0 // indirect
@@ -140,37 +143,38 @@ require (
 	github.com/Azure/go-autorest/autorest/to v0.4.1 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/HdrHistogram/hdrhistogram-go v1.1.2 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.1 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.13.0 // indirect
-	github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87 // indirect
 	github.com/VividCortex/gohistogram v1.0.0 // indirect
 	github.com/akamai/AkamaiOPEN-edgegrid-golang/v11 v11.1.0 // indirect
 	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5 // indirect
 	github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13 // indirect
 	github.com/alibabacloud-go/debug v1.0.1 // indirect
-	github.com/alibabacloud-go/tea v1.3.13 // indirect
+	github.com/alibabacloud-go/tea v1.4.0 // indirect
 	github.com/alibabacloud-go/tea-utils/v2 v2.0.7 // indirect
 	github.com/aliyun/credentials-go v1.4.7 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 // indirect
-	github.com/aziontech/azionapi-go-sdk v0.143.0 // indirect
-	github.com/baidubce/bce-sdk-go v0.9.248 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.62.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
+	github.com/aziontech/azionapi-go-sdk v0.144.0 // indirect
+	github.com/baidubce/bce-sdk-go v0.9.256 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blendle/zapdriver v1.3.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/bytedance/sonic v1.10.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
@@ -191,18 +195,20 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/dnsimple/dnsimple-go/v4 v4.0.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/exoscale/egoscale/v3 v3.1.27 // indirect
+	github.com/exoscale/egoscale/v3 v3.1.33 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/gin-gonic/gin v1.9.1 // indirect
-	github.com/go-acme/alidns-20150109/v4 v4.6.1 // indirect
-	github.com/go-acme/tencentclouddnspod v1.1.10 // indirect
-	github.com/go-acme/tencentedgdeone v1.1.19 // indirect
+	github.com/go-acme/alidns-20150109/v4 v4.7.0 // indirect
+	github.com/go-acme/esa-20240910/v2 v2.44.0 // indirect
+	github.com/go-acme/jdcloud-sdk-go v1.64.0 // indirect
+	github.com/go-acme/tencentclouddnspod v1.1.25 // indirect
+	github.com/go-acme/tencentedgdeone v1.1.48 // indirect
 	github.com/go-errors/errors v1.0.1 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
@@ -210,29 +216,30 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.23.0 // indirect
-	github.com/go-resty/resty/v2 v2.16.5 // indirect
+	github.com/go-resty/resty/v2 v2.17.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-zookeeper/zk v1.0.3 // indirect
-	github.com/goccy/go-yaml v1.11.3 // indirect
-	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
+	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/gophercloud/gophercloud v1.14.1 // indirect
 	github.com/gophercloud/utils v0.0.0-20231010081019-80377eca5d56 // indirect
 	github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf // indirect
@@ -247,12 +254,12 @@ require (
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/hashicorp/serf v0.10.1 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.172 // indirect
+	github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.182 // indirect
 	github.com/iij/doapi v0.0.0-20190504054126-0bbf12d6d7df // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839 // indirect
 	github.com/infobloxopen/infoblox-go-client/v2 v2.10.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
 	github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 // indirect
@@ -262,7 +269,7 @@ require (
 	github.com/labbsr0x/bindman-dns-webhook v1.0.2 // indirect
 	github.com/labbsr0x/goh v1.0.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/linode/linodego v1.60.0 // indirect
+	github.com/linode/linodego v1.64.0 // indirect
 	github.com/liquidweb/liquidweb-cli v0.6.9 // indirect
 	github.com/liquidweb/liquidweb-go v1.6.4 // indirect
 	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
@@ -270,7 +277,7 @@ require (
 	github.com/mailgun/minheap v0.0.0-20170619185613-3dbe6c6bf55f // indirect
 	github.com/mailgun/multibuf v0.1.2 // indirect
 	github.com/mailgun/timetools v0.0.0-20141028012446-7e6055773c51 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mimuret/golang-iij-dpf v0.9.1 // indirect
@@ -293,22 +300,24 @@ require (
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/namedotcom/go/v4 v4.0.2 // indirect
 	github.com/nrdcg/auroradns v1.1.0 // indirect
-	github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea // indirect
-	github.com/nrdcg/desec v0.11.0 // indirect
+	github.com/nrdcg/bunny-go v0.1.0 // indirect
+	github.com/nrdcg/desec v0.11.1 // indirect
 	github.com/nrdcg/dnspod-go v0.4.0 // indirect
 	github.com/nrdcg/freemyip v0.3.0 // indirect
 	github.com/nrdcg/goacmedns v0.2.0 // indirect
-	github.com/nrdcg/goinwx v0.11.0 // indirect
-	github.com/nrdcg/mailinabox v0.2.0 // indirect
+	github.com/nrdcg/goinwx v0.12.0 // indirect
+	github.com/nrdcg/mailinabox v0.3.0 // indirect
 	github.com/nrdcg/namesilo v0.5.0 // indirect
 	github.com/nrdcg/nodion v0.1.0 // indirect
-	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.102.0 // indirect
-	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.102.0 // indirect
+	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 // indirect
+	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 // indirect
 	github.com/nrdcg/porkbun v0.4.0 // indirect
+	github.com/nrdcg/vegadns v0.3.0 // indirect
 	github.com/nzdjb/go-metaname v1.0.0 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/openzipkin/zipkin-go v0.4.3 // indirect
 	github.com/ovh/go-ovh v1.9.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterhellberg/link v1.2.0 // indirect
@@ -316,24 +325,24 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/regfish/regfish-dnsapi-go v0.1.1 // indirect
 	github.com/rs/cors v1.7.0 // indirect
+	github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 // indirect
 	github.com/sacloud/api-client-go v0.3.3 // indirect
 	github.com/sacloud/go-http v0.1.9 // indirect
-	github.com/sacloud/iaas-api-go v1.19.0 // indirect
-	github.com/sacloud/packages-go v0.0.11 // indirect
+	github.com/sacloud/iaas-api-go v1.23.1 // indirect
+	github.com/sacloud/packages-go v0.0.12 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
-	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35 // indirect
+	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 // indirect
 	github.com/selectel/domains-go v1.1.0 // indirect
 	github.com/selectel/go-selvpcclient/v4 v4.1.0 // indirect
 	github.com/shirou/gopsutil/v3 v3.24.4 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9 // indirect
 	github.com/softlayer/softlayer-go v1.2.1 // indirect
 	github.com/softlayer/xmlrpc v0.0.0-20200409220501-5f089df7cb7e // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
@@ -344,7 +353,7 @@ require (
 	github.com/spf13/viper v1.18.2 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.41 // indirect
+	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.28 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
@@ -353,21 +362,21 @@ require (
 	github.com/transip/gotransip/v6 v6.26.1 // indirect
 	github.com/ultradns/ultradns-go-sdk v1.8.1-20250722213956-faef419 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/vinyldns/go-vinyldns v0.9.16 // indirect
-	github.com/volcengine/volc-sdk-golang v1.0.223 // indirect
-	github.com/vultr/govultr/v3 v3.24.0 // indirect
+	github.com/vinyldns/go-vinyldns v0.9.17 // indirect
+	github.com/volcengine/volc-sdk-golang v1.0.233 // indirect
+	github.com/vultr/govultr/v3 v3.26.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/yandex-cloud/go-genproto v0.31.0 // indirect
-	github.com/yandex-cloud/go-sdk/services/dns v0.0.12 // indirect
-	github.com/yandex-cloud/go-sdk/v2 v2.19.0 // indirect
+	github.com/yandex-cloud/go-genproto v0.43.0 // indirect
+	github.com/yandex-cloud/go-sdk/services/dns v0.0.25 // indirect
+	github.com/yandex-cloud/go-sdk/v2 v2.37.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zeebo/errs v1.4.0 // indirect
 	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
 	go.mongodb.org/mongo-driver v1.13.1 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/collector/featuregate v1.41.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/contrib/propagators/aws v1.38.0 // indirect
@@ -379,25 +388,27 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.4.0 // indirect
 	golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect
-	golang.org/x/oauth2 v0.32.0 // indirect
-	golang.org/x/term v0.36.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/api v0.252.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/api v0.259.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/ns1/ns1-go.v2 v2.15.0 // indirect
+	gopkg.in/ns1/ns1-go.v2 v2.16.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3 // indirect
 	nhooyr.io/websocket v1.8.7 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 )
 
 // Containous forks
diff --git a/go.sum b/go.sum
index 01f7b442d..a81ba3393 100644
--- a/go.sum
+++ b/go.sum
@@ -13,8 +13,8 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
-cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
+cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
+cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -37,6 +37,10 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d h1:LblfooH1lKOpp1hIhukktmSAxFkqMPFk9KR6iZ0MJNI=
+contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d/go.mod h1:IshRmMJBhDfFj5Y67nVhMYTTIze91RUeT73ipWKs/GY=
+contrib.go.opencensus.io/exporter/prometheus v0.4.2 h1:sqfsYl5GIY/L570iT+l93ehxaWJs2/OwXtiWwew3oAg=
+contrib.go.opencensus.io/exporter/prometheus v0.4.2/go.mod h1:dvEHbiKmgvbr5pjaF9fpw1KeYcjrnC1J8B+JKjsZyRQ=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -46,10 +50,10 @@ github.com/AdamSLevy/jsonrpc2/v14 v14.1.0 h1:Dy3M9aegiI7d7PF1LUdjbVigJReo+QOceYs
 github.com/AdamSLevy/jsonrpc2/v14 v14.1.0/go.mod h1:ZakZtbCXxCz82NJvq7MoREtiQesnDfrtF6RFUGzQfLo=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 h1:KpMC6LFL7mqpExyMC9jVOYRiVhLmamjeZfRsUpB7l4s=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
@@ -91,11 +95,11 @@ github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUM
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/HdrHistogram/hdrhistogram-go v1.1.0/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
@@ -115,8 +119,6 @@ github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA
 github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
 github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87 h1:xPMsUicZ3iosVPSIP7bW5EcGUzjiiMl1OYTe14y/R24=
-github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87/go.mod h1:iGLljf5n9GjT6kc0HBvyI1nOKnGQbNB66VzSNbK5iks=
 github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
 github.com/Shopify/sarama v1.30.1/go.mod h1:hGgx05L/DiW8XYBXeJdKIN6V2QUy2H6JqME5VT1NLRw=
 github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
@@ -143,7 +145,6 @@ github.com/alibabacloud-go/darabonba-encode-util v0.0.2 h1:1uJGrbsGEVqWcWxrS9MyC
 github.com/alibabacloud-go/darabonba-encode-util v0.0.2/go.mod h1:JiW9higWHYXm7F4PKuMgEUETNZasrDM6vqVr/Can7H8=
 github.com/alibabacloud-go/darabonba-map v0.0.2 h1:qvPnGB4+dJbJIxOOfawxzF3hzMnIpjmafa0qOTp6udc=
 github.com/alibabacloud-go/darabonba-map v0.0.2/go.mod h1:28AJaX8FOE/ym8OUFWga+MtEzBunJwQGceGQlvaPGPc=
-github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.12/go.mod h1:f2wDpbM7hK9SvLIH09zSKVU1TsyemUNOqErMscMMl7c=
 github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13 h1:Q00FU3H94Ts0ZIHDmY+fYGgB7dV9D/YX6FGsgorQPgw=
 github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13/go.mod h1:lxFGfobinVsQ49ntjpgWghXmIF0/Sm4+wvBJ1h5RtaE=
 github.com/alibabacloud-go/darabonba-signature-util v0.0.7 h1:UzCnKvsjPFzApvODDNEYqBHMFt1w98wC7FOo0InLyxg=
@@ -166,9 +167,9 @@ github.com/alibabacloud-go/tea v1.1.11/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/Ke
 github.com/alibabacloud-go/tea v1.1.17/go.mod h1:nXxjm6CIFkBhwW4FQkNrolwbfon8Svy6cujmKFUq98A=
 github.com/alibabacloud-go/tea v1.1.20/go.mod h1:nXxjm6CIFkBhwW4FQkNrolwbfon8Svy6cujmKFUq98A=
 github.com/alibabacloud-go/tea v1.2.2/go.mod h1:CF3vOzEMAG+bR4WOql8gc2G9H3EkH3ZLAQdpmpXMgwk=
-github.com/alibabacloud-go/tea v1.3.12/go.mod h1:A560v/JTQ1n5zklt2BEpurJzZTI8TUT+Psg2drWlxRg=
-github.com/alibabacloud-go/tea v1.3.13 h1:WhGy6LIXaMbBM6VBYcsDCz6K/TPsT1Ri2hPmmZffZ94=
 github.com/alibabacloud-go/tea v1.3.13/go.mod h1:A560v/JTQ1n5zklt2BEpurJzZTI8TUT+Psg2drWlxRg=
+github.com/alibabacloud-go/tea v1.4.0 h1:MSKhu/kWLPX7mplWMngki8nNt+CyUZ+kfkzaR5VpMhA=
+github.com/alibabacloud-go/tea v1.4.0/go.mod h1:A560v/JTQ1n5zklt2BEpurJzZTI8TUT+Psg2drWlxRg=
 github.com/alibabacloud-go/tea-utils v1.3.1/go.mod h1:EI/o33aBfj3hETm4RLiAxF/ThQdSngxrpF8rKUDJjPE=
 github.com/alibabacloud-go/tea-utils/v2 v2.0.5/go.mod h1:dL6vbUT35E4F4bFTHL845eUloqaerYBYPsdWR2/jhe4=
 github.com/alibabacloud-go/tea-utils/v2 v2.0.7 h1:WDx5qW3Xa5ZgJ1c8NfqJkF6w+AU5wB8835UdhPr6Ax0=
@@ -197,48 +198,50 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:W
 github.com/avast/retry-go v3.0.0+incompatible/go.mod h1:XtSnn+n/sHqQIpZ10K1qAevBhOOCWBLXXy3hyiqqBrY=
 github.com/aws/aws-sdk-go v1.40.45/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
 github.com/aws/aws-sdk-go-v2 v1.9.1/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
-github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I=
-github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
-github.com/aws/aws-sdk-go-v2/config v1.31.12 h1:pYM1Qgy0dKZLHX2cXslNacbcEFMkDMl+Bcj5ROuS6p8=
-github.com/aws/aws-sdk-go-v2/config v1.31.12/go.mod h1:/MM0dyD7KSDPR+39p9ZNVKaHDLb9qnfDurvVS2KAhN8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.16 h1:4JHirI4zp958zC026Sm+V4pSDwW4pwLefKrc0bF2lwI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.16/go.mod h1:qQMtGx9OSw7ty1yLclzLxXCRbrkjWAM7JnObZjmCB7I=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 h1:Mv4Bc0mWmv6oDuSWTKnk+wgeqPL5DRFu5bQL9BGPQ8Y=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9/go.mod h1:IKlKfRppK2a1y0gy1yH6zD+yX5uplJ6UuPlgd48dJiQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
+github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2/config v1.32.6 h1:hFLBGUKjmLAekvi1evLi5hVvFQtSo3GYwi+Bx4lpJf8=
+github.com/aws/aws-sdk-go-v2/config v1.32.6/go.mod h1:lcUL/gcd8WyjCrMnxez5OXkO3/rwcNmvfno62tnXNcI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6 h1:F9vWao2TwjV2MyiyVS+duza0NIRtAslgLUM0vTA1ZaE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6/go.mod h1:SgHzKjEVsdQr6Opor0ihgWtkWdfRAIwxYzSJ8O85VHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 h1:80+uETIWS1BqjnN9uJ0dBUaETh+P1XwFy5vwHwK5r9k=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16/go.mod h1:wOOsYuxYuB/7FlnVtzeBYRcjSRtQpAW0hCP7tIULMwo=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.8.1/go.mod h1:CM+19rL1+4dFWnOQKwDc7H1KwXTz+h61oUSHyhV0b3o=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.203.1 h1:ZgY9zeVAe+54Qa7o1GXKRNTez79lffCeJSSinhl+qec=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.203.1/go.mod h1:0naMk66LtdeTmE+1CWQTKwtzOQ2t8mavOhMhR0Pv1m0=
 github.com/aws/aws-sdk-go-v2/service/ecs v1.53.15 h1:uH0DMwDjLGgjjYMk3M1MXHggk37trTiJIvwyJNP17Ig=
 github.com/aws/aws-sdk-go-v2/service/ecs v1.53.15/go.mod h1:49tE5yYdlAHqZIO8u5+u9Xy9k8IaV0v5cstZrjnX5+c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.0 h1:JOLRYFWMMKUABCp94HHfo0JBVQDVTLXOvWWphjpBBiQ=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.0/go.mod h1:WEOSRNyfIfvgrD9MuSIGrogKyuFahaVMziVq1pHI0NQ=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4 h1:KycXrohD5OxAZ5h02YechO2gevvoHfAPAaJM5l8zqb0=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4/go.mod h1:xNLZLn4SusktBQ5moqUOgiDKGz3a7vHwF4W0KD+WBPc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.10 h1:MQuZZ6Tq1qQabPlkVxrCMdyVl70Ogl4AERZKo+y9Wzo=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.50.10/go.mod h1:U5C3JME1ibKESmpzBAqlRpTYZfVbTqrb5ICJm+sVVd8=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.62.0 h1:80pDB3Tpmb2RCSZORrK9/3iQxsd+w6vSzVqpT1FGiwE=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.62.0/go.mod h1:6EZUGGNLPLh5Unt30uEoA+KQcByERfXIkax9qrc80nA=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 h1:HpI7aMmJ+mm1wkSHIA2t5EaFFv5EFYXePW30p1EIrbQ=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4/go.mod h1:C5RdGMYGlfM0gYq/tifqgn4EbyX99V15P2V3R+VHbQU=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.56.13 h1:JfPeW7F6Y+VqBg6p+8zQv4wlgceguYu5ZT0USEGZ89g=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.56.13/go.mod h1:EonGQFn66wZkJJrrKXrryrxoS3V30rcHvaWvc6oGHCI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 h1:A1oRkiSQOWstGh61y4Wc/yQ04sqrQZr1Si/oAXj20/s=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.6/go.mod h1:5PfYspyCU5Vw1wNPsxi15LZovOnULudOQuVxphSflQA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 h1:5fm5RTONng73/QA73LhCNR7UT9RpFH3hR6HWL6bIgVY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1/go.mod h1:xBEjWD13h+6nq+z4AkqSfSvqRKFgDIQeaMguAJndOWo=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 h1:p3jIvqYwUZgu/XYeI48bJxOhvm47hZb5HUQ0tn6Q9kA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.6/go.mod h1:WtKK+ppze5yKPkZ0XwqIVWD4beCwv056ZbPQNoeHqM8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 h1:aM/Q24rIlS3bRAhTyFurowU8A0SMyGDtEOY/l/s/1Uw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8/go.mod h1:+fWt2UHSb4kS7Pu8y+BMBvJF0EWx+4H0hzNwtDNRTrg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 h1:AHDr0DaHIAo8c9t1emrzAlVDFp+iMMKnPdYy6XO4MCE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12/go.mod h1:GQ73XawFFiWxyWXMHWfhiomvP3tXtdNar/fi8z18sx0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
 github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
-github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
-github.com/aziontech/azionapi-go-sdk v0.143.0 h1:4eEBlYT10prgeCVTNR9FIc7f59Crbl2zrH1a4D1BUqU=
-github.com/aziontech/azionapi-go-sdk v0.143.0/go.mod h1:cA5DY/VP4X5Eu11LpQNzNn83ziKjja7QVMIl4J45feA=
-github.com/baidubce/bce-sdk-go v0.9.248 h1:vB5OMuEC2xnO197M6OWUi24C8mYOZHKXT/8HuKQJUhU=
-github.com/baidubce/bce-sdk-go v0.9.248/go.mod h1:zbYJMQwE4IZuyrJiFO8tO8NbtYiKTFTbwh4eIsqjVdg=
+github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
+github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aziontech/azionapi-go-sdk v0.144.0 h1:T+/w18o+FCiZsk3Z0ACBVVe7c/5EGLG15S3P8JfuPfo=
+github.com/aziontech/azionapi-go-sdk v0.144.0/go.mod h1:OKxP/R0iVXnJJakYwMhh2BGAXnud8Ruy55Ak9ANuWoU=
+github.com/baidubce/bce-sdk-go v0.9.256 h1:/6UwBzDp+dRFpKRIb5WsvxfSiG4SLOIOghvagOK/q4Y=
+github.com/baidubce/bce-sdk-go v0.9.256/go.mod h1:zbYJMQwE4IZuyrJiFO8tO8NbtYiKTFTbwh4eIsqjVdg=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -248,6 +251,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/blendle/zapdriver v1.3.1 h1:C3dydBOWYRiOk+B8X9IVZ5IOe+7cl+tGOexN4QqHfpE=
+github.com/blendle/zapdriver v1.3.1/go.mod h1:mdXfREi6u5MArG4j9fewC+FGnXaBR+T4Ox4J2u4eHCc=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -267,6 +272,8 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
+github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -363,8 +370,8 @@ github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFP
 github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/eknkc/amber v0.0.0-20171010120322-cdade1c07385 h1:clC1lXBpe2kTj2VHdaIu9ajZQe4kcEY9j0NsnDDBZ3o=
 github.com/eknkc/amber v0.0.0-20171010120322-cdade1c07385/go.mod h1:0vRUJqYpeSZifjYj7uP3BG/gKcuzL9xWVV/Y+cK33KM=
-github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk=
-github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -372,10 +379,12 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
+github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
-github.com/exoscale/egoscale/v3 v3.1.27 h1:vKdWZG8QFDc7rY7lCfcuudO+ovyp5psYjFwKVqmkhCE=
-github.com/exoscale/egoscale/v3 v3.1.27/go.mod h1:0iY8OxgHJCS5TKqDNhwOW95JBKCnBZl3YGU4Yt+NqkU=
+github.com/exoscale/egoscale/v3 v3.1.33 h1:5Lk/pwZ+K0sjNu9obS0VYPfhZQffRkvvO0BpdPoir4o=
+github.com/exoscale/egoscale/v3 v3.1.33/go.mod h1:0iY8OxgHJCS5TKqDNhwOW95JBKCnBZl3YGU4Yt+NqkU=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
@@ -399,8 +408,8 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/getkin/kin-openapi v0.61.0/go.mod h1:7Yn5whZr5kJi6t+kShccXS8ae1APpYTW6yheSwk8Yi4=
@@ -413,14 +422,18 @@ github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwv
 github.com/gin-gonic/gin v1.7.4/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
 github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
-github.com/go-acme/alidns-20150109/v4 v4.6.1 h1:Dch3aWRcw4U62+jKPjPQN3iW3TPvgIywATbvHzojXeo=
-github.com/go-acme/alidns-20150109/v4 v4.6.1/go.mod h1:RBcqBA5IvUWtlpjx6dC6EkPVyBNLQ+mR18XoaP38BFY=
-github.com/go-acme/lego/v4 v4.27.0 h1:cIhWd7Uj4BNFLEF3IpwuMkukVVRs5qjlp4KdUGa75yU=
-github.com/go-acme/lego/v4 v4.27.0/go.mod h1:9FfNZHZmg6hf5CWOp4Lzo4gU8aBEvqZvrwdkBboa+4g=
-github.com/go-acme/tencentclouddnspod v1.1.10 h1:ERVJ4mc3cT4Nb3+n6H/c1AwZnChGBqLoymE0NVYscKI=
-github.com/go-acme/tencentclouddnspod v1.1.10/go.mod h1:Bo/0YQJ/99FM+44HmCQkByuptX1tJsJ9V14MGV/2Qco=
-github.com/go-acme/tencentedgdeone v1.1.19 h1:1jdEpMITrDuXHnu7QLOy2hpLW0BlDof70/KuRT+EiTo=
-github.com/go-acme/tencentedgdeone v1.1.19/go.mod h1:gpu7HvXfcKWBrq5HAEBowZNkdk7JFPkagRzC/infUY0=
+github.com/go-acme/alidns-20150109/v4 v4.7.0 h1:PqJ/wR0JTpL4v0Owu1uM7bPQ1Yww0eQLAuuSdLjjQaQ=
+github.com/go-acme/alidns-20150109/v4 v4.7.0/go.mod h1:btQvB6xZoN6ykKB74cPhiR+uvhrEE2AFVXm6RDmCHm0=
+github.com/go-acme/esa-20240910/v2 v2.44.0 h1:ACi2uFb7ig4ousFs/YiFBR+aw3A4SHtOxvkMWB2Hbcs=
+github.com/go-acme/esa-20240910/v2 v2.44.0/go.mod h1:ZYdN9EN9ikn26SNapxCVjZ65pHT/1qm4fzuJ7QGVX6g=
+github.com/go-acme/jdcloud-sdk-go v1.64.0 h1:AW9j5khk8tRYbpBJPxKmqdwIqgLs2Fz3HUK3hn2YXjs=
+github.com/go-acme/jdcloud-sdk-go v1.64.0/go.mod h1:qc/m8HNX1Zgd7GAv2DSEinup8fwy3Ted3/VVx7LB5bU=
+github.com/go-acme/lego/v4 v4.31.0 h1:gd4oUYdfs83PR1/SflkNdit9xY1iul2I4EystnU8NXM=
+github.com/go-acme/lego/v4 v4.31.0/go.mod h1:m6zcfX/zcbMYDa8s6AnCMnoORWNP8Epnei+6NBCTUGs=
+github.com/go-acme/tencentclouddnspod v1.1.25 h1:7H3ZKshkaHzCXfRpAHVB5nvxeDDl2XLeNZfrNHiZj/s=
+github.com/go-acme/tencentclouddnspod v1.1.25/go.mod h1:XXfzp0AYV7UAUsHKT6R0KAUJFhqAUXmWGF07Elpa5cE=
+github.com/go-acme/tencentedgdeone v1.1.48 h1:WLyLBsRVhSLFmtbEFXk0naLODSQn7X6J0Fc/qR8xVUk=
+github.com/go-acme/tencentedgdeone v1.1.48/go.mod h1:mu6tA+bPhlSd+CKUfzRikE0mfxmTlBI6dVTn9LY9dRI=
 github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs=
 github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW4s=
 github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w=
@@ -454,13 +467,13 @@ github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
@@ -479,11 +492,11 @@ github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn
 github.com/go-playground/validator/v10 v10.9.0/go.mod h1:74x4gJWsvQexRdW8Pn3dXSGrTK4nAUsbPlLADvpJkos=
 github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
 github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
-github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
-github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
+github.com/go-resty/resty/v2 v2.17.1 h1:x3aMpHK1YM9e4va/TMDRlusDDoZiQ+ViDu/WpA6xTM4=
+github.com/go-resty/resty/v2 v2.17.1/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
@@ -503,11 +516,13 @@ github.com/goccy/go-json v0.7.8/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGF
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-yaml v1.9.8/go.mod h1:JubOolP3gh0HpiBc4BLRD4YmjEjHAmIIB2aaXKkTfoE=
-github.com/goccy/go-yaml v1.11.3 h1:B3W9IdWbvrUu2OYQGwvU1nZtvMQJPBKgBUuweJjLj6I=
-github.com/goccy/go-yaml v1.11.3/go.mod h1:wKnAMd44+9JAAnGQpWVEgBzGt3YuTaQ4uXoHvE4m7WU=
+github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
-github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -526,6 +541,7 @@ github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4er
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -561,8 +577,8 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -584,11 +600,10 @@ github.com/google/go-github/v28 v28.1.1 h1:kORf5ekX5qwXO2mGzXXOjMe/g6ap8ahVe0sBE
 github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM=
 github.com/google/go-github/v32 v32.1.0/go.mod h1:rIEpZD9CTDQwDK9GDrtMTycQNA4JU3qBsCizh3q2WCI=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
@@ -609,12 +624,12 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
-github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
-github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
+github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gophercloud/gophercloud v1.3.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
 github.com/gophercloud/gophercloud v1.14.1 h1:DTCNaTVGl8/cFu58O1JwWgis9gtISAFONqpMKNg/Vpw=
 github.com/gophercloud/gophercloud v1.14.1/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
@@ -627,8 +642,8 @@ github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
-github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf h1:C1GPyPJrOlJlIrcaBBiBpDsqZena2Ks8spa5xZqr1XQ=
 github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf/go.mod h1:zXqxTI6jXDdKnlf8s+nT+3c8LrwUEy3yNpO4XJL90lA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
@@ -683,8 +698,8 @@ github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
-github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
+github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
@@ -714,8 +729,8 @@ github.com/http-wasm/http-wasm-host-go v0.7.0/go.mod h1:adXKcLmL7yuavH/e0kBAp7b3
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.172 h1:68VUVbLKwBxPh8tjCXwnLO/d8/thdZ+ExpxdFMEdK5A=
-github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.172/go.mod h1:M+yna96Fx9o5GbIUnF3OvVvQGjgfVSyeJbV9Yb1z/wI=
+github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.182 h1:B3W9acgpqu5XsN8v+W8SOTfqn/6n4JsjgoKBsm30HFY=
+github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.182/go.mod h1:M+yna96Fx9o5GbIUnF3OvVvQGjgfVSyeJbV9Yb1z/wI=
 github.com/hudl/fargo v1.4.0/go.mod h1:9Ai6uvFy5fQNq6VPKtg+Ceq1+eTY4nKUlR2JElEOcDo=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
@@ -748,8 +763,8 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
-github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -830,8 +845,8 @@ github.com/lestrrat-go/httpcc v1.0.0/go.mod h1:tGS/u00Vh5N6FHNkExqGGNId8e0Big+++
 github.com/lestrrat-go/iter v1.0.1/go.mod h1:zIdgO1mRKhn8l9vrZJZz9TUMMFbQbLeTsbqPDrJ/OJc=
 github.com/lestrrat-go/jwx v1.2.7/go.mod h1:bw24IXWbavc0R2RsOtpXL7RtMyP589yZ1+L7kd09ZGA=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
-github.com/linode/linodego v1.60.0 h1:SgsebJFRCi+lSmYy+C40wmKZeJllGGm+W12Qw4+yVdI=
-github.com/linode/linodego v1.60.0/go.mod h1:1+Bt0oTz5rBnDOJbGhccxn7LYVytXTIIfAy7QYmijDs=
+github.com/linode/linodego v1.64.0 h1:If6pULIwHuQytgogtpQaBdVLX7z2TTHUF5u1tj2TPiY=
+github.com/linode/linodego v1.64.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
 github.com/liquidweb/go-lwApi v0.0.0-20190605172801-52a4864d2738/go.mod h1:0sYF9rMXb0vlG+4SzdiGMXHheCZxjguMq+Zb4S2BfBs=
 github.com/liquidweb/liquidweb-cli v0.6.9 h1:acbIvdRauiwbxIsOCEMXGwF75aSJDbDiyAWPjVnwoYM=
 github.com/liquidweb/liquidweb-cli v0.6.9/go.mod h1:cE1uvQ+x24NGUL75D0QagOFCG8Wdvmwu8aL9TLmA/eQ=
@@ -852,8 +867,8 @@ github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f h1:ZZYhg16XocqSKPGN
 github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f/go.mod h1:8heskWJ5c0v5J9WH89ADhyal1DOZcayll8fSbhB+/9A=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
@@ -889,8 +904,8 @@ github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKju
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
 github.com/miekg/dns v1.1.47/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
-github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
-github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
+github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
 github.com/mimuret/golang-iij-dpf v0.9.1 h1:Gj6EhHJkOhr+q2RnvRPJsPMcjuVnWPSccEHyoEehU34=
 github.com/mimuret/golang-iij-dpf v0.9.1/go.mod h1:sl9KyOkESib9+KRD3HaGpgi1xk7eoN2+d96LCLsME2M=
 github.com/minio/highwayhash v1.0.1/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
@@ -969,30 +984,32 @@ github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OS
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nrdcg/auroradns v1.1.0 h1:KekGh8kmf2MNwqZVVYo/fw/ZONt8QMEmbMFOeljteWo=
 github.com/nrdcg/auroradns v1.1.0/go.mod h1:O7tViUZbAcnykVnrGkXzIJTHoQCHcgalgAe6X1mzHfk=
-github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea h1:OSgRS4kqOs/WuxuFOObP2gwrenL4/qiKXQbQugr/Two=
-github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea/go.mod h1:IDRRngAngb2eTEaWgpO0hukQFI/vJId46fT1KErMytA=
-github.com/nrdcg/desec v0.11.0 h1:XZVHy07sg12y8FozMp+l7XvzPsdzog0AYXuQMaHBsfs=
-github.com/nrdcg/desec v0.11.0/go.mod h1:5+4vyhMRTs49V9CNoODF/HwT8Mwxv9DJ6j+7NekUnBs=
+github.com/nrdcg/bunny-go v0.1.0 h1:GAHTRpHaG/TxfLZlqoJ8OJFzw8rI74+jOTkzxWh0uHA=
+github.com/nrdcg/bunny-go v0.1.0/go.mod h1:u+C9dgsspgtWVaAz6QkyV17s9fxD8viwwKoxb9XMz1A=
+github.com/nrdcg/desec v0.11.1 h1:ilpKmCr4gGsLcyq3RHfHNmlRzm9fzT2XbWxoVaUCS0s=
+github.com/nrdcg/desec v0.11.1/go.mod h1:2LuxHlOcwML/7cntu0eimONmA1U+ZxFDAonoSXr4igQ=
 github.com/nrdcg/dnspod-go v0.4.0 h1:c/jn1mLZNKF3/osJ6mz3QPxTudvPArXTjpkmYj0uK6U=
 github.com/nrdcg/dnspod-go v0.4.0/go.mod h1:vZSoFSFeQVm2gWLMkyX61LZ8HI3BaqtHZWgPTGKr6KQ=
 github.com/nrdcg/freemyip v0.3.0 h1:0D2rXgvLwe2RRaVIjyUcQ4S26+cIS2iFwnhzDsEuuwc=
 github.com/nrdcg/freemyip v0.3.0/go.mod h1:c1PscDvA0ukBF0dwelU/IwOakNKnVxetpAQ863RMJoM=
 github.com/nrdcg/goacmedns v0.2.0 h1:ADMbThobzEMnr6kg2ohs4KGa3LFqmgiBA22/6jUWJR0=
 github.com/nrdcg/goacmedns v0.2.0/go.mod h1:T5o6+xvSLrQpugmwHvrSNkzWht0UGAwj2ACBMhh73Cg=
-github.com/nrdcg/goinwx v0.11.0 h1:GER0SE3POub7rxARt3Y3jRy1OON1hwF1LRxHz5xsFBw=
-github.com/nrdcg/goinwx v0.11.0/go.mod h1:0BXSC0FxVtU4aTjX0Zw3x0DK32tjugLzeNIAGtwXvPQ=
-github.com/nrdcg/mailinabox v0.2.0 h1:IKq8mfKiVwNW2hQii/ng1dJ4yYMMv3HAP3fMFIq2CFk=
-github.com/nrdcg/mailinabox v0.2.0/go.mod h1:0yxqeYOiGyxAu7Sb94eMxHPIOsPYXAjTeA9ZhePhGnc=
+github.com/nrdcg/goinwx v0.12.0 h1:ujdUqDBnaRSFwzVnImvPHYw3w3m9XgmGImNUw1GyMb4=
+github.com/nrdcg/goinwx v0.12.0/go.mod h1:IrVKd3ZDbFiMjdPgML4CSxZAY9wOoqLvH44zv3NodJ0=
+github.com/nrdcg/mailinabox v0.3.0 h1:PHkC1elKXKAjEvdx2HHFMgcEGZFqudAl7aU3L2JDhM4=
+github.com/nrdcg/mailinabox v0.3.0/go.mod h1:1eFIGcM4lI+AfFOUpbs548SFGz1ZWoMOGbECBmkghw4=
 github.com/nrdcg/namesilo v0.5.0 h1:6QNxT/XxE+f5B+7QlfWorthNzOzcGlBLRQxqi6YeBrE=
 github.com/nrdcg/namesilo v0.5.0/go.mod h1:4UkwlwQfDt74kSGmhLaDylnBrD94IfflnpoEaj6T2qw=
 github.com/nrdcg/nodion v0.1.0 h1:zLKaqTn2X0aDuBHHfyA1zFgeZfiCpmu/O9DM73okavw=
 github.com/nrdcg/nodion v0.1.0/go.mod h1:inbuh3neCtIWlMPZHtEpe43TmRXxHV6+hk97iCZicms=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.102.0 h1:W28ZizQSS2aRWkFA3iAP9eiZS4OLFaiv35nXtq2lW/s=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.102.0/go.mod h1:cVbzGjRhtXgrduaQbR1GR1x+VDU60NcXPMZ3+eQuiiY=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.102.0 h1:gAOs1dkE7LFoWflzqrDqAhOprc0kF1a0fyV8C4HUPj4=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.102.0/go.mod h1:EUBSYwop1K40VpcKy1haIK6kFK/gPT1atEk89OkY0Kg=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 h1:l0tH15ACQADZAzC+LZ+mo2tIX4H6uZu0ulrVmG5Tqz0=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 h1:gzB4c6ztb38C/jYiqEaFC+mCGcWFHDji9e6jwymY9d4=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2/go.mod h1:l1qIPIq2uRV5WTSvkbhbl/ndbeOu7OCb3UZ+0+2ZSb8=
 github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
 github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
+github.com/nrdcg/vegadns v0.3.0 h1:11FQMw7xVIRUWO9o5+Z/5YZhmPWlm4oxUUH3F6EVqQU=
+github.com/nrdcg/vegadns v0.3.0/go.mod h1:NqSyRKZuJlAsv8VI/7rSubfPXN68NwaJ0aG9KxQVFVo=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
@@ -1025,6 +1042,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/openzipkin/zipkin-go v0.2.5/go.mod h1:KpXfKdgRDnnhsxw4pNIH9Md5lyFqKUa4YDFlwRYAMyE=
+github.com/openzipkin/zipkin-go v0.4.3 h1:9EGwpqkgnwdEIJ+Od7QVSEIH+ocmm5nPat0G7sjsSdg=
+github.com/openzipkin/zipkin-go v0.4.3/go.mod h1:M9wCJZFWCo2RiY+o1eBCEMe0Dp2S5LDHcMZmk3RmK7c=
 github.com/ovh/go-ovh v1.9.0 h1:6K8VoL3BYjVV3In9tPJUdT7qMx9h0GExN9EXx1r2kKE=
 github.com/ovh/go-ovh v1.9.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -1070,14 +1089,14 @@ github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQ
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -1086,8 +1105,8 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
 github.com/prometheus/common v0.30.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -1096,13 +1115,15 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
+github.com/prometheus/statsd_exporter v0.22.7 h1:7Pji/i2GuhK6Lu7DHrtTkFmNBCudCPT1pX2CziuyQR0=
+github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
-github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
+github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.8.0 h1:q3nRvjrlge/6UD7eTu/DSg2uYiU2mCL0G/uzBWqhicI=
@@ -1118,6 +1139,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.7.0 h1:+88SsELBHx5r+hZ8TCkggzSstaWNbDvThkVK8H6f9ik=
 github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
+github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 h1:18kd+8ZUlt/ARXhljq+14TwAoKa61q6dX8jtwOf6DH8=
+github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529/go.mod h1:qe5TWALJ8/a1Lqznoc5BDHpYX/8HU60Hm2AwRmqzxqA=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
 github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
@@ -1127,16 +1150,16 @@ github.com/sacloud/api-client-go v0.3.3 h1:ZpSAyGpITA8UFO3Hq4qMHZLGuNI1FgxAxo4sq
 github.com/sacloud/api-client-go v0.3.3/go.mod h1:0p3ukcWYXRCc2AUWTl1aA+3sXLvurvvDqhRaLZRLBwo=
 github.com/sacloud/go-http v0.1.9 h1:Xa5PY8/pb7XWhwG9nAeXSrYXPbtfBWqawgzxD5co3VE=
 github.com/sacloud/go-http v0.1.9/go.mod h1:DpDG+MSyxYaBwPJ7l3aKLMzwYdTVtC5Bo63HActcgoE=
-github.com/sacloud/iaas-api-go v1.19.0 h1:Bw4uygqukcvlblhWrITp94nikXqy2fnKoAC6929LkIA=
-github.com/sacloud/iaas-api-go v1.19.0/go.mod h1:XV995RM1I7k5AHb7UZrCVyDF/8bZXDxa+uk1EXoj/Zs=
-github.com/sacloud/packages-go v0.0.11 h1:hrRWLmfPM9w7GBs6xb5/ue6pEMl8t1UuDKyR/KfteHo=
-github.com/sacloud/packages-go v0.0.11/go.mod h1:XNF5MCTWcHo9NiqWnYctVbASSSZR3ZOmmQORIzcurJ8=
+github.com/sacloud/iaas-api-go v1.23.1 h1:rjYG0vVoxWyETiwc7R8YdD7CIzs9vVNEOzu7w6dgGzc=
+github.com/sacloud/iaas-api-go v1.23.1/go.mod h1:EGIHOWRB9azOv7HPCVM8WpOEl28WIV9TNRbnEVg+Q3U=
+github.com/sacloud/packages-go v0.0.12 h1:MKeZNN3FQn1heqUSRBrbZw89YusZA1n4kammjMFZYvQ=
+github.com/sacloud/packages-go v0.0.12/go.mod h1:XNF5MCTWcHo9NiqWnYctVbASSSZR3ZOmmQORIzcurJ8=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
 github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
 github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35 h1:8xfn1RzeI9yoCUuEwDy08F+No6PcKZGEDOQ6hrRyLts=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35/go.mod h1:47B1d/YXmSAxlJxUJxClzHR6b3T4M1WyCvwENPQNBWc=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/segmentio/fasthash v1.0.3 h1:EI9+KE1EwvMLBWwjpRDc+fEM+prwxDYbslddQGtrmhM=
@@ -1164,13 +1187,8 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/assertions v1.1.0 h1:MkTeG1DMwsrdH7QtLXy5W+fUxWq+vmb6cLmyJ7aRtF0=
 github.com/smartystreets/assertions v1.1.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
-github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9 h1:hp2CYQUINdZMHdvTdXtPOY2ainKl4IoMcpAXEf2xj3Q=
-github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/smartystreets/gunit v1.0.4 h1:tpTjnuH7MLlqhoD21vRoMZbMIi5GmBsAJDFyF67GhZA=
-github.com/smartystreets/gunit v1.0.4/go.mod h1:EH5qMBab2UclzXUcpR8b93eHsIlp9u+pDQIRp5DZNzQ=
 github.com/softlayer/softlayer-go v1.2.1 h1:8ucHxn5laVsVPb0/aMGnr6tOMt1I9BgEtU5mn70OGKw=
 github.com/softlayer/softlayer-go v1.2.1/go.mod h1:Gz9/ktcmB7Z8EJlu+QEJJpkv8lAmnhYdB9Tc6gedjmo=
 github.com/softlayer/xmlrpc v0.0.0-20200409220501-5f089df7cb7e h1:3OgWYFw7jxCZPcvAg+4R8A50GZ+CCkARF10lxu2qDsQ=
@@ -1201,8 +1219,8 @@ github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5q
 github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
 github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
 github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
-github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
-github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
+github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
+github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
 github.com/stealthrocket/wasi-go v0.8.0 h1:Hwnv3CUoMhhRyero9vt1vfwaYa9tu/Z5kmCW4WeAmVI=
 github.com/stealthrocket/wasi-go v0.8.0/go.mod h1:PJ5oVs2E1ciOJnsTnav4nvTtEcJ4D1jUZAewS9pzuZg=
 github.com/stealthrocket/wazergo v0.19.1 h1:BPrITETPgSFwiytwmToO0MbUC/+RGC39JScz1JmmG6c=
@@ -1232,17 +1250,17 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154 h1:XGopsea1Dw7ecQ8JscCNQXDGYAKDiWjDeXnpN/+BY9g=
-github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
+github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807 h1:LUsDduamlucuNnWcaTbXQ6aLILFcLXADpOzeEH3U+OI=
+github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 h1:8rUlviSVOEe7TMk7W0gIPrW8MqEzYfZHpsNWSf8s2vg=
 github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.10/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.19/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.41 h1:XQDGrLX6v4McMP+2myhgQcy5JaPqSgwpLM1qa7ngUII=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.41/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.25/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.48/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.28 h1:Rj1WXXNPm9AsPf0PJhWCvlsqfcKPUYdyVnkmEc3O8sI=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.28/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/testcontainers/testcontainers-go v0.32.0 h1:ug1aK08L3gCHdhknlTTwWjPHPS+/alvLJU/DRxTD/ME=
 github.com/testcontainers/testcontainers-go v0.32.0/go.mod h1:CRHrzHLQhlXUsa5gXjTOfqIEJcrK5+xMDmBr/WMI88E=
 github.com/testcontainers/testcontainers-go/modules/k3s v0.32.0 h1:Z3DTMveNUqeGJZ+CXZhpvI7OF1BS71Ywi3SwoXLZ4Lc=
@@ -1299,16 +1317,16 @@ github.com/valyala/fasthttp v1.58.0 h1:GGB2dWxSbEprU9j0iMJHgdKYJVDyjrOwF9RE59PbR
 github.com/valyala/fasthttp v1.58.0/go.mod h1:SYXvHHaFp7QZHGKSHmoMipInhrI5StHrhDTYVEjK/Kw=
 github.com/valyala/fasttemplate v1.0.1/go.mod h1:UQGH1tvbgY+Nz5t2n7tXsz52dQxojPUpymEIMZ47gx8=
 github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
-github.com/vinyldns/go-vinyldns v0.9.16 h1:GZJStDkcCk1F1AcRc64LuuMh+ENL8pHA0CVd4ulRMcQ=
-github.com/vinyldns/go-vinyldns v0.9.16/go.mod h1:5qIJOdmzAnatKjurI+Tl4uTus7GJKJxb+zitufjHs3Q=
-github.com/volcengine/volc-sdk-golang v1.0.223 h1:1EEK6VOUaA2Tu0VBD4VC5iSTTFag+KuNo+Vix469Tz4=
-github.com/volcengine/volc-sdk-golang v1.0.223/go.mod h1:zHJlaqiMbIB+0mcrsZPTwOb3FB7S/0MCfqlnO8R7hlM=
+github.com/vinyldns/go-vinyldns v0.9.17 h1:hfPZfCaxcRBX6Gsgl42rLCeoal58/BH8kkvJShzjjdI=
+github.com/vinyldns/go-vinyldns v0.9.17/go.mod h1:pwWhE9K/leGDOIduVhRGvQ3ecVMHWRfEnKYUTEU3gB4=
+github.com/volcengine/volc-sdk-golang v1.0.233 h1:Hh2pzwu/Wq19rsZgNo3HdpjQB28D/F0+m6EjLVggmhM=
+github.com/volcengine/volc-sdk-golang v1.0.233/go.mod h1:zHJlaqiMbIB+0mcrsZPTwOb3FB7S/0MCfqlnO8R7hlM=
 github.com/vulcand/oxy/v2 v2.0.3 h1:CPWVPfW4hVZXzwwiQzpFidbnJKpahjPHezM+7TkZRNw=
 github.com/vulcand/oxy/v2 v2.0.3/go.mod h1:k3t+xjyqmXVh88FdFDbYmUKMEvNpaejvBW14es6H70A=
 github.com/vulcand/predicate v1.2.0 h1:uFsW1gcnnR7R+QTID+FVcs0sSYlIGntoGOTb3rQJt50=
 github.com/vulcand/predicate v1.2.0/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
-github.com/vultr/govultr/v3 v3.24.0 h1:fTTTj0VBve+Miy+wGhlb90M2NMDfpGFi6Frlj3HVy6M=
-github.com/vultr/govultr/v3 v3.24.0/go.mod h1:9WwnWGCKnwDlNjHjtt+j+nP+0QWq6hQXzaHgddqrLWY=
+github.com/vultr/govultr/v3 v3.26.1 h1:G/M0rMQKwVSmL+gb0UgETbW5mcQi0Vf/o/ZSGdBCxJw=
+github.com/vultr/govultr/v3 v3.26.1/go.mod h1:9WwnWGCKnwDlNjHjtt+j+nP+0QWq6hQXzaHgddqrLWY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
@@ -1319,12 +1337,12 @@ github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gi
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yandex-cloud/go-genproto v0.31.0 h1:mFMS5SD1Lt8qErwefR8ChK3d0jg0tvbDLq57IqenpTg=
-github.com/yandex-cloud/go-genproto v0.31.0/go.mod h1:0LDD/IZLIUIV4iPH+YcF+jysO3jkSvADFGm4dCAuwQo=
-github.com/yandex-cloud/go-sdk/services/dns v0.0.12 h1:c5TNaX7r3DqY37YJFbr7HyQFRcSe1WzCbR81LVwxXyk=
-github.com/yandex-cloud/go-sdk/services/dns v0.0.12/go.mod h1:6CRtIkxq6iTSZIOT42EFns54CEr35ncECy4ix9lXUd4=
-github.com/yandex-cloud/go-sdk/v2 v2.19.0 h1:Cuzjn6kkOD/KrBF/QyDbKS7b5GAu8fC2ZUjdBjit60A=
-github.com/yandex-cloud/go-sdk/v2 v2.19.0/go.mod h1:4SwghU8RB4v2OQzhESgq5SF8XmCXIP80WhgrrNpetJ8=
+github.com/yandex-cloud/go-genproto v0.43.0 h1:HjBesEmCN8ZOhjjh8gs605vvi9/MBJAW3P20OJ4iQnw=
+github.com/yandex-cloud/go-genproto v0.43.0/go.mod h1:0LDD/IZLIUIV4iPH+YcF+jysO3jkSvADFGm4dCAuwQo=
+github.com/yandex-cloud/go-sdk/services/dns v0.0.25 h1:BcGEuOnwq2X3LS2kvFC6BOdZkOq4Lc7XAYvzap/SJJY=
+github.com/yandex-cloud/go-sdk/services/dns v0.0.25/go.mod h1:B4QHijALUHIjRxL3aqmOwDrHYUI2XdeeG4WKItth3jI=
+github.com/yandex-cloud/go-sdk/v2 v2.37.0 h1:WvttW6p9xcWag9j+GQv+GJXPggggXGwOlIJNfkWmFWw=
+github.com/yandex-cloud/go-sdk/v2 v2.37.0/go.mod h1:Dt4a81enjRsm4xMJyW5E1Y/vaUYwXJvUGRdDLuM2k6I=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
@@ -1339,8 +1357,6 @@ github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
-github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/api/v3 v3.6.4 h1:7F6N7toCKcV72QmoUKa23yYLiiljMrT4xCeBL9BmXdo=
@@ -1360,8 +1376,10 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/collector/featuregate v1.41.0 h1:CL4UMsMQj35nMJC3/jUu8VvYB4MHirbAX4B0Z/fCVLY=
 go.opentelemetry.io/collector/featuregate v1.41.0/go.mod h1:A72x92glpH3zxekaUybml1vMSv94BH6jQRn5+/htcjw=
 go.opentelemetry.io/collector/pdata v1.41.0 h1:2zurAaY0FkURbLa1x7f7ag6HaNZYZKSmI4wgzDegLgo=
@@ -1445,6 +1463,10 @@ go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/arch v0.4.0 h1:A8WCeEWhLwPBKNbFi5Wv5UTCBx5zzubnXDlMOFAzFMc=
 golang.org/x/arch v0.4.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
@@ -1487,8 +1509,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
-golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1533,8 +1555,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
-golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1597,17 +1619,16 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
-golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
-golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1624,8 +1645,8 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1723,8 +1744,8 @@ golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1741,8 +1762,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
-golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1761,8 +1782,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
-golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1832,14 +1853,14 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
+gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
 gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
@@ -1862,8 +1883,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.252.0 h1:xfKJeAJaMwb8OC9fesr369rjciQ704AjU/psjkKURSI=
-google.golang.org/api v0.252.0/go.mod h1:dnHOv81x5RAmumZ7BWLShB/u7JZNeyalImxHmtTHxqw=
+google.golang.org/api v0.259.0 h1:90TaGVIxScrh1Vn/XI2426kRpBqHwWIzVBzJsVZ5XrQ=
+google.golang.org/api v0.259.0/go.mod h1:LC2ISWGWbRoyQVpxGntWwLWN/vLNxxKBK9KuJRI8Te4=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1902,12 +1923,12 @@ google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
-google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
+google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
+google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1925,8 +1946,8 @@ google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
+google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1941,8 +1962,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1951,8 +1972,8 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gcfg.v1 v1.2.3/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
@@ -1965,8 +1986,8 @@ gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
-gopkg.in/ns1/ns1-go.v2 v2.15.0 h1:cE3xSMdSCV8kf9SQldzqgW/Ueh7sv3yO2JwKtYxxz3E=
-gopkg.in/ns1/ns1-go.v2 v2.15.0/go.mod h1:pfaU0vECVP7DIOr453z03HXS6dFJpXdNRwOyRzwmPSc=
+gopkg.in/ns1/ns1-go.v2 v2.16.0 h1:mUczKFnrCystSV7yIODzVSbENoud3T7DwstmyVZfqg4=
+gopkg.in/ns1/ns1-go.v2 v2.16.0/go.mod h1:pfaU0vECVP7DIOr453z03HXS6dFJpXdNRwOyRzwmPSc=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
@@ -1994,20 +2015,24 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.32.3 h1:Hw7KqxRusq+6QSplE3NYG4MBxZw1BZnq4aP4cJVINls=
-k8s.io/api v0.32.3/go.mod h1:2wEDTXADtm/HA7CCMD8D8bK4yuBUptzaRhYcYEEYA3k=
-k8s.io/apiextensions-apiserver v0.32.3 h1:4D8vy+9GWerlErCwVIbcQjsWunF9SUGNu7O7hiQTyPY=
-k8s.io/apiextensions-apiserver v0.32.3/go.mod h1:8YwcvVRMVzw0r1Stc7XfGAzB/SIVLunqApySV5V7Dss=
-k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
-k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
-k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
-k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
+k8s.io/api v0.34.3 h1:D12sTP257/jSH2vHV2EDYrb16bS7ULlHpdNdNhEw2S4=
+k8s.io/api v0.34.3/go.mod h1:PyVQBF886Q5RSQZOim7DybQjAbVs8g7gwJNhGtY5MBk=
+k8s.io/apiextensions-apiserver v0.34.3 h1:p10fGlkDY09eWKOTeUSioxwLukJnm+KuDZdrW71y40g=
+k8s.io/apiextensions-apiserver v0.34.3/go.mod h1:aujxvqGFRdb/cmXYfcRTeppN7S2XV/t7WMEc64zB5A0=
+k8s.io/apimachinery v0.34.3 h1:/TB+SFEiQvN9HPldtlWOTp0hWbJ+fjU+wkxysf/aQnE=
+k8s.io/apimachinery v0.34.3/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.3 h1:wtYtpzy/OPNYf7WyNBTj3iUA0XaBHVqhv4Iv3tbrF5A=
+k8s.io/client-go v0.34.3/go.mod h1:OxxeYagaP9Kdf78UrKLa3YZixMCfP6bgPwPwNBQBzpM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
-k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
-k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3 h1:liMHz39T5dJO1aOKHLvwaCjDbf07wVh6yaUlTpunnkE=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+knative.dev/networking v0.0.0-20241022012959-60e29ff520dc h1:0d9XXRLlyuHfINZLlYqo/BYe/+chqqNBMLKJldjTbtw=
+knative.dev/networking v0.0.0-20241022012959-60e29ff520dc/go.mod h1:G56j6VCLzfaN9yZ4IqfNyN4c3U1czvhUmKeZX4UjQ8Q=
+knative.dev/pkg v0.0.0-20241021183759-9b9d535af5ad h1:Nrjtr2H168rJeamH4QdyLMV1lEKHejNhaj1ymgQMfLk=
+knative.dev/pkg v0.0.0-20241021183759-9b9d535af5ad/go.mod h1:StJI72GWcm/iErmk4RqFJiOo8RLbVqPbHxUqeVwAzeo=
 mvdan.cc/xurls/v2 v2.5.0 h1:lyBNOm8Wo71UknhUs4QTFUNNMyxy2JEIaKKo0RWOh+8=
 mvdan.cc/xurls/v2 v2.5.0/go.mod h1:yQgaGQ1rFtJUzkmKiHYSSfuQxqfYmd//X6PxvholpeE=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
@@ -2017,16 +2042,16 @@ rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
-sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
-sigs.k8s.io/gateway-api v1.3.0 h1:q6okN+/UKDATola4JY7zXzx40WO4VISk7i9DIfOvr9M=
-sigs.k8s.io/gateway-api v1.3.0/go.mod h1:d8NV8nJbaRbEKem+5IuxkL8gJGOZ+FJ+NvOIltV8gDk=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016 h1:kXv6kKdoEtedwuqMmkqhbkgvYKeycVbC8+iPCP9j5kQ=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/controller-runtime v0.22.1 h1:Ah1T7I+0A7ize291nJZdS1CabF/lB4E++WizgV24Eqg=
+sigs.k8s.io/controller-runtime v0.22.1/go.mod h1:FwiwRjkRPbiN+zp2QRp7wlTCzbUXxZ/D4OzuQUDwBHY=
+sigs.k8s.io/gateway-api v1.4.0 h1:ZwlNM6zOHq0h3WUX2gfByPs2yAEsy/EenYJB78jpQfQ=
+sigs.k8s.io/gateway-api v1.4.0/go.mod h1:AR5RSqciWP98OPckEjOjh2XJhAe2Na4LHyXD2FUY7Qk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1 h1:JrhdFMqOd/+3ByqlP2I45kTOZmTRLBUm5pvRjeheg7E=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/integration/acme_test.go b/integration/acme_test.go
index c6c92e24b..a226ea88d 100644
--- a/integration/acme_test.go
+++ b/integration/acme_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/traefik/traefik/v3/pkg/provider/acme"
 	"github.com/traefik/traefik/v3/pkg/testhelpers"
 	"github.com/traefik/traefik/v3/pkg/types"
+	"k8s.io/utils/strings/slices"
 )
 
 // ACME test suites.
@@ -35,9 +36,9 @@ func TestAcmeSuite(t *testing.T) {
 }
 
 type subCases struct {
-	host               string
-	expectedCommonName string
-	expectedAlgorithm  x509.PublicKeyAlgorithm
+	host              string
+	expectedDomain    string
+	expectedAlgorithm x509.PublicKeyAlgorithm
 }
 
 type acmeTestCase struct {
@@ -142,9 +143,9 @@ func (s *AcmeSuite) TestHTTP01Domains() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_domains.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Domains: []types.Domain{{
@@ -165,9 +166,9 @@ func (s *AcmeSuite) TestHTTP01StoreDomains() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_store_domains.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Domain: types.Domain{
@@ -188,9 +189,9 @@ func (s *AcmeSuite) TestHTTP01DomainsInSAN() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_domains.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: "acme.wtf",
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    "acme.wtf",
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Domains: []types.Domain{{
@@ -212,9 +213,9 @@ func (s *AcmeSuite) TestHTTP01OnHostRule() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_base.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -233,14 +234,14 @@ func (s *AcmeSuite) TestMultipleResolver() {
 		traefikConfFilePath: "fixtures/acme/acme_multiple_resolvers.toml",
 		subCases: []subCases{
 			{
-				host:               acmeDomain,
-				expectedCommonName: acmeDomain,
-				expectedAlgorithm:  x509.RSA,
+				host:              acmeDomain,
+				expectedDomain:    acmeDomain,
+				expectedAlgorithm: x509.RSA,
 			},
 			{
-				host:               "tchouk.acme.wtf",
-				expectedCommonName: "tchouk.acme.wtf",
-				expectedAlgorithm:  x509.ECDSA,
+				host:              "tchouk.acme.wtf",
+				expectedDomain:    "tchouk.acme.wtf",
+				expectedAlgorithm: x509.ECDSA,
 			},
 		},
 		template: templateModel{
@@ -263,9 +264,9 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleECDSA() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_base.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.ECDSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.ECDSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -284,9 +285,9 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleInvalidAlgo() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_base.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -301,13 +302,14 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleInvalidAlgo() {
 	s.retrieveAcmeCertificate(testCase)
 }
 
+// TODO: check why this test do not use the ACME cert resolver.
 func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_tls.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: wildcardDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    wildcardDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -321,13 +323,14 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard()
 	s.retrieveAcmeCertificate(testCase)
 }
 
+// TODO: check why this test do not use the ACME cert resolver.
 func (s *AcmeSuite) TestHTTP01OnHostRuleDynamicCertificatesWithWildcard() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: wildcardDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    wildcardDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -345,9 +348,9 @@ func (s *AcmeSuite) TestTLSALPN01OnHostRuleTCP() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_tcp.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -365,9 +368,9 @@ func (s *AcmeSuite) TestTLSALPN01OnHostRule() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_base.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Acme: map[string]static.CertificateResolver{
@@ -385,9 +388,9 @@ func (s *AcmeSuite) TestTLSALPN01Domains() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_domains.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: acmeDomain,
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    acmeDomain,
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Domains: []types.Domain{{
@@ -408,9 +411,9 @@ func (s *AcmeSuite) TestTLSALPN01DomainsInSAN() {
 	testCase := acmeTestCase{
 		traefikConfFilePath: "fixtures/acme/acme_domains.toml",
 		subCases: []subCases{{
-			host:               acmeDomain,
-			expectedCommonName: "acme.wtf",
-			expectedAlgorithm:  x509.RSA,
+			host:              acmeDomain,
+			expectedDomain:    "acme.wtf",
+			expectedAlgorithm: x509.RSA,
 		}},
 		template: templateModel{
 			Domains: []types.Domain{{
@@ -502,27 +505,38 @@ func (s *AcmeSuite) retrieveAcmeCertificate(testCase acmeTestCase) {
 		req.Header.Set("Host", sub.host)
 		req.Header.Set("Accept", "*/*")
 
-		var resp *http.Response
+		var (
+			gotStatusCode         int
+			gotDomains            []string
+			gotPublicKeyAlgorithm x509.PublicKeyAlgorithm
+		)
 
 		// Retry to send a Request which uses the LE generated certificate
 		err := try.Do(60*time.Second, func() error {
-			resp, err = client.Do(req)
+			resp, err := client.Do(req)
 			if err != nil {
 				return err
 			}
 
-			cn := resp.TLS.PeerCertificates[0].Subject.CommonName
-			if cn != sub.expectedCommonName {
-				return fmt.Errorf("domain %s found instead of %s", cn, sub.expectedCommonName)
+			gotStatusCode = resp.StatusCode
+			gotPublicKeyAlgorithm = resp.TLS.PeerCertificates[0].PublicKeyAlgorithm
+
+			// Here we are collecting the common name as it is used in wildcard tests.
+			gotDomains = append(gotDomains, resp.TLS.PeerCertificates[0].Subject.CommonName)
+			gotDomains = append(gotDomains, resp.TLS.PeerCertificates[0].DNSNames...)
+
+			if !slices.Contains(gotDomains, sub.expectedDomain) {
+				return fmt.Errorf("domain name %s not found in domain names: %v", sub.expectedDomain, gotDomains)
 			}
 
 			return nil
 		})
 
 		require.NoError(s.T(), err)
-		assert.Equal(s.T(), http.StatusOK, resp.StatusCode)
+		assert.Equal(s.T(), http.StatusOK, gotStatusCode)
+
 		// Check Domain into response certificate
-		assert.Equal(s.T(), sub.expectedCommonName, resp.TLS.PeerCertificates[0].Subject.CommonName)
-		assert.Equal(s.T(), sub.expectedAlgorithm, resp.TLS.PeerCertificates[0].PublicKeyAlgorithm)
+		assert.Contains(s.T(), gotDomains, sub.expectedDomain)
+		assert.Equal(s.T(), sub.expectedAlgorithm, gotPublicKeyAlgorithm)
 	}
 }
diff --git a/integration/docker_test.go b/integration/docker_test.go
index d6a6819ff..08606b60b 100644
--- a/integration/docker_test.go
+++ b/integration/docker_test.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
-	"strings"
 	"testing"
 	"time"
 
@@ -33,7 +32,7 @@ func (s *DockerSuite) TearDownSuite() {
 }
 
 func (s *DockerSuite) TearDownTest() {
-	s.composeStop("simple", "withtcplabels", "withlabels1", "withlabels2", "withonelabelmissing", "powpow")
+	s.composeStop("simple", "withtcplabels", "withlabels1", "withlabels2", "withonelabelmissing", "powpow", "nonRunning")
 }
 
 func (s *DockerSuite) TestSimpleConfiguration() {
@@ -56,56 +55,6 @@ func (s *DockerSuite) TestSimpleConfiguration() {
 	require.NoError(s.T(), err)
 }
 
-func (s *DockerSuite) TestWRRServer() {
-	tempObjects := struct {
-		DockerHost  string
-		DefaultRule string
-	}{
-		DockerHost:  s.getDockerHost(),
-		DefaultRule: "Host(`{{ normalize .Name }}.docker.localhost`)",
-	}
-
-	file := s.adaptFile("fixtures/docker/simple.toml", tempObjects)
-
-	s.composeUp()
-
-	s.traefikCmd(withConfigFile(file))
-
-	whoami1IP := s.getComposeServiceIP("wrr-server")
-	whoami2IP := s.getComposeServiceIP("wrr-server2")
-
-	// Expected a 404 as we did not configure anything
-	err := try.GetRequest("http://127.0.0.1:8000/", 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
-	require.NoError(s.T(), err)
-
-	err = try.GetRequest("http://127.0.0.1:8080/api/http/services", 1000*time.Millisecond, try.BodyContains("wrr-server"))
-	require.NoError(s.T(), err)
-
-	repartition := map[string]int{}
-	for range 4 {
-		req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
-		req.Host = "my.wrr.host"
-		require.NoError(s.T(), err)
-
-		response, err := http.DefaultClient.Do(req)
-		require.NoError(s.T(), err)
-		assert.Equal(s.T(), http.StatusOK, response.StatusCode)
-
-		body, err := io.ReadAll(response.Body)
-		require.NoError(s.T(), err)
-
-		if strings.Contains(string(body), whoami1IP) {
-			repartition[whoami1IP]++
-		}
-		if strings.Contains(string(body), whoami2IP) {
-			repartition[whoami2IP]++
-		}
-	}
-
-	assert.Equal(s.T(), 3, repartition[whoami1IP])
-	assert.Equal(s.T(), 1, repartition[whoami2IP])
-}
-
 func (s *DockerSuite) TestDefaultDockerContainers() {
 	tempObjects := struct {
 		DockerHost  string
@@ -273,3 +222,59 @@ func (s *DockerSuite) TestRestartDockerContainers() {
 	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 60*time.Second, try.BodyContains("powpow"))
 	require.NoError(s.T(), err)
 }
+
+func (s *DockerSuite) TestDockerAllowNonRunning() {
+	tempObjects := struct {
+		DockerHost  string
+		DefaultRule string
+	}{
+		DockerHost:  s.getDockerHost(),
+		DefaultRule: "Host(`{{ normalize .Name }}.docker.localhost`)",
+	}
+
+	file := s.adaptFile("fixtures/docker/simple.toml", tempObjects)
+
+	s.composeUp("nonRunning")
+
+	// Start traefik
+	s.traefikCmd(withConfigFile(file))
+
+	// Verify the container is working when running
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	require.NoError(s.T(), err)
+	req.Host = "non.running.host"
+
+	resp, err := try.ResponseUntilStatusCode(req, 3*time.Second, http.StatusOK)
+	require.NoError(s.T(), err)
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(s.T(), err)
+	assert.Contains(s.T(), string(body), "Hostname:")
+
+	// Verify the router exists in Traefik configuration
+	err = try.GetRequest("http://127.0.0.1:8080/api/http/routers", 1*time.Second, try.BodyContains("NonRunning"))
+	require.NoError(s.T(), err)
+
+	// Stop the container
+	s.composeStop("nonRunning")
+
+	// Wait a bit for container stop to be detected
+	time.Sleep(2 * time.Second)
+
+	// Verify the router still exists in configuration even though container is stopped
+	// This is the key test - the router should persist due to allowNonRunning=true
+	err = try.GetRequest("http://127.0.0.1:8080/api/http/routers", 10*time.Second, try.BodyContains("NonRunning"))
+	require.NoError(s.T(), err)
+
+	// Verify the service still exists in configuration
+	err = try.GetRequest("http://127.0.0.1:8080/api/http/services", 1*time.Second, try.BodyContains("nonRunning"))
+	require.NoError(s.T(), err)
+
+	// HTTP requests should fail (502 Bad Gateway) since container is stopped but router exists
+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	require.NoError(s.T(), err)
+	req.Host = "non.running.host"
+
+	err = try.Request(req, 3*time.Second, try.StatusCodeIs(http.StatusServiceUnavailable))
+	require.NoError(s.T(), err)
+}
diff --git a/integration/fixtures/k8s-conformance/00-experimental-v1.3.0.yml b/integration/fixtures/gateway-api-conformance/00-experimental-v1.4.0.yml
similarity index 81%
rename from integration/fixtures/k8s-conformance/00-experimental-v1.3.0.yml
rename to integration/fixtures/gateway-api-conformance/00-experimental-v1.4.0.yml
index 75725cc0f..b1e7bd2f2 100644
--- a/integration/fixtures/k8s-conformance/00-experimental-v1.3.0.yml
+++ b/integration/fixtures/gateway-api-conformance/00-experimental-v1.4.0.yml
@@ -24,9 +24,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: backendtlspolicies.gateway.networking.k8s.io
@@ -47,7 +46,7 @@ spec:
         - jsonPath: .metadata.creationTimestamp
           name: Age
           type: date
-      name: v1alpha3
+      name: v1
       schema:
         openAPIV3Schema:
           description: |-
@@ -114,6 +113,22 @@ spec:
                       be unique across all targetRef entries in the BackendTLSPolicy.
                     * They select different sectionNames in the same target.
                     
+                    When more than one BackendTLSPolicy selects the same target and
+                    sectionName, implementations MUST determine precedence using the
+                    following criteria, continuing on ties:
+                    
+                    * The older policy by creation timestamp takes precedence. For
+                      example, a policy with a creation timestamp of "2021-07-15
+                      01:02:03" MUST be given precedence over a policy with a
+                      creation timestamp of "2021-07-15 01:02:04".
+                    * The policy appearing first in alphabetical order by {name}.
+                      For example, a policy named `bar` is given precedence over a
+                      policy named `baz`.
+                    
+                    For any BackendTLSPolicy that does not take precedence, the
+                    implementation MUST ensure the `Accepted` Condition is set to
+                    `status: False`, with Reason `Conflicted`.
+                    
                     Support: Extended for Kubernetes Service
                     
                     Support: Implementation-specific for any other resource
@@ -170,6 +185,7 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName must be specified when targetRefs includes
                         2 or more references to the same target
@@ -198,8 +214,31 @@ spec:
                         not both. If CACertificateRefs is empty or unspecified, the configuration for
                         WellKnownCACertificates MUST be honored instead if supported by the implementation.
                         
-                        References to a resource in a different namespace are invalid for the
-                        moment, although we will revisit this in the future.
+                        A CACertificateRef is invalid if:
+                        
+                        * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                          does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                          named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                          and the Message of the Condition must indicate which reference is invalid and why.
+                        
+                        * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                          must be set to `InvalidKind` and the Message of the Condition must explain which
+                          kind of resource is unknown or unsupported.
+                        
+                        * It refers to a resource in another namespace. This may change in future
+                          spec updates.
+                        
+                        Implementations MAY choose to perform further validation of the certificate
+                        content (e.g., checking expiry or enforcing specific formats). In such cases,
+                        an implementation-specific Reason and Message must be set for the invalid reference.
+                        
+                        In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                        the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                        that indicate the cause of the error. Connections using an invalid
+                        CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                        response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                        ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                        `status: False`, with a Reason `NoValidCACertificate`.
                         
                         A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
                         Implementations MAY choose to support attaching multiple certificates to
@@ -208,8 +247,8 @@ spec:
                         Support: Core - An optional single reference to a Kubernetes ConfigMap,
                         with the CA certificate in a key named `ca.crt`.
                         
-                        Support: Implementation-specific (More than one reference, or other kinds
-                        of resources).
+                        Support: Implementation-specific - More than one reference, other kinds
+                        of resources, or a single reference that includes multiple certificates.
                       items:
                         description: |-
                           LocalObjectReference identifies an API object within the namespace of the
@@ -247,15 +286,18 @@ spec:
                         type: object
                       maxItems: 8
                       type: array
+                      x-kubernetes-list-type: atomic
                     hostname:
                       description: |-
                         Hostname is used for two purposes in the connection between Gateways and
                         backends:
                         
                         1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-                        2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
-                           authentication and MUST match the certificate served by the matching
-                           backend.
+                        2. Hostname MUST be used for authentication and MUST match the certificate
+                           served by the matching backend, unless SubjectAltNames is specified.
+                        3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                           but MUST NOT be used for authentication. If you want to use the value
+                           of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
                         
                         Support: Core
                       maxLength: 253
@@ -325,6 +367,7 @@ spec:
                           "")'
                       maxItems: 5
                       type: array
+                      x-kubernetes-list-type: atomic
                     wellKnownCACertificates:
                       description: |-
                         WellKnownCACertificates specifies whether system CA certificates may be used in
@@ -332,10 +375,11 @@ spec:
                         
                         If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
                         must be specified with at least one entry for a valid configuration. Only one of
-                        CACertificateRefs or WellKnownCACertificates may be specified, not both. If an
-                        implementation does not support the WellKnownCACertificates field or the value
-                        supplied is not supported, the Status Conditions on the Policy MUST be
-                        updated to include an Accepted: False Condition with Reason: Invalid.
+                        CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                        If an implementation does not support the WellKnownCACertificates field, or
+                        the supplied value is not recognized, the implementation MUST ensure the
+                        `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                        a Reason `Invalid`.
                         
                         Support: Implementation-specific
                       enum:
@@ -646,10 +690,12 @@ spec:
                         type: string
                     required:
                       - ancestorRef
+                      - conditions
                       - controllerName
                     type: object
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - ancestors
               type: object
@@ -660,6 +706,667 @@ spec:
       storage: true
       subresources:
         status: {}
+    - deprecated: true
+      deprecationWarning: The v1alpha3 version of BackendTLSPolicy has been deprecated
+        and will be removed in a future release of the API. Please upgrade to v1.
+      name: v1alpha3
+      schema:
+        openAPIV3Schema:
+          description: |-
+            BackendTLSPolicy provides a way to configure how a Gateway
+            connects to a Backend via TLS.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of BackendTLSPolicy.
+              properties:
+                options:
+                  additionalProperties:
+                    description: |-
+                      AnnotationValue is the value of an annotation in Gateway API. This is used
+                      for validation of maps such as TLS options. This roughly matches Kubernetes
+                      annotation validation, although the length validation in that case is based
+                      on the entire size of the annotations struct.
+                    maxLength: 4096
+                    minLength: 0
+                    type: string
+                  description: |-
+                    Options are a list of key/value pairs to enable extended TLS
+                    configuration for each implementation. For example, configuring the
+                    minimum TLS version or supported cipher suites.
+                    
+                    A set of common keys MAY be defined by the API in the future. To avoid
+                    any ambiguity, implementation-specific definitions MUST use
+                    domain-prefixed names, such as `example.com/my-custom-option`.
+                    Un-prefixed names are reserved for key names defined by Gateway API.
+                    
+                    Support: Implementation-specific
+                  maxProperties: 16
+                  type: object
+                targetRefs:
+                  description: |-
+                    TargetRefs identifies an API object to apply the policy to.
+                    Only Services have Extended support. Implementations MAY support
+                    additional objects, with Implementation Specific support.
+                    Note that this config applies to the entire referenced resource
+                    by default, but this default may change in the future to provide
+                    a more granular application of the policy.
+                    
+                    TargetRefs must be _distinct_. This means either that:
+                    
+                    * They select different targets. If this is the case, then targetRef
+                      entries are distinct. In terms of fields, this means that the
+                      multi-part key defined by `group`, `kind`, and `name` must
+                      be unique across all targetRef entries in the BackendTLSPolicy.
+                    * They select different sectionNames in the same target.
+                    
+                    When more than one BackendTLSPolicy selects the same target and
+                    sectionName, implementations MUST determine precedence using the
+                    following criteria, continuing on ties:
+                    
+                    * The older policy by creation timestamp takes precedence. For
+                      example, a policy with a creation timestamp of "2021-07-15
+                      01:02:03" MUST be given precedence over a policy with a
+                      creation timestamp of "2021-07-15 01:02:04".
+                    * The policy appearing first in alphabetical order by {name}.
+                      For example, a policy named `bar` is given precedence over a
+                      policy named `baz`.
+                    
+                    For any BackendTLSPolicy that does not take precedence, the
+                    implementation MUST ensure the `Accepted` Condition is set to
+                    `status: False`, with Reason `Conflicted`.
+                    
+                    Support: Extended for Kubernetes Service
+                    
+                    Support: Implementation-specific for any other resource
+                  items:
+                    description: |-
+                      LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+                      direct policy to. This should be used as part of Policy resources that can
+                      target single resources. For more information on how this policy attachment
+                      mode works, and a sample Policy resource, refer to the policy attachment
+                      documentation for Gateway API.
+                      
+                      Note: This should only be used for direct policy attachment when references
+                      to SectionName are actually needed. In all other cases,
+                      LocalPolicyTargetReference should be used.
+                    properties:
+                      group:
+                        description: Group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        description: Kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: Name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      sectionName:
+                        description: |-
+                          SectionName is the name of a section within the target resource. When
+                          unspecified, this targetRef targets the entire resource. In the following
+                          resources, SectionName is interpreted as the following:
+                          
+                          * Gateway: Listener name
+                          * HTTPRoute: HTTPRouteRule name
+                          * Service: Port name
+                          
+                          If a SectionName is specified, but does not exist on the targeted object,
+                          the Policy must fail to attach, and the policy implementation should record
+                          a `ResolvedRefs` or similar Condition in the Policy's status.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - group
+                      - kind
+                      - name
+                    type: object
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: sectionName must be specified when targetRefs includes
+                        2 or more references to the same target
+                      rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                    - message: sectionName must be unique when targetRefs includes 2 or
+                        more references to the same target
+                      rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                        == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                        p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                        == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                        == p2.sectionName))))
+                validation:
+                  description: Validation contains backend TLS validation configuration.
+                  properties:
+                    caCertificateRefs:
+                      description: |-
+                        CACertificateRefs contains one or more references to Kubernetes objects that
+                        contain a PEM-encoded TLS CA certificate bundle, which is used to
+                        validate a TLS handshake between the Gateway and backend Pod.
+                        
+                        If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+                        specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+                        not both. If CACertificateRefs is empty or unspecified, the configuration for
+                        WellKnownCACertificates MUST be honored instead if supported by the implementation.
+                        
+                        A CACertificateRef is invalid if:
+                        
+                        * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                          does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                          named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                          and the Message of the Condition must indicate which reference is invalid and why.
+                        
+                        * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                          must be set to `InvalidKind` and the Message of the Condition must explain which
+                          kind of resource is unknown or unsupported.
+                        
+                        * It refers to a resource in another namespace. This may change in future
+                          spec updates.
+                        
+                        Implementations MAY choose to perform further validation of the certificate
+                        content (e.g., checking expiry or enforcing specific formats). In such cases,
+                        an implementation-specific Reason and Message must be set for the invalid reference.
+                        
+                        In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                        the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                        that indicate the cause of the error. Connections using an invalid
+                        CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                        response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                        ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                        `status: False`, with a Reason `NoValidCACertificate`.
+                        
+                        A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+                        Implementations MAY choose to support attaching multiple certificates to
+                        a backend, but this behavior is implementation-specific.
+                        
+                        Support: Core - An optional single reference to a Kubernetes ConfigMap,
+                        with the CA certificate in a key named `ca.crt`.
+                        
+                        Support: Implementation-specific - More than one reference, other kinds
+                        of resources, or a single reference that includes multiple certificates.
+                      items:
+                        description: |-
+                          LocalObjectReference identifies an API object within the namespace of the
+                          referrer.
+                          The API object must be valid in the cluster; the Group and Kind must
+                          be registered in the cluster for this reference to be valid.
+                          
+                          References to objects with invalid Group and Kind are not valid, and must
+                          be rejected by the implementation, with appropriate Conditions set
+                          on the containing object.
+                        properties:
+                          group:
+                            description: |-
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            description: Kind is kind of the referent. For example "HTTPRoute"
+                              or "Service".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                        required:
+                          - group
+                          - kind
+                          - name
+                        type: object
+                      maxItems: 8
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    hostname:
+                      description: |-
+                        Hostname is used for two purposes in the connection between Gateways and
+                        backends:
+                        
+                        1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+                        2. Hostname MUST be used for authentication and MUST match the certificate
+                           served by the matching backend, unless SubjectAltNames is specified.
+                        3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                           but MUST NOT be used for authentication. If you want to use the value
+                           of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+                        
+                        Support: Core
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    subjectAltNames:
+                      description: |-
+                        SubjectAltNames contains one or more Subject Alternative Names.
+                        When specified the certificate served from the backend MUST
+                        have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+                        
+                        Support: Extended
+                      items:
+                        description: SubjectAltName represents Subject Alternative Name.
+                        properties:
+                          hostname:
+                            description: |-
+                              Hostname contains Subject Alternative Name specified in DNS name format.
+                              Required when Type is set to Hostname, ignored otherwise.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          type:
+                            description: |-
+                              Type determines the format of the Subject Alternative Name. Always required.
+                              
+                              Support: Core
+                            enum:
+                              - Hostname
+                              - URI
+                            type: string
+                          uri:
+                            description: |-
+                              URI contains Subject Alternative Name specified in a full URI format.
+                              It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+                              Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+                              Required when Type is set to URI, ignored otherwise.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                            type: string
+                        required:
+                          - type
+                        type: object
+                        x-kubernetes-validations:
+                          - message: SubjectAltName element must contain Hostname, if
+                              Type is set to Hostname
+                            rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
+                          self.hostname == ""))'
+                          - message: SubjectAltName element must not contain Hostname,
+                              if Type is not set to Hostname
+                            rule: '!(self.type != "Hostname" && has(self.hostname) &&
+                          self.hostname != "")'
+                          - message: SubjectAltName element must contain URI, if Type
+                              is set to URI
+                            rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
+                          == ""))'
+                          - message: SubjectAltName element must not contain URI, if Type
+                              is not set to URI
+                            rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
+                          "")'
+                      maxItems: 5
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    wellKnownCACertificates:
+                      description: |-
+                        WellKnownCACertificates specifies whether system CA certificates may be used in
+                        the TLS handshake between the gateway and backend pod.
+                        
+                        If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+                        must be specified with at least one entry for a valid configuration. Only one of
+                        CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                        If an implementation does not support the WellKnownCACertificates field, or
+                        the supplied value is not recognized, the implementation MUST ensure the
+                        `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                        a Reason `Invalid`.
+                        
+                        Support: Implementation-specific
+                      enum:
+                        - System
+                      type: string
+                  required:
+                    - hostname
+                  type: object
+                  x-kubernetes-validations:
+                    - message: must not contain both CACertificateRefs and WellKnownCACertificates
+                      rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")'
+                    - message: must specify either CACertificateRefs or WellKnownCACertificates
+                      rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                        > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                        != "")
+              required:
+                - targetRefs
+                - validation
+              type: object
+            status:
+              description: Status defines the current state of BackendTLSPolicy.
+              properties:
+                ancestors:
+                  description: |-
+                    Ancestors is a list of ancestor resources (usually Gateways) that are
+                    associated with the policy, and the status of the policy with respect to
+                    each ancestor. When this policy attaches to a parent, the controller that
+                    manages the parent and the ancestors MUST add an entry to this list when
+                    the controller first sees the policy and SHOULD update the entry as
+                    appropriate when the relevant ancestor is modified.
+                    
+                    Note that choosing the relevant ancestor is left to the Policy designers;
+                    an important part of Policy design is designing the right object level at
+                    which to namespace this status.
+                    
+                    Note also that implementations MUST ONLY populate ancestor status for
+                    the Ancestor resources they are responsible for. Implementations MUST
+                    use the ControllerName field to uniquely identify the entries in this list
+                    that they are responsible for.
+                    
+                    Note that to achieve this, the list of PolicyAncestorStatus structs
+                    MUST be treated as a map with a composite key, made up of the AncestorRef
+                    and ControllerName fields combined.
+                    
+                    A maximum of 16 ancestors will be represented in this list. An empty list
+                    means the Policy is not relevant for any ancestors.
+                    
+                    If this slice is full, implementations MUST NOT add further entries.
+                    Instead they MUST consider the policy unimplementable and signal that
+                    on any related resources such as the ancestor that would be referenced
+                    here. For example, if this list was full on BackendTLSPolicy, no
+                    additional Gateways would be able to reference the Service targeted by
+                    the BackendTLSPolicy.
+                  items:
+                    description: |-
+                      PolicyAncestorStatus describes the status of a route with respect to an
+                      associated Ancestor.
+                      
+                      Ancestors refer to objects that are either the Target of a policy or above it
+                      in terms of object hierarchy. For example, if a policy targets a Service, the
+                      Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                      the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                      useful object to place Policy status on, so we recommend that implementations
+                      SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                      have a _very_ good reason otherwise.
+                      
+                      In the context of policy attachment, the Ancestor is used to distinguish which
+                      resource results in a distinct application of this policy. For example, if a policy
+                      targets a Service, it may have a distinct result per attached Gateway.
+                      
+                      Policies targeting the same resource may have different effects depending on the
+                      ancestors of those resources. For example, different Gateways targeting the same
+                      Service may have different capabilities, especially if they have different underlying
+                      implementations.
+                      
+                      For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                      used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                      In this case, the relevant object for status is the Gateway, and that is the
+                      ancestor object referred to in this status.
+                      
+                      Note that a parent is also an ancestor, so for objects where the parent is the
+                      relevant object for status, this struct SHOULD still be used.
+                      
+                      This struct is intended to be used in a slice that's effectively a map,
+                      with a composite key made up of the AncestorRef and the ControllerName.
+                    properties:
+                      ancestorRef:
+                        description: |-
+                          AncestorRef corresponds with a ParentRef in the spec that this
+                          PolicyAncestorStatus struct describes the status of.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: |-
+                              Group is the group of the referent.
+                              When unspecified, "gateway.networking.k8s.io" is inferred.
+                              To set the core API group (such as for a "Service" kind referent),
+                              Group must be explicitly set to "" (empty string).
+                              
+                              Support: Core
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Gateway
+                            description: |-
+                              Kind is kind of the referent.
+                              
+                              There are two kinds of parent resources with "Core" support:
+                              
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+                              
+                              Support for other resources is Implementation-Specific.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: |-
+                              Name is the name of the referent.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the referent. When unspecified, this refers
+                              to the local namespace of the Route.
+                              
+                              Note that there are specific rules for ParentRefs which cross namespace
+                              boundaries. Cross-namespace references are only valid if they are explicitly
+                              allowed by something in the namespace they are referring to. For example:
+                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                              generic way to enable any other kind of cross-namespace reference.
+                              
+                              
+                              ParentRefs from a Route to a Service in the same namespace are "producer"
+                              routes, which apply default routing rules to inbound connections from
+                              any namespace to the Service.
+                              
+                              ParentRefs from a Route to a Service in a different namespace are
+                              "consumer" routes, and these routing rules are only applied to outbound
+                              connections originating from the same namespace as the Route, for which
+                              the intended destination of the connections are a Service targeted as a
+                              ParentRef of the Route.
+                              
+                              
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port is the network port this Route targets. It can be interpreted
+                              differently based on the type of parent resource.
+                              
+                              When the parent resource is a Gateway, this targets all listeners
+                              listening on the specified port that also support this kind of Route(and
+                              select this Route). It's not recommended to set `Port` unless the
+                              networking behaviors specified in a Route must apply to a specific port
+                              as opposed to a listener(s) whose port(s) may be changed. When both Port
+                              and SectionName are specified, the name and port of the selected listener
+                              must match both specified values.
+                              
+                              
+                              When the parent resource is a Service, this targets a specific port in the
+                              Service spec. When both Port (experimental) and SectionName are specified,
+                              the name and port of the selected port must match both specified values.
+                              
+                              
+                              Implementations MAY choose to support other parent resources.
+                              Implementations supporting other types of parent resources MUST clearly
+                              document how/if Port is interpreted.
+                              
+                              For the purpose of status, an attachment is considered successful as
+                              long as the parent resource accepts it partially. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                              from the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route,
+                              the Route MUST be considered detached from the Gateway.
+                              
+                              Support: Extended
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          sectionName:
+                            description: |-
+                              SectionName is the name of a section within the target resource. In the
+                              following resources, SectionName is interpreted as the following:
+                              
+                              * Gateway: Listener name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              * Service: Port name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              
+                              Implementations MAY choose to support attaching Routes to other resources.
+                              If that is the case, they MUST clearly document how SectionName is
+                              interpreted.
+                              
+                              When unspecified (empty string), this will reference the entire resource.
+                              For the purpose of status, an attachment is considered successful if at
+                              least one section in the parent resource accepts it. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                              the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route, the
+                              Route MUST be considered detached from the Gateway.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                        required:
+                          - name
+                        type: object
+                      conditions:
+                        description: Conditions describes the status of the Policy with
+                          respect to the given Ancestor.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      controllerName:
+                        description: |-
+                          ControllerName is a domain/path string that indicates the name of the
+                          controller that wrote this status. This corresponds with the
+                          controllerName field on GatewayClass.
+                          
+                          Example: "example.net/gateway-controller".
+                          
+                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                          valid Kubernetes names
+                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                          
+                          Controllers MUST populate this field when writing status. Controllers should ensure that
+                          entries to status populated with their ControllerName are cleaned up when they are no
+                          longer necessary.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                        type: string
+                    required:
+                      - ancestorRef
+                      - conditions
+                      - controllerName
+                    type: object
+                  maxItems: 16
+                  type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - ancestors
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: false
 status:
   acceptedNames:
     kind: ""
@@ -675,9 +1382,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -1195,9 +1901,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -1257,7 +1962,7 @@ spec:
                     Addresses requested for this Gateway. This is optional and behavior can
                     depend on the implementation. If a value is set in the spec and the
                     requested address is invalid or unavailable, the implementation MUST
-                    indicate this in the associated entry in GatewayStatus.Addresses.
+                    indicate this in an associated entry in GatewayStatus.Conditions.
                     
                     The Addresses field represents a request for the address(es) on the
                     "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -1312,19 +2017,22 @@ spec:
                         type: string
                     type: object
                     x-kubernetes-validations:
-                      - message: Hostname value must only contain valid characters (matching
-                          ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                        rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                      - message: Hostname value must be empty or contain only valid characters
+                          (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                        rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: IPAddress values must be unique
-                      rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                     - message: Hostname values must be unique
-                      rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 allowedListeners:
                   description: |-
                     AllowedListeners defines which ListenerSets can be attached to this Gateway.
@@ -1406,70 +2114,29 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                   type: object
-                backendTLS:
+                defaultScope:
                   description: |-
-                    BackendTLS configures TLS settings for when this Gateway is connecting to
-                    backends with TLS.
+                    DefaultScope, when set, configures the Gateway as a default Gateway,
+                    meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                    attached to it, according to the scope configured here.
                     
-                    Support: Core
-                  properties:
-                    clientCertificateRef:
-                      description: |-
-                        ClientCertificateRef is a reference to an object that contains a Client
-                        Certificate and the associated private key.
-                        
-                        References to a resource in different namespace are invalid UNLESS there
-                        is a ReferenceGrant in the target namespace that allows the certificate
-                        to be attached. If a ReferenceGrant does not allow this reference, the
-                        "ResolvedRefs" condition MUST be set to False for this listener with the
-                        "RefNotPermitted" reason.
-                        
-                        ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                        Secret, or implementation-specific custom resources.
-                        
-                        This setting can be overridden on the service level by use of BackendTLSPolicy.
-                        
-                        Support: Core
-                      properties:
-                        group:
-                          default: ""
-                          description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                          type: string
-                        kind:
-                          default: Secret
-                          description: Kind is kind of the referent. For example "Secret".
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: |-
-                            Namespace is the namespace of the referenced object. When unspecified, the local
-                            namespace is inferred.
-                            
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-                            
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                      required:
-                        - name
-                      type: object
-                  type: object
+                    If unset (the default) or set to None, the Gateway will not act as a
+                    default Gateway; if set, the Gateway will claim any Route with a
+                    matching scope set in its UseDefaultGateway field, subject to the usual
+                    rules about which routes the Gateway can attach to.
+                    
+                    Think carefully before using this functionality! While the normal rules
+                    about which Route can apply are still enforced, it is simply easier for
+                    the wrong Route to be accidentally attached to this Gateway in this
+                    configuration. If the Gateway operator is not also the operator in
+                    control of the scope (e.g. namespace) with tight controls and checks on
+                    what kind of workloads and Routes get added in that scope, we strongly
+                    recommend not using this just because it seems convenient, and instead
+                    stick to direct Route attachment.
+                  enum:
+                    - All
+                    - None
+                  type: string
                 gatewayClassName:
                   description: |-
                     GatewayClassName used for this Gateway. This is the name of a
@@ -1825,6 +2492,7 @@ spec:
                               type: object
                             maxItems: 8
                             type: array
+                            x-kubernetes-list-type: atomic
                           namespaces:
                             default:
                               from: Same
@@ -1992,7 +2660,7 @@ spec:
                           the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
                           if the Protocol field is "HTTP", "TCP", or "UDP".
                           
-                          The association of SNIs to Certificate defined in GatewayTLSConfig is
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
                           defined based on the Hostname field for this listener.
                           
                           The GatewayClass MUST use the longest matching SNI out of all
@@ -2079,93 +2747,7 @@ spec:
                               type: object
                             maxItems: 64
                             type: array
-                          frontendValidation:
-                            description: |-
-                              FrontendValidation holds configuration information for validating the frontend (client).
-                              Setting this field will require clients to send a client certificate
-                              required for validation during the TLS handshake. In browsers this may result in a dialog appearing
-                              that requests a user to specify the client certificate.
-                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
-                              
-                              Support: Extended
-                            properties:
-                              caCertificateRefs:
-                                description: |-
-                                  CACertificateRefs contains one or more references to
-                                  Kubernetes objects that contain TLS certificates of
-                                  the Certificate Authorities that can be used
-                                  as a trust anchor to validate the certificates presented by the client.
-                                  
-                                  A single CA certificate reference to a Kubernetes ConfigMap
-                                  has "Core" support.
-                                  Implementations MAY choose to support attaching multiple CA certificates to
-                                  a Listener, but this behavior is implementation-specific.
-                                  
-                                  Support: Core - A single reference to a Kubernetes ConfigMap
-                                  with the CA certificate in a key named `ca.crt`.
-                                  
-                                  Support: Implementation-specific (More than one reference, or other kinds
-                                  of resources).
-                                  
-                                  References to a resource in a different namespace are invalid UNLESS there
-                                  is a ReferenceGrant in the target namespace that allows the certificate
-                                  to be attached. If a ReferenceGrant does not allow this reference, the
-                                  "ResolvedRefs" condition MUST be set to False for this listener with the
-                                  "RefNotPermitted" reason.
-                                items:
-                                  description: |-
-                                    ObjectReference identifies an API object including its namespace.
-                                    
-                                    The API object must be valid in the cluster; the Group and Kind must
-                                    be registered in the cluster for this reference to be valid.
-                                    
-                                    References to objects with invalid Group and Kind are not valid, and must
-                                    be rejected by the implementation, with appropriate Conditions set
-                                    on the containing object.
-                                  properties:
-                                    group:
-                                      description: |-
-                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                        When set to the empty string, core API group is inferred.
-                                      maxLength: 253
-                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                      type: string
-                                    kind:
-                                      description: Kind is kind of the referent. For
-                                        example "ConfigMap" or "Service".
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                      type: string
-                                    name:
-                                      description: Name is the name of the referent.
-                                      maxLength: 253
-                                      minLength: 1
-                                      type: string
-                                    namespace:
-                                      description: |-
-                                        Namespace is the namespace of the referenced object. When unspecified, the local
-                                        namespace is inferred.
-                                        
-                                        Note that when a namespace different than the local namespace is specified,
-                                        a ReferenceGrant object is required in the referent namespace to allow that
-                                        namespace's owner to accept the reference. See the ReferenceGrant
-                                        documentation for details.
-                                        
-                                        Support: Core
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                      type: string
-                                  required:
-                                    - group
-                                    - kind
-                                    - name
-                                  type: object
-                                maxItems: 8
-                                minItems: 1
-                                type: array
-                            type: object
+                            x-kubernetes-list-type: atomic
                           mode:
                             default: Terminate
                             description: |-
@@ -2244,6 +2826,366 @@ spec:
                       rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
                     == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
+                tls:
+                  description: |-
+                    TLS specifies frontend and backend tls configuration for entire gateway.
+                    
+                    Support: Extended
+                  properties:
+                    backend:
+                      description: |-
+                        Backend describes TLS configuration for gateway when connecting
+                        to backends.
+                        
+                        Note that this contains only details for the Gateway as a TLS client,
+                        and does _not_ imply behavior about how to choose which backend should
+                        get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+                        
+                        Support: Core
+                      properties:
+                        clientCertificateRef:
+                          description: |-
+                            ClientCertificateRef is a reference to an object that contains a Client
+                            Certificate and the associated private key.
+                            
+                            References to a resource in different namespace are invalid UNLESS there
+                            is a ReferenceGrant in the target namespace that allows the certificate
+                            to be attached. If a ReferenceGrant does not allow this reference, the
+                            "ResolvedRefs" condition MUST be set to False for this listener with the
+                            "RefNotPermitted" reason.
+                            
+                            ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                            Secret, or implementation-specific custom resources.
+                            
+                            Support: Core
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Secret
+                              description: Kind is kind of the referent. For example
+                                "Secret".
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    frontend:
+                      description: |-
+                        Frontend describes TLS config when client connects to Gateway.
+                        Support: Core
+                      properties:
+                        default:
+                          description: |-
+                            Default specifies the default client certificate validation configuration
+                            for all Listeners handling HTTPS traffic, unless a per-port configuration
+                            is defined.
+                            
+                            support: Core
+                          properties:
+                            validation:
+                              description: |-
+                                Validation holds configuration information for validating the frontend (client).
+                                Setting this field will result in mutual authentication when connecting to the gateway.
+                                In browsers this may result in a dialog appearing
+                                that requests a user to specify the client certificate.
+                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                
+                                Support: Core
+                              properties:
+                                caCertificateRefs:
+                                  description: |-
+                                    CACertificateRefs contains one or more references to
+                                    Kubernetes objects that contain TLS certificates of
+                                    the Certificate Authorities that can be used
+                                    as a trust anchor to validate the certificates presented by the client.
+                                    
+                                    A single CA certificate reference to a Kubernetes ConfigMap
+                                    has "Core" support.
+                                    Implementations MAY choose to support attaching multiple CA certificates to
+                                    a Listener, but this behavior is implementation-specific.
+                                    
+                                    Support: Core - A single reference to a Kubernetes ConfigMap
+                                    with the CA certificate in a key named `ca.crt`.
+                                    
+                                    Support: Implementation-specific (More than one certificate in a ConfigMap
+                                    with different keys or more than one reference, or other kinds of resources).
+                                    
+                                    References to a resource in a different namespace are invalid UNLESS there
+                                    is a ReferenceGrant in the target namespace that allows the certificate
+                                    to be attached. If a ReferenceGrant does not allow this reference, the
+                                    "ResolvedRefs" condition MUST be set to False for this listener with the
+                                    "RefNotPermitted" reason.
+                                  items:
+                                    description: |-
+                                      ObjectReference identifies an API object including its namespace.
+                                      
+                                      The API object must be valid in the cluster; the Group and Kind must
+                                      be registered in the cluster for this reference to be valid.
+                                      
+                                      References to objects with invalid Group and Kind are not valid, and must
+                                      be rejected by the implementation, with appropriate Conditions set
+                                      on the containing object.
+                                    properties:
+                                      group:
+                                        description: |-
+                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                          When set to the empty string, core API group is inferred.
+                                        maxLength: 253
+                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                      kind:
+                                        description: Kind is kind of the referent. For
+                                          example "ConfigMap" or "Service".
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                        type: string
+                                      name:
+                                        description: Name is the name of the referent.
+                                        maxLength: 253
+                                        minLength: 1
+                                        type: string
+                                      namespace:
+                                        description: |-
+                                          Namespace is the namespace of the referenced object. When unspecified, the local
+                                          namespace is inferred.
+                                          
+                                          Note that when a namespace different than the local namespace is specified,
+                                          a ReferenceGrant object is required in the referent namespace to allow that
+                                          namespace's owner to accept the reference. See the ReferenceGrant
+                                          documentation for details.
+                                          
+                                          Support: Core
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                        type: string
+                                    required:
+                                      - group
+                                      - kind
+                                      - name
+                                    type: object
+                                  maxItems: 8
+                                  minItems: 1
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mode:
+                                  default: AllowValidOnly
+                                  description: |-
+                                    FrontendValidationMode defines the mode for validating the client certificate.
+                                    There are two possible modes:
+                                    
+                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                      the client presents a valid certificate. This certificate must successfully
+                                      pass validation against the CA certificates specified in `CACertificateRefs`.
+                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                      even if the client certificate is not presented or fails verification.
+                                    
+                                      This approach delegates client authorization to the backend and introduce
+                                      a significant security risk. It should be used in testing environments or
+                                      on a temporary basis in non-testing environments.
+                                    
+                                    Defaults to AllowValidOnly.
+                                    
+                                    Support: Core
+                                  enum:
+                                    - AllowValidOnly
+                                    - AllowInsecureFallback
+                                  type: string
+                              required:
+                                - caCertificateRefs
+                              type: object
+                          type: object
+                        perPort:
+                          description: |-
+                            PerPort specifies tls configuration assigned per port.
+                            Per port configuration is optional. Once set this configuration overrides
+                            the default configuration for all Listeners handling HTTPS traffic
+                            that match this port.
+                            Each override port requires a unique TLS configuration.
+                            
+                            support: Core
+                          items:
+                            properties:
+                              port:
+                                description: |-
+                                  The Port indicates the Port Number to which the TLS configuration will be
+                                  applied. This configuration will be applied to all Listeners handling HTTPS
+                                  traffic that match this port.
+                                  
+                                  Support: Core
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                              tls:
+                                description: |-
+                                  TLS store the configuration that will be applied to all Listeners handling
+                                  HTTPS traffic and matching given port.
+                                  
+                                  Support: Core
+                                properties:
+                                  validation:
+                                    description: |-
+                                      Validation holds configuration information for validating the frontend (client).
+                                      Setting this field will result in mutual authentication when connecting to the gateway.
+                                      In browsers this may result in a dialog appearing
+                                      that requests a user to specify the client certificate.
+                                      The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                      
+                                      Support: Core
+                                    properties:
+                                      caCertificateRefs:
+                                        description: |-
+                                          CACertificateRefs contains one or more references to
+                                          Kubernetes objects that contain TLS certificates of
+                                          the Certificate Authorities that can be used
+                                          as a trust anchor to validate the certificates presented by the client.
+                                          
+                                          A single CA certificate reference to a Kubernetes ConfigMap
+                                          has "Core" support.
+                                          Implementations MAY choose to support attaching multiple CA certificates to
+                                          a Listener, but this behavior is implementation-specific.
+                                          
+                                          Support: Core - A single reference to a Kubernetes ConfigMap
+                                          with the CA certificate in a key named `ca.crt`.
+                                          
+                                          Support: Implementation-specific (More than one certificate in a ConfigMap
+                                          with different keys or more than one reference, or other kinds of resources).
+                                          
+                                          References to a resource in a different namespace are invalid UNLESS there
+                                          is a ReferenceGrant in the target namespace that allows the certificate
+                                          to be attached. If a ReferenceGrant does not allow this reference, the
+                                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                                          "RefNotPermitted" reason.
+                                        items:
+                                          description: |-
+                                            ObjectReference identifies an API object including its namespace.
+                                            
+                                            The API object must be valid in the cluster; the Group and Kind must
+                                            be registered in the cluster for this reference to be valid.
+                                            
+                                            References to objects with invalid Group and Kind are not valid, and must
+                                            be rejected by the implementation, with appropriate Conditions set
+                                            on the containing object.
+                                          properties:
+                                            group:
+                                              description: |-
+                                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                                When set to the empty string, core API group is inferred.
+                                              maxLength: 253
+                                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
+                                            kind:
+                                              description: Kind is kind of the referent.
+                                                For example "ConfigMap" or "Service".
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                              type: string
+                                            name:
+                                              description: Name is the name of the referent.
+                                              maxLength: 253
+                                              minLength: 1
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                                namespace is inferred.
+                                                
+                                                Note that when a namespace different than the local namespace is specified,
+                                                a ReferenceGrant object is required in the referent namespace to allow that
+                                                namespace's owner to accept the reference. See the ReferenceGrant
+                                                documentation for details.
+                                                
+                                                Support: Core
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                              type: string
+                                          required:
+                                            - group
+                                            - kind
+                                            - name
+                                          type: object
+                                        maxItems: 8
+                                        minItems: 1
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mode:
+                                        default: AllowValidOnly
+                                        description: |-
+                                          FrontendValidationMode defines the mode for validating the client certificate.
+                                          There are two possible modes:
+                                          
+                                          - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                            the client presents a valid certificate. This certificate must successfully
+                                            pass validation against the CA certificates specified in `CACertificateRefs`.
+                                          - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                            even if the client certificate is not presented or fails verification.
+                                          
+                                            This approach delegates client authorization to the backend and introduce
+                                            a significant security risk. It should be used in testing environments or
+                                            on a temporary basis in non-testing environments.
+                                          
+                                          Defaults to AllowValidOnly.
+                                          
+                                          Support: Core
+                                        enum:
+                                          - AllowValidOnly
+                                          - AllowInsecureFallback
+                                        type: string
+                                    required:
+                                      - caCertificateRefs
+                                    type: object
+                                type: object
+                            required:
+                              - port
+                              - tls
+                            type: object
+                          maxItems: 64
+                          type: array
+                          x-kubernetes-list-map-keys:
+                            - port
+                          x-kubernetes-list-type: map
+                          x-kubernetes-validations:
+                            - message: Port for TLS configuration must be unique within
+                                the Gateway
+                              rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                      required:
+                        - default
+                      type: object
+                  type: object
               required:
                 - gatewayClassName
                 - listeners
@@ -2318,6 +3260,7 @@ spec:
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 conditions:
                   default:
                     - lastTransitionTime: "1970-01-01T00:00:00Z"
@@ -2531,6 +3474,7 @@ spec:
                           type: object
                         maxItems: 8
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                       - attachedRoutes
                       - conditions
@@ -2595,7 +3539,7 @@ spec:
                     Addresses requested for this Gateway. This is optional and behavior can
                     depend on the implementation. If a value is set in the spec and the
                     requested address is invalid or unavailable, the implementation MUST
-                    indicate this in the associated entry in GatewayStatus.Addresses.
+                    indicate this in an associated entry in GatewayStatus.Conditions.
                     
                     The Addresses field represents a request for the address(es) on the
                     "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -2650,19 +3594,22 @@ spec:
                         type: string
                     type: object
                     x-kubernetes-validations:
-                      - message: Hostname value must only contain valid characters (matching
-                          ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                        rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                      - message: Hostname value must be empty or contain only valid characters
+                          (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                        rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: IPAddress values must be unique
-                      rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                     - message: Hostname values must be unique
-                      rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 allowedListeners:
                   description: |-
                     AllowedListeners defines which ListenerSets can be attached to this Gateway.
@@ -2744,70 +3691,29 @@ spec:
                           x-kubernetes-map-type: atomic
                       type: object
                   type: object
-                backendTLS:
+                defaultScope:
                   description: |-
-                    BackendTLS configures TLS settings for when this Gateway is connecting to
-                    backends with TLS.
+                    DefaultScope, when set, configures the Gateway as a default Gateway,
+                    meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                    attached to it, according to the scope configured here.
                     
-                    Support: Core
-                  properties:
-                    clientCertificateRef:
-                      description: |-
-                        ClientCertificateRef is a reference to an object that contains a Client
-                        Certificate and the associated private key.
-                        
-                        References to a resource in different namespace are invalid UNLESS there
-                        is a ReferenceGrant in the target namespace that allows the certificate
-                        to be attached. If a ReferenceGrant does not allow this reference, the
-                        "ResolvedRefs" condition MUST be set to False for this listener with the
-                        "RefNotPermitted" reason.
-                        
-                        ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                        Secret, or implementation-specific custom resources.
-                        
-                        This setting can be overridden on the service level by use of BackendTLSPolicy.
-                        
-                        Support: Core
-                      properties:
-                        group:
-                          default: ""
-                          description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                          type: string
-                        kind:
-                          default: Secret
-                          description: Kind is kind of the referent. For example "Secret".
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: |-
-                            Namespace is the namespace of the referenced object. When unspecified, the local
-                            namespace is inferred.
-                            
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-                            
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                      required:
-                        - name
-                      type: object
-                  type: object
+                    If unset (the default) or set to None, the Gateway will not act as a
+                    default Gateway; if set, the Gateway will claim any Route with a
+                    matching scope set in its UseDefaultGateway field, subject to the usual
+                    rules about which routes the Gateway can attach to.
+                    
+                    Think carefully before using this functionality! While the normal rules
+                    about which Route can apply are still enforced, it is simply easier for
+                    the wrong Route to be accidentally attached to this Gateway in this
+                    configuration. If the Gateway operator is not also the operator in
+                    control of the scope (e.g. namespace) with tight controls and checks on
+                    what kind of workloads and Routes get added in that scope, we strongly
+                    recommend not using this just because it seems convenient, and instead
+                    stick to direct Route attachment.
+                  enum:
+                    - All
+                    - None
+                  type: string
                 gatewayClassName:
                   description: |-
                     GatewayClassName used for this Gateway. This is the name of a
@@ -3163,6 +4069,7 @@ spec:
                               type: object
                             maxItems: 8
                             type: array
+                            x-kubernetes-list-type: atomic
                           namespaces:
                             default:
                               from: Same
@@ -3330,7 +4237,7 @@ spec:
                           the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
                           if the Protocol field is "HTTP", "TCP", or "UDP".
                           
-                          The association of SNIs to Certificate defined in GatewayTLSConfig is
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
                           defined based on the Hostname field for this listener.
                           
                           The GatewayClass MUST use the longest matching SNI out of all
@@ -3417,93 +4324,7 @@ spec:
                               type: object
                             maxItems: 64
                             type: array
-                          frontendValidation:
-                            description: |-
-                              FrontendValidation holds configuration information for validating the frontend (client).
-                              Setting this field will require clients to send a client certificate
-                              required for validation during the TLS handshake. In browsers this may result in a dialog appearing
-                              that requests a user to specify the client certificate.
-                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
-                              
-                              Support: Extended
-                            properties:
-                              caCertificateRefs:
-                                description: |-
-                                  CACertificateRefs contains one or more references to
-                                  Kubernetes objects that contain TLS certificates of
-                                  the Certificate Authorities that can be used
-                                  as a trust anchor to validate the certificates presented by the client.
-                                  
-                                  A single CA certificate reference to a Kubernetes ConfigMap
-                                  has "Core" support.
-                                  Implementations MAY choose to support attaching multiple CA certificates to
-                                  a Listener, but this behavior is implementation-specific.
-                                  
-                                  Support: Core - A single reference to a Kubernetes ConfigMap
-                                  with the CA certificate in a key named `ca.crt`.
-                                  
-                                  Support: Implementation-specific (More than one reference, or other kinds
-                                  of resources).
-                                  
-                                  References to a resource in a different namespace are invalid UNLESS there
-                                  is a ReferenceGrant in the target namespace that allows the certificate
-                                  to be attached. If a ReferenceGrant does not allow this reference, the
-                                  "ResolvedRefs" condition MUST be set to False for this listener with the
-                                  "RefNotPermitted" reason.
-                                items:
-                                  description: |-
-                                    ObjectReference identifies an API object including its namespace.
-                                    
-                                    The API object must be valid in the cluster; the Group and Kind must
-                                    be registered in the cluster for this reference to be valid.
-                                    
-                                    References to objects with invalid Group and Kind are not valid, and must
-                                    be rejected by the implementation, with appropriate Conditions set
-                                    on the containing object.
-                                  properties:
-                                    group:
-                                      description: |-
-                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                        When set to the empty string, core API group is inferred.
-                                      maxLength: 253
-                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                      type: string
-                                    kind:
-                                      description: Kind is kind of the referent. For
-                                        example "ConfigMap" or "Service".
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                      type: string
-                                    name:
-                                      description: Name is the name of the referent.
-                                      maxLength: 253
-                                      minLength: 1
-                                      type: string
-                                    namespace:
-                                      description: |-
-                                        Namespace is the namespace of the referenced object. When unspecified, the local
-                                        namespace is inferred.
-                                        
-                                        Note that when a namespace different than the local namespace is specified,
-                                        a ReferenceGrant object is required in the referent namespace to allow that
-                                        namespace's owner to accept the reference. See the ReferenceGrant
-                                        documentation for details.
-                                        
-                                        Support: Core
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                      type: string
-                                  required:
-                                    - group
-                                    - kind
-                                    - name
-                                  type: object
-                                maxItems: 8
-                                minItems: 1
-                                type: array
-                            type: object
+                            x-kubernetes-list-type: atomic
                           mode:
                             default: Terminate
                             description: |-
@@ -3582,6 +4403,366 @@ spec:
                       rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
                     == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
+                tls:
+                  description: |-
+                    TLS specifies frontend and backend tls configuration for entire gateway.
+                    
+                    Support: Extended
+                  properties:
+                    backend:
+                      description: |-
+                        Backend describes TLS configuration for gateway when connecting
+                        to backends.
+                        
+                        Note that this contains only details for the Gateway as a TLS client,
+                        and does _not_ imply behavior about how to choose which backend should
+                        get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+                        
+                        Support: Core
+                      properties:
+                        clientCertificateRef:
+                          description: |-
+                            ClientCertificateRef is a reference to an object that contains a Client
+                            Certificate and the associated private key.
+                            
+                            References to a resource in different namespace are invalid UNLESS there
+                            is a ReferenceGrant in the target namespace that allows the certificate
+                            to be attached. If a ReferenceGrant does not allow this reference, the
+                            "ResolvedRefs" condition MUST be set to False for this listener with the
+                            "RefNotPermitted" reason.
+                            
+                            ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                            Secret, or implementation-specific custom resources.
+                            
+                            Support: Core
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Secret
+                              description: Kind is kind of the referent. For example
+                                "Secret".
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    frontend:
+                      description: |-
+                        Frontend describes TLS config when client connects to Gateway.
+                        Support: Core
+                      properties:
+                        default:
+                          description: |-
+                            Default specifies the default client certificate validation configuration
+                            for all Listeners handling HTTPS traffic, unless a per-port configuration
+                            is defined.
+                            
+                            support: Core
+                          properties:
+                            validation:
+                              description: |-
+                                Validation holds configuration information for validating the frontend (client).
+                                Setting this field will result in mutual authentication when connecting to the gateway.
+                                In browsers this may result in a dialog appearing
+                                that requests a user to specify the client certificate.
+                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                
+                                Support: Core
+                              properties:
+                                caCertificateRefs:
+                                  description: |-
+                                    CACertificateRefs contains one or more references to
+                                    Kubernetes objects that contain TLS certificates of
+                                    the Certificate Authorities that can be used
+                                    as a trust anchor to validate the certificates presented by the client.
+                                    
+                                    A single CA certificate reference to a Kubernetes ConfigMap
+                                    has "Core" support.
+                                    Implementations MAY choose to support attaching multiple CA certificates to
+                                    a Listener, but this behavior is implementation-specific.
+                                    
+                                    Support: Core - A single reference to a Kubernetes ConfigMap
+                                    with the CA certificate in a key named `ca.crt`.
+                                    
+                                    Support: Implementation-specific (More than one certificate in a ConfigMap
+                                    with different keys or more than one reference, or other kinds of resources).
+                                    
+                                    References to a resource in a different namespace are invalid UNLESS there
+                                    is a ReferenceGrant in the target namespace that allows the certificate
+                                    to be attached. If a ReferenceGrant does not allow this reference, the
+                                    "ResolvedRefs" condition MUST be set to False for this listener with the
+                                    "RefNotPermitted" reason.
+                                  items:
+                                    description: |-
+                                      ObjectReference identifies an API object including its namespace.
+                                      
+                                      The API object must be valid in the cluster; the Group and Kind must
+                                      be registered in the cluster for this reference to be valid.
+                                      
+                                      References to objects with invalid Group and Kind are not valid, and must
+                                      be rejected by the implementation, with appropriate Conditions set
+                                      on the containing object.
+                                    properties:
+                                      group:
+                                        description: |-
+                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                          When set to the empty string, core API group is inferred.
+                                        maxLength: 253
+                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                      kind:
+                                        description: Kind is kind of the referent. For
+                                          example "ConfigMap" or "Service".
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                        type: string
+                                      name:
+                                        description: Name is the name of the referent.
+                                        maxLength: 253
+                                        minLength: 1
+                                        type: string
+                                      namespace:
+                                        description: |-
+                                          Namespace is the namespace of the referenced object. When unspecified, the local
+                                          namespace is inferred.
+                                          
+                                          Note that when a namespace different than the local namespace is specified,
+                                          a ReferenceGrant object is required in the referent namespace to allow that
+                                          namespace's owner to accept the reference. See the ReferenceGrant
+                                          documentation for details.
+                                          
+                                          Support: Core
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                        type: string
+                                    required:
+                                      - group
+                                      - kind
+                                      - name
+                                    type: object
+                                  maxItems: 8
+                                  minItems: 1
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mode:
+                                  default: AllowValidOnly
+                                  description: |-
+                                    FrontendValidationMode defines the mode for validating the client certificate.
+                                    There are two possible modes:
+                                    
+                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                      the client presents a valid certificate. This certificate must successfully
+                                      pass validation against the CA certificates specified in `CACertificateRefs`.
+                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                      even if the client certificate is not presented or fails verification.
+                                    
+                                      This approach delegates client authorization to the backend and introduce
+                                      a significant security risk. It should be used in testing environments or
+                                      on a temporary basis in non-testing environments.
+                                    
+                                    Defaults to AllowValidOnly.
+                                    
+                                    Support: Core
+                                  enum:
+                                    - AllowValidOnly
+                                    - AllowInsecureFallback
+                                  type: string
+                              required:
+                                - caCertificateRefs
+                              type: object
+                          type: object
+                        perPort:
+                          description: |-
+                            PerPort specifies tls configuration assigned per port.
+                            Per port configuration is optional. Once set this configuration overrides
+                            the default configuration for all Listeners handling HTTPS traffic
+                            that match this port.
+                            Each override port requires a unique TLS configuration.
+                            
+                            support: Core
+                          items:
+                            properties:
+                              port:
+                                description: |-
+                                  The Port indicates the Port Number to which the TLS configuration will be
+                                  applied. This configuration will be applied to all Listeners handling HTTPS
+                                  traffic that match this port.
+                                  
+                                  Support: Core
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                              tls:
+                                description: |-
+                                  TLS store the configuration that will be applied to all Listeners handling
+                                  HTTPS traffic and matching given port.
+                                  
+                                  Support: Core
+                                properties:
+                                  validation:
+                                    description: |-
+                                      Validation holds configuration information for validating the frontend (client).
+                                      Setting this field will result in mutual authentication when connecting to the gateway.
+                                      In browsers this may result in a dialog appearing
+                                      that requests a user to specify the client certificate.
+                                      The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                      
+                                      Support: Core
+                                    properties:
+                                      caCertificateRefs:
+                                        description: |-
+                                          CACertificateRefs contains one or more references to
+                                          Kubernetes objects that contain TLS certificates of
+                                          the Certificate Authorities that can be used
+                                          as a trust anchor to validate the certificates presented by the client.
+                                          
+                                          A single CA certificate reference to a Kubernetes ConfigMap
+                                          has "Core" support.
+                                          Implementations MAY choose to support attaching multiple CA certificates to
+                                          a Listener, but this behavior is implementation-specific.
+                                          
+                                          Support: Core - A single reference to a Kubernetes ConfigMap
+                                          with the CA certificate in a key named `ca.crt`.
+                                          
+                                          Support: Implementation-specific (More than one certificate in a ConfigMap
+                                          with different keys or more than one reference, or other kinds of resources).
+                                          
+                                          References to a resource in a different namespace are invalid UNLESS there
+                                          is a ReferenceGrant in the target namespace that allows the certificate
+                                          to be attached. If a ReferenceGrant does not allow this reference, the
+                                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                                          "RefNotPermitted" reason.
+                                        items:
+                                          description: |-
+                                            ObjectReference identifies an API object including its namespace.
+                                            
+                                            The API object must be valid in the cluster; the Group and Kind must
+                                            be registered in the cluster for this reference to be valid.
+                                            
+                                            References to objects with invalid Group and Kind are not valid, and must
+                                            be rejected by the implementation, with appropriate Conditions set
+                                            on the containing object.
+                                          properties:
+                                            group:
+                                              description: |-
+                                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                                When set to the empty string, core API group is inferred.
+                                              maxLength: 253
+                                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
+                                            kind:
+                                              description: Kind is kind of the referent.
+                                                For example "ConfigMap" or "Service".
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                              type: string
+                                            name:
+                                              description: Name is the name of the referent.
+                                              maxLength: 253
+                                              minLength: 1
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                                namespace is inferred.
+                                                
+                                                Note that when a namespace different than the local namespace is specified,
+                                                a ReferenceGrant object is required in the referent namespace to allow that
+                                                namespace's owner to accept the reference. See the ReferenceGrant
+                                                documentation for details.
+                                                
+                                                Support: Core
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                              type: string
+                                          required:
+                                            - group
+                                            - kind
+                                            - name
+                                          type: object
+                                        maxItems: 8
+                                        minItems: 1
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mode:
+                                        default: AllowValidOnly
+                                        description: |-
+                                          FrontendValidationMode defines the mode for validating the client certificate.
+                                          There are two possible modes:
+                                          
+                                          - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                            the client presents a valid certificate. This certificate must successfully
+                                            pass validation against the CA certificates specified in `CACertificateRefs`.
+                                          - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                            even if the client certificate is not presented or fails verification.
+                                          
+                                            This approach delegates client authorization to the backend and introduce
+                                            a significant security risk. It should be used in testing environments or
+                                            on a temporary basis in non-testing environments.
+                                          
+                                          Defaults to AllowValidOnly.
+                                          
+                                          Support: Core
+                                        enum:
+                                          - AllowValidOnly
+                                          - AllowInsecureFallback
+                                        type: string
+                                    required:
+                                      - caCertificateRefs
+                                    type: object
+                                type: object
+                            required:
+                              - port
+                              - tls
+                            type: object
+                          maxItems: 64
+                          type: array
+                          x-kubernetes-list-map-keys:
+                            - port
+                          x-kubernetes-list-type: map
+                          x-kubernetes-validations:
+                            - message: Port for TLS configuration must be unique within
+                                the Gateway
+                              rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                      required:
+                        - default
+                      type: object
+                  type: object
               required:
                 - gatewayClassName
                 - listeners
@@ -3656,6 +4837,7 @@ spec:
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 conditions:
                   default:
                     - lastTransitionTime: "1970-01-01T00:00:00Z"
@@ -3869,6 +5051,7 @@ spec:
                           type: object
                         maxItems: 8
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                       - attachedRoutes
                       - conditions
@@ -3903,9 +5086,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -4051,6 +5233,7 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
                   description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
@@ -4263,6 +5446,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -4884,6 +6068,7 @@ spec:
                                     rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
                                 - message: RequestHeaderModifier filter cannot be repeated
                                   rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
@@ -4980,6 +6165,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -5530,6 +6716,7 @@ spec:
                               rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: RequestHeaderModifier filter cannot be repeated
                             rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
@@ -5707,6 +6894,7 @@ spec:
                           type: object
                         maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -5808,6 +6996,7 @@ spec:
                     type: object
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -5832,6 +7021,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of GRPCRoute.
@@ -6096,14 +7303,18 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
+          required:
+            - spec
           type: object
       served: true
       storage: true
@@ -6124,9 +7335,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -6252,6 +7462,7 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
                   description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
@@ -6464,6 +7675,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -6589,16 +7801,14 @@ spec:
                                           AllowCredentials indicates whether the actual cross-origin request allows
                                           to include credentials.
                                           
-                                          The only valid value for the `Access-Control-Allow-Credentials` response
-                                          header is true (case-sensitive).
+                                          When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                          response header with value true (case-sensitive).
                                           
-                                          If the credentials are not allowed in cross-origin requests, the gateway
-                                          will omit the header `Access-Control-Allow-Credentials` entirely rather
-                                          than setting its value to false.
+                                          When set to false or omitted the gateway will omit the header
+                                          `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                          behavior).
                                           
                                           Support: Extended
-                                        enum:
-                                          - true
                                         type: boolean
                                       allowHeaders:
                                         description: |-
@@ -6625,9 +7835,9 @@ spec:
                                           
                                           A wildcard indicates that the requests with all HTTP headers are allowed.
                                           The `Access-Control-Allow-Headers` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                          When the `AllowCredentials` field is true and `AllowHeaders` field
                                           specified with the `*` wildcard, the gateway must specify one or more
                                           HTTP headers in the value of the `Access-Control-Allow-Headers` response
                                           header. The value of the header `Access-Control-Allow-Headers` is same as
@@ -6688,9 +7898,9 @@ spec:
                                           side.
                                           
                                           The `Access-Control-Allow-Methods` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowMethods` field
+                                          When the `AllowCredentials` field is true and `AllowMethods` field
                                           specified with the `*` wildcard, the gateway must specify one HTTP method
                                           in the value of the Access-Control-Allow-Methods response header. The
                                           value of the header `Access-Control-Allow-Methods` is same as the
@@ -6766,9 +7976,9 @@ spec:
                                           Therefore, the client doesn't attempt the actual cross-origin request.
                                           
                                           The `Access-Control-Allow-Origin` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                          When the `AllowCredentials` field is true and `AllowOrigins` field
                                           specified with the `*` wildcard, the gateway must return a single origin
                                           in the value of the `Access-Control-Allow-Origin` response header,
                                           instead of specifying the `*` wildcard. The value of the header
@@ -6778,18 +7988,22 @@ spec:
                                           Support: Extended
                                         items:
                                           description: |-
-                                            The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                            encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                            include an authority MUST include a fully qualified domain name or
+                                            The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                            encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                            URIs that include an authority MUST include a fully qualified domain name or
                                             IP address as the host.
                                           maxLength: 253
                                           minLength: 1
-                                          pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                          pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                           type: string
                                         maxItems: 64
                                         type: array
                                         x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowOrigins cannot contain '*' alongside
+                                              other origins
+                                            rule: '!(''*'' in self && self.size() > 1)'
                                       exposeHeaders:
                                         description: |-
                                           ExposeHeaders indicates which HTTP response headers can be exposed
@@ -6819,8 +8033,7 @@ spec:
                                           
                                           A wildcard indicates that the responses with all HTTP headers are exposed
                                           to clients. The `Access-Control-Expose-Headers` response header can only
-                                          use `*` wildcard as value when the `AllowCredentials` field is
-                                          unspecified.
+                                          use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
                                           Support: Extended
                                         items:
@@ -6895,6 +8108,253 @@ spec:
                                       - kind
                                       - name
                                     type: object
+                                  externalAuth:
+                                    description: |-
+                                      ExternalAuth configures settings related to sending request details
+                                      to an external auth service. The external service MUST authenticate
+                                      the request, and MAY authorize the request as well.
+                                      
+                                      If there is any problem communicating with the external service,
+                                      this filter MUST fail closed.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef is a reference to a backend to send authorization
+                                          requests to.
+                                          
+                                          The backend must speak the selected protocol (GRPC or HTTP) on the
+                                          referenced port.
+                                          
+                                          If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                          implementation to supply the TLS details to be used to connect to that
+                                          backend.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+                                              
+                                              Defaults to "Service" when not specified.
+                                              
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+                                              
+                                              Support: Core (Services with a type other than ExternalName)
+                                              
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+                                              
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+                                              
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                          - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                          - message: Must have port for Service reference
+                                            rule: '(size(self.group) == 0 && self.kind
+                                          == ''Service'') ? has(self.port) : true'
+                                      forwardBody:
+                                        description: |-
+                                          ForwardBody controls if requests to the authorization server should include
+                                          the body of the client request; and if so, how big that body is allowed
+                                          to be.
+                                          
+                                          It is expected that implementations will buffer the request body up to
+                                          `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                          4xx series error (413 or 403 are common examples), and fail processing
+                                          of the filter.
+                                          
+                                          If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                          be forwarded.
+                                          
+                                          Feature Name: HTTPRouteExternalAuthForwardBody
+                                        properties:
+                                          maxSize:
+                                            description: |-
+                                              MaxSize specifies how large in bytes the largest body that will be buffered
+                                              and sent to the authorization server. If the body size is larger than
+                                              `maxSize`, then the body sent to the authorization server must be
+                                              truncated to `maxSize` bytes.
+                                              
+                                              Experimental note: This behavior needs to be checked against
+                                              various dataplanes; it may need to be changed.
+                                              See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                              for more.
+                                              
+                                              If 0, the body will not be sent to the authorization server.
+                                            type: integer
+                                        type: object
+                                      grpc:
+                                        description: |-
+                                          GRPCAuthConfig contains configuration for communication with ext_authz
+                                          protocol-speaking backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              If this list is empty, then all headers must be sent.
+                                              
+                                              If the list has entries, only those entries must be sent.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        type: object
+                                      http:
+                                        description: |-
+                                          HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                          backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what additional headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              The following headers must always be sent to the authorization server,
+                                              regardless of this setting:
+                                              
+                                              * `Host`
+                                              * `Method`
+                                              * `Path`
+                                              * `Content-Length`
+                                              * `Authorization`
+                                              
+                                              If this list is empty, then only those headers must be sent.
+                                              
+                                              Note that `Content-Length` has a special behavior, in that the length
+                                              sent must be correct for the actual request to the external authorization
+                                              server - that is, it must reflect the actual number of bytes sent in the
+                                              body of the request to the authorization server.
+                                              
+                                              So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                              to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                              to anything other than `0`, then the `Content-Length` of the authorization
+                                              request must be set to the actual number of bytes forwarded.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          allowedResponseHeaders:
+                                            description: |-
+                                              AllowedResponseHeaders specifies what headers from the authorization response
+                                              will be copied into the request to the backend.
+                                              
+                                              If this list is empty, then all headers from the authorization server
+                                              except Authority or Host must be copied.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          path:
+                                            description: |-
+                                              Path sets the prefix that paths from the client request will have added
+                                              when forwarded to the authorization server.
+                                              
+                                              When empty or unspecified, no prefix is added.
+                                              
+                                              Valid values are the same as the "value" regex for path values in the `match`
+                                              stanza, and the validation regex will screen out invalid paths in the same way.
+                                              Even with the validation, implementations MUST sanitize this input before using it
+                                              directly.
+                                            maxLength: 1024
+                                            pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                            type: string
+                                        type: object
+                                      protocol:
+                                        description: |-
+                                          ExternalAuthProtocol describes which protocol to use when communicating with an
+                                          ext_authz authorization server.
+                                          
+                                          When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                          on the port specified in `backendRefs`. Requests and responses are defined
+                                          in the protobufs explained at:
+                                          https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                          
+                                          When this is set to HTTP, each backend must respond with a `200` status
+                                          code in on a successful authorization. Any other code is considered
+                                          an authorization failure.
+                                          
+                                          Feature Names:
+                                          GRPC Support - HTTPRouteExternalAuthGRPC
+                                          HTTP Support - HTTPRouteExternalAuthHTTP
+                                        enum:
+                                          - HTTP
+                                          - GRPC
+                                        type: string
+                                    required:
+                                      - backendRef
+                                      - protocol
+                                    type: object
+                                    x-kubernetes-validations:
+                                      - message: grpc must be specified when protocol
+                                          is set to 'GRPC'
+                                        rule: 'self.protocol == ''GRPC'' ? has(self.grpc)
+                                      : true'
+                                      - message: protocol must be 'GRPC' when grpc is
+                                          set
+                                        rule: 'has(self.grpc) ? self.protocol == ''GRPC''
+                                      : true'
+                                      - message: http must be specified when protocol
+                                          is set to 'HTTP'
+                                        rule: 'self.protocol == ''HTTP'' ? has(self.http)
+                                      : true'
+                                      - message: protocol must be 'HTTP' when http is
+                                          set
+                                        rule: 'has(self.http) ? self.protocol == ''HTTP''
+                                      : true'
                                   requestHeaderModifier:
                                     description: |-
                                       RequestHeaderModifier defines a schema for a filter that modifies request
@@ -7508,6 +8968,7 @@ spec:
                                       - URLRewrite
                                       - ExtensionRef
                                       - CORS
+                                      - ExternalAuth
                                     type: string
                                   urlRewrite:
                                     description: |-
@@ -7645,13 +9106,16 @@ spec:
                                     rule: '!(has(self.cors) && self.type != ''CORS'')'
                                   - message: filter.cors must be specified for CORS filter.type
                                     rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                                  - message: filter.externalAuth must be nil if the filter.type
+                                      is not ExternalAuth
+                                    rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                                  - message: filter.externalAuth must be specified for
+                                      ExternalAuth filter.type
+                                    rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
-                                - message: May specify either httpRouteFilterRequestRedirect
-                                    or httpRouteFilterRequestRewrite, but not both
-                                  rule: '!(self.exists(f, f.type == ''RequestRedirect'')
-                                && self.exists(f, f.type == ''URLRewrite''))'
                                 - message: May specify either httpRouteFilterRequestRedirect
                                     or httpRouteFilterRequestRewrite, but not both
                                   rule: '!(self.exists(f, f.type == ''RequestRedirect'')
@@ -7757,6 +9221,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -7816,16 +9281,14 @@ spec:
                                     AllowCredentials indicates whether the actual cross-origin request allows
                                     to include credentials.
                                     
-                                    The only valid value for the `Access-Control-Allow-Credentials` response
-                                    header is true (case-sensitive).
+                                    When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                    response header with value true (case-sensitive).
                                     
-                                    If the credentials are not allowed in cross-origin requests, the gateway
-                                    will omit the header `Access-Control-Allow-Credentials` entirely rather
-                                    than setting its value to false.
+                                    When set to false or omitted the gateway will omit the header
+                                    `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                    behavior).
                                     
                                     Support: Extended
-                                  enum:
-                                    - true
                                   type: boolean
                                 allowHeaders:
                                   description: |-
@@ -7852,9 +9315,9 @@ spec:
                                     
                                     A wildcard indicates that the requests with all HTTP headers are allowed.
                                     The `Access-Control-Allow-Headers` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                    When the `AllowCredentials` field is true and `AllowHeaders` field
                                     specified with the `*` wildcard, the gateway must specify one or more
                                     HTTP headers in the value of the `Access-Control-Allow-Headers` response
                                     header. The value of the header `Access-Control-Allow-Headers` is same as
@@ -7915,9 +9378,9 @@ spec:
                                     side.
                                     
                                     The `Access-Control-Allow-Methods` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowMethods` field
+                                    When the `AllowCredentials` field is true and `AllowMethods` field
                                     specified with the `*` wildcard, the gateway must specify one HTTP method
                                     in the value of the Access-Control-Allow-Methods response header. The
                                     value of the header `Access-Control-Allow-Methods` is same as the
@@ -7993,9 +9456,9 @@ spec:
                                     Therefore, the client doesn't attempt the actual cross-origin request.
                                     
                                     The `Access-Control-Allow-Origin` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                    When the `AllowCredentials` field is true and `AllowOrigins` field
                                     specified with the `*` wildcard, the gateway must return a single origin
                                     in the value of the `Access-Control-Allow-Origin` response header,
                                     instead of specifying the `*` wildcard. The value of the header
@@ -8005,18 +9468,22 @@ spec:
                                     Support: Extended
                                   items:
                                     description: |-
-                                      The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                      encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                      include an authority MUST include a fully qualified domain name or
+                                      The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                      encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                      URIs that include an authority MUST include a fully qualified domain name or
                                       IP address as the host.
                                     maxLength: 253
                                     minLength: 1
-                                    pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                    pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                     type: string
                                   maxItems: 64
                                   type: array
                                   x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowOrigins cannot contain '*' alongside
+                                        other origins
+                                      rule: '!(''*'' in self && self.size() > 1)'
                                 exposeHeaders:
                                   description: |-
                                     ExposeHeaders indicates which HTTP response headers can be exposed
@@ -8046,8 +9513,7 @@ spec:
                                     
                                     A wildcard indicates that the responses with all HTTP headers are exposed
                                     to clients. The `Access-Control-Expose-Headers` response header can only
-                                    use `*` wildcard as value when the `AllowCredentials` field is
-                                    unspecified.
+                                    use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
                                     Support: Extended
                                   items:
@@ -8122,6 +9588,251 @@ spec:
                                 - kind
                                 - name
                               type: object
+                            externalAuth:
+                              description: |-
+                                ExternalAuth configures settings related to sending request details
+                                to an external auth service. The external service MUST authenticate
+                                the request, and MAY authorize the request as well.
+                                
+                                If there is any problem communicating with the external service,
+                                this filter MUST fail closed.
+                                
+                                Support: Extended
+                              properties:
+                                backendRef:
+                                  description: |-
+                                    BackendRef is a reference to a backend to send authorization
+                                    requests to.
+                                    
+                                    The backend must speak the selected protocol (GRPC or HTTP) on the
+                                    referenced port.
+                                    
+                                    If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                    implementation to supply the TLS details to be used to connect to that
+                                    backend.
+                                  properties:
+                                    group:
+                                      default: ""
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When unspecified or empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Service
+                                      description: |-
+                                        Kind is the Kubernetes resource kind of the referent. For example
+                                        "Service".
+                                        
+                                        Defaults to "Service" when not specified.
+                                        
+                                        ExternalName services can refer to CNAME DNS records that may live
+                                        outside of the cluster and as such are difficult to reason about in
+                                        terms of conformance. They also may not be safe to forward to (see
+                                        CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                        support ExternalName Services.
+                                        
+                                        Support: Core (Services with a type other than ExternalName)
+                                        
+                                        Support: Implementation-specific (Services with type ExternalName)
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the backend. When unspecified, the local
+                                        namespace is inferred.
+                                        
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+                                        
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port specifies the destination port number to use for this resource.
+                                        Port is required when the referent is a Kubernetes Service. In this
+                                        case, the port number is the service port number, not the target port.
+                                        For other resources, destination port might be derived from the referent
+                                        resource or this field.
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                  required:
+                                    - name
+                                  type: object
+                                  x-kubernetes-validations:
+                                    - message: Must have port for Service reference
+                                      rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                                    ? has(self.port) : true'
+                                forwardBody:
+                                  description: |-
+                                    ForwardBody controls if requests to the authorization server should include
+                                    the body of the client request; and if so, how big that body is allowed
+                                    to be.
+                                    
+                                    It is expected that implementations will buffer the request body up to
+                                    `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                    4xx series error (413 or 403 are common examples), and fail processing
+                                    of the filter.
+                                    
+                                    If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                    be forwarded.
+                                    
+                                    Feature Name: HTTPRouteExternalAuthForwardBody
+                                  properties:
+                                    maxSize:
+                                      description: |-
+                                        MaxSize specifies how large in bytes the largest body that will be buffered
+                                        and sent to the authorization server. If the body size is larger than
+                                        `maxSize`, then the body sent to the authorization server must be
+                                        truncated to `maxSize` bytes.
+                                        
+                                        Experimental note: This behavior needs to be checked against
+                                        various dataplanes; it may need to be changed.
+                                        See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                        for more.
+                                        
+                                        If 0, the body will not be sent to the authorization server.
+                                      type: integer
+                                  type: object
+                                grpc:
+                                  description: |-
+                                    GRPCAuthConfig contains configuration for communication with ext_authz
+                                    protocol-speaking backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        If this list is empty, then all headers must be sent.
+                                        
+                                        If the list has entries, only those entries must be sent.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                  type: object
+                                http:
+                                  description: |-
+                                    HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                    backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what additional headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        The following headers must always be sent to the authorization server,
+                                        regardless of this setting:
+                                        
+                                        * `Host`
+                                        * `Method`
+                                        * `Path`
+                                        * `Content-Length`
+                                        * `Authorization`
+                                        
+                                        If this list is empty, then only those headers must be sent.
+                                        
+                                        Note that `Content-Length` has a special behavior, in that the length
+                                        sent must be correct for the actual request to the external authorization
+                                        server - that is, it must reflect the actual number of bytes sent in the
+                                        body of the request to the authorization server.
+                                        
+                                        So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                        to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                        to anything other than `0`, then the `Content-Length` of the authorization
+                                        request must be set to the actual number of bytes forwarded.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowedResponseHeaders:
+                                      description: |-
+                                        AllowedResponseHeaders specifies what headers from the authorization response
+                                        will be copied into the request to the backend.
+                                        
+                                        If this list is empty, then all headers from the authorization server
+                                        except Authority or Host must be copied.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    path:
+                                      description: |-
+                                        Path sets the prefix that paths from the client request will have added
+                                        when forwarded to the authorization server.
+                                        
+                                        When empty or unspecified, no prefix is added.
+                                        
+                                        Valid values are the same as the "value" regex for path values in the `match`
+                                        stanza, and the validation regex will screen out invalid paths in the same way.
+                                        Even with the validation, implementations MUST sanitize this input before using it
+                                        directly.
+                                      maxLength: 1024
+                                      pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                      type: string
+                                  type: object
+                                protocol:
+                                  description: |-
+                                    ExternalAuthProtocol describes which protocol to use when communicating with an
+                                    ext_authz authorization server.
+                                    
+                                    When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                    on the port specified in `backendRefs`. Requests and responses are defined
+                                    in the protobufs explained at:
+                                    https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                    
+                                    When this is set to HTTP, each backend must respond with a `200` status
+                                    code in on a successful authorization. Any other code is considered
+                                    an authorization failure.
+                                    
+                                    Feature Names:
+                                    GRPC Support - HTTPRouteExternalAuthGRPC
+                                    HTTP Support - HTTPRouteExternalAuthHTTP
+                                  enum:
+                                    - HTTP
+                                    - GRPC
+                                  type: string
+                              required:
+                                - backendRef
+                                - protocol
+                              type: object
+                              x-kubernetes-validations:
+                                - message: grpc must be specified when protocol is set
+                                    to 'GRPC'
+                                  rule: 'self.protocol == ''GRPC'' ? has(self.grpc) :
+                                true'
+                                - message: protocol must be 'GRPC' when grpc is set
+                                  rule: 'has(self.grpc) ? self.protocol == ''GRPC'' :
+                                true'
+                                - message: http must be specified when protocol is set
+                                    to 'HTTP'
+                                  rule: 'self.protocol == ''HTTP'' ? has(self.http) :
+                                true'
+                                - message: protocol must be 'HTTP' when http is set
+                                  rule: 'has(self.http) ? self.protocol == ''HTTP'' :
+                                true'
                             requestHeaderModifier:
                               description: |-
                                 RequestHeaderModifier defines a schema for a filter that modifies request
@@ -8731,6 +10442,7 @@ spec:
                                 - URLRewrite
                                 - ExtensionRef
                                 - CORS
+                                - ExternalAuth
                               type: string
                             urlRewrite:
                               description: |-
@@ -8865,8 +10577,15 @@ spec:
                               rule: '!(has(self.cors) && self.type != ''CORS'')'
                             - message: filter.cors must be specified for CORS filter.type
                               rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                            - message: filter.externalAuth must be nil if the filter.type
+                                is not ExternalAuth
+                              rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                            - message: filter.externalAuth must be specified for ExternalAuth
+                                filter.type
+                              rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: May specify either httpRouteFilterRequestRedirect
                               or httpRouteFilterRequestRewrite, but not both
@@ -9178,6 +10897,7 @@ spec:
                           type: object
                         maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -9273,6 +10993,7 @@ spec:
                               minimum: 400
                               type: integer
                             type: array
+                            x-kubernetes-list-type: atomic
                         type: object
                       sessionPersistence:
                         description: |-
@@ -9468,6 +11189,7 @@ spec:
                       != ''PathPrefix'') ? false : true) : true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -9486,6 +11208,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of HTTPRoute.
@@ -9750,11 +11490,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -9878,6 +11620,7 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
                   description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
@@ -10090,6 +11833,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -10215,16 +11959,14 @@ spec:
                                           AllowCredentials indicates whether the actual cross-origin request allows
                                           to include credentials.
                                           
-                                          The only valid value for the `Access-Control-Allow-Credentials` response
-                                          header is true (case-sensitive).
+                                          When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                          response header with value true (case-sensitive).
                                           
-                                          If the credentials are not allowed in cross-origin requests, the gateway
-                                          will omit the header `Access-Control-Allow-Credentials` entirely rather
-                                          than setting its value to false.
+                                          When set to false or omitted the gateway will omit the header
+                                          `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                          behavior).
                                           
                                           Support: Extended
-                                        enum:
-                                          - true
                                         type: boolean
                                       allowHeaders:
                                         description: |-
@@ -10251,9 +11993,9 @@ spec:
                                           
                                           A wildcard indicates that the requests with all HTTP headers are allowed.
                                           The `Access-Control-Allow-Headers` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                          When the `AllowCredentials` field is true and `AllowHeaders` field
                                           specified with the `*` wildcard, the gateway must specify one or more
                                           HTTP headers in the value of the `Access-Control-Allow-Headers` response
                                           header. The value of the header `Access-Control-Allow-Headers` is same as
@@ -10314,9 +12056,9 @@ spec:
                                           side.
                                           
                                           The `Access-Control-Allow-Methods` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowMethods` field
+                                          When the `AllowCredentials` field is true and `AllowMethods` field
                                           specified with the `*` wildcard, the gateway must specify one HTTP method
                                           in the value of the Access-Control-Allow-Methods response header. The
                                           value of the header `Access-Control-Allow-Methods` is same as the
@@ -10392,9 +12134,9 @@ spec:
                                           Therefore, the client doesn't attempt the actual cross-origin request.
                                           
                                           The `Access-Control-Allow-Origin` response header can only use `*`
-                                          wildcard as value when the `AllowCredentials` field is unspecified.
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
-                                          When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                          When the `AllowCredentials` field is true and `AllowOrigins` field
                                           specified with the `*` wildcard, the gateway must return a single origin
                                           in the value of the `Access-Control-Allow-Origin` response header,
                                           instead of specifying the `*` wildcard. The value of the header
@@ -10404,18 +12146,22 @@ spec:
                                           Support: Extended
                                         items:
                                           description: |-
-                                            The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                            encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                            include an authority MUST include a fully qualified domain name or
+                                            The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                            encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                            URIs that include an authority MUST include a fully qualified domain name or
                                             IP address as the host.
                                           maxLength: 253
                                           minLength: 1
-                                          pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                          pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                           type: string
                                         maxItems: 64
                                         type: array
                                         x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowOrigins cannot contain '*' alongside
+                                              other origins
+                                            rule: '!(''*'' in self && self.size() > 1)'
                                       exposeHeaders:
                                         description: |-
                                           ExposeHeaders indicates which HTTP response headers can be exposed
@@ -10445,8 +12191,7 @@ spec:
                                           
                                           A wildcard indicates that the responses with all HTTP headers are exposed
                                           to clients. The `Access-Control-Expose-Headers` response header can only
-                                          use `*` wildcard as value when the `AllowCredentials` field is
-                                          unspecified.
+                                          use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
                                           
                                           Support: Extended
                                         items:
@@ -10521,6 +12266,253 @@ spec:
                                       - kind
                                       - name
                                     type: object
+                                  externalAuth:
+                                    description: |-
+                                      ExternalAuth configures settings related to sending request details
+                                      to an external auth service. The external service MUST authenticate
+                                      the request, and MAY authorize the request as well.
+                                      
+                                      If there is any problem communicating with the external service,
+                                      this filter MUST fail closed.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef is a reference to a backend to send authorization
+                                          requests to.
+                                          
+                                          The backend must speak the selected protocol (GRPC or HTTP) on the
+                                          referenced port.
+                                          
+                                          If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                          implementation to supply the TLS details to be used to connect to that
+                                          backend.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+                                              
+                                              Defaults to "Service" when not specified.
+                                              
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+                                              
+                                              Support: Core (Services with a type other than ExternalName)
+                                              
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+                                              
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+                                              
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                          - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                          - message: Must have port for Service reference
+                                            rule: '(size(self.group) == 0 && self.kind
+                                          == ''Service'') ? has(self.port) : true'
+                                      forwardBody:
+                                        description: |-
+                                          ForwardBody controls if requests to the authorization server should include
+                                          the body of the client request; and if so, how big that body is allowed
+                                          to be.
+                                          
+                                          It is expected that implementations will buffer the request body up to
+                                          `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                          4xx series error (413 or 403 are common examples), and fail processing
+                                          of the filter.
+                                          
+                                          If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                          be forwarded.
+                                          
+                                          Feature Name: HTTPRouteExternalAuthForwardBody
+                                        properties:
+                                          maxSize:
+                                            description: |-
+                                              MaxSize specifies how large in bytes the largest body that will be buffered
+                                              and sent to the authorization server. If the body size is larger than
+                                              `maxSize`, then the body sent to the authorization server must be
+                                              truncated to `maxSize` bytes.
+                                              
+                                              Experimental note: This behavior needs to be checked against
+                                              various dataplanes; it may need to be changed.
+                                              See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                              for more.
+                                              
+                                              If 0, the body will not be sent to the authorization server.
+                                            type: integer
+                                        type: object
+                                      grpc:
+                                        description: |-
+                                          GRPCAuthConfig contains configuration for communication with ext_authz
+                                          protocol-speaking backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              If this list is empty, then all headers must be sent.
+                                              
+                                              If the list has entries, only those entries must be sent.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        type: object
+                                      http:
+                                        description: |-
+                                          HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                          backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what additional headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              The following headers must always be sent to the authorization server,
+                                              regardless of this setting:
+                                              
+                                              * `Host`
+                                              * `Method`
+                                              * `Path`
+                                              * `Content-Length`
+                                              * `Authorization`
+                                              
+                                              If this list is empty, then only those headers must be sent.
+                                              
+                                              Note that `Content-Length` has a special behavior, in that the length
+                                              sent must be correct for the actual request to the external authorization
+                                              server - that is, it must reflect the actual number of bytes sent in the
+                                              body of the request to the authorization server.
+                                              
+                                              So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                              to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                              to anything other than `0`, then the `Content-Length` of the authorization
+                                              request must be set to the actual number of bytes forwarded.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          allowedResponseHeaders:
+                                            description: |-
+                                              AllowedResponseHeaders specifies what headers from the authorization response
+                                              will be copied into the request to the backend.
+                                              
+                                              If this list is empty, then all headers from the authorization server
+                                              except Authority or Host must be copied.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          path:
+                                            description: |-
+                                              Path sets the prefix that paths from the client request will have added
+                                              when forwarded to the authorization server.
+                                              
+                                              When empty or unspecified, no prefix is added.
+                                              
+                                              Valid values are the same as the "value" regex for path values in the `match`
+                                              stanza, and the validation regex will screen out invalid paths in the same way.
+                                              Even with the validation, implementations MUST sanitize this input before using it
+                                              directly.
+                                            maxLength: 1024
+                                            pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                            type: string
+                                        type: object
+                                      protocol:
+                                        description: |-
+                                          ExternalAuthProtocol describes which protocol to use when communicating with an
+                                          ext_authz authorization server.
+                                          
+                                          When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                          on the port specified in `backendRefs`. Requests and responses are defined
+                                          in the protobufs explained at:
+                                          https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                          
+                                          When this is set to HTTP, each backend must respond with a `200` status
+                                          code in on a successful authorization. Any other code is considered
+                                          an authorization failure.
+                                          
+                                          Feature Names:
+                                          GRPC Support - HTTPRouteExternalAuthGRPC
+                                          HTTP Support - HTTPRouteExternalAuthHTTP
+                                        enum:
+                                          - HTTP
+                                          - GRPC
+                                        type: string
+                                    required:
+                                      - backendRef
+                                      - protocol
+                                    type: object
+                                    x-kubernetes-validations:
+                                      - message: grpc must be specified when protocol
+                                          is set to 'GRPC'
+                                        rule: 'self.protocol == ''GRPC'' ? has(self.grpc)
+                                      : true'
+                                      - message: protocol must be 'GRPC' when grpc is
+                                          set
+                                        rule: 'has(self.grpc) ? self.protocol == ''GRPC''
+                                      : true'
+                                      - message: http must be specified when protocol
+                                          is set to 'HTTP'
+                                        rule: 'self.protocol == ''HTTP'' ? has(self.http)
+                                      : true'
+                                      - message: protocol must be 'HTTP' when http is
+                                          set
+                                        rule: 'has(self.http) ? self.protocol == ''HTTP''
+                                      : true'
                                   requestHeaderModifier:
                                     description: |-
                                       RequestHeaderModifier defines a schema for a filter that modifies request
@@ -11134,6 +13126,7 @@ spec:
                                       - URLRewrite
                                       - ExtensionRef
                                       - CORS
+                                      - ExternalAuth
                                     type: string
                                   urlRewrite:
                                     description: |-
@@ -11271,13 +13264,16 @@ spec:
                                     rule: '!(has(self.cors) && self.type != ''CORS'')'
                                   - message: filter.cors must be specified for CORS filter.type
                                     rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                                  - message: filter.externalAuth must be nil if the filter.type
+                                      is not ExternalAuth
+                                    rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                                  - message: filter.externalAuth must be specified for
+                                      ExternalAuth filter.type
+                                    rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
-                                - message: May specify either httpRouteFilterRequestRedirect
-                                    or httpRouteFilterRequestRewrite, but not both
-                                  rule: '!(self.exists(f, f.type == ''RequestRedirect'')
-                                && self.exists(f, f.type == ''URLRewrite''))'
                                 - message: May specify either httpRouteFilterRequestRedirect
                                     or httpRouteFilterRequestRewrite, but not both
                                   rule: '!(self.exists(f, f.type == ''RequestRedirect'')
@@ -11383,6 +13379,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -11442,16 +13439,14 @@ spec:
                                     AllowCredentials indicates whether the actual cross-origin request allows
                                     to include credentials.
                                     
-                                    The only valid value for the `Access-Control-Allow-Credentials` response
-                                    header is true (case-sensitive).
+                                    When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                    response header with value true (case-sensitive).
                                     
-                                    If the credentials are not allowed in cross-origin requests, the gateway
-                                    will omit the header `Access-Control-Allow-Credentials` entirely rather
-                                    than setting its value to false.
+                                    When set to false or omitted the gateway will omit the header
+                                    `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                    behavior).
                                     
                                     Support: Extended
-                                  enum:
-                                    - true
                                   type: boolean
                                 allowHeaders:
                                   description: |-
@@ -11478,9 +13473,9 @@ spec:
                                     
                                     A wildcard indicates that the requests with all HTTP headers are allowed.
                                     The `Access-Control-Allow-Headers` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                    When the `AllowCredentials` field is true and `AllowHeaders` field
                                     specified with the `*` wildcard, the gateway must specify one or more
                                     HTTP headers in the value of the `Access-Control-Allow-Headers` response
                                     header. The value of the header `Access-Control-Allow-Headers` is same as
@@ -11541,9 +13536,9 @@ spec:
                                     side.
                                     
                                     The `Access-Control-Allow-Methods` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowMethods` field
+                                    When the `AllowCredentials` field is true and `AllowMethods` field
                                     specified with the `*` wildcard, the gateway must specify one HTTP method
                                     in the value of the Access-Control-Allow-Methods response header. The
                                     value of the header `Access-Control-Allow-Methods` is same as the
@@ -11619,9 +13614,9 @@ spec:
                                     Therefore, the client doesn't attempt the actual cross-origin request.
                                     
                                     The `Access-Control-Allow-Origin` response header can only use `*`
-                                    wildcard as value when the `AllowCredentials` field is unspecified.
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
-                                    When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                    When the `AllowCredentials` field is true and `AllowOrigins` field
                                     specified with the `*` wildcard, the gateway must return a single origin
                                     in the value of the `Access-Control-Allow-Origin` response header,
                                     instead of specifying the `*` wildcard. The value of the header
@@ -11631,18 +13626,22 @@ spec:
                                     Support: Extended
                                   items:
                                     description: |-
-                                      The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                      encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                      include an authority MUST include a fully qualified domain name or
+                                      The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                      encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                      URIs that include an authority MUST include a fully qualified domain name or
                                       IP address as the host.
                                     maxLength: 253
                                     minLength: 1
-                                    pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                    pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                     type: string
                                   maxItems: 64
                                   type: array
                                   x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowOrigins cannot contain '*' alongside
+                                        other origins
+                                      rule: '!(''*'' in self && self.size() > 1)'
                                 exposeHeaders:
                                   description: |-
                                     ExposeHeaders indicates which HTTP response headers can be exposed
@@ -11672,8 +13671,7 @@ spec:
                                     
                                     A wildcard indicates that the responses with all HTTP headers are exposed
                                     to clients. The `Access-Control-Expose-Headers` response header can only
-                                    use `*` wildcard as value when the `AllowCredentials` field is
-                                    unspecified.
+                                    use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
                                     
                                     Support: Extended
                                   items:
@@ -11748,6 +13746,251 @@ spec:
                                 - kind
                                 - name
                               type: object
+                            externalAuth:
+                              description: |-
+                                ExternalAuth configures settings related to sending request details
+                                to an external auth service. The external service MUST authenticate
+                                the request, and MAY authorize the request as well.
+                                
+                                If there is any problem communicating with the external service,
+                                this filter MUST fail closed.
+                                
+                                Support: Extended
+                              properties:
+                                backendRef:
+                                  description: |-
+                                    BackendRef is a reference to a backend to send authorization
+                                    requests to.
+                                    
+                                    The backend must speak the selected protocol (GRPC or HTTP) on the
+                                    referenced port.
+                                    
+                                    If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                    implementation to supply the TLS details to be used to connect to that
+                                    backend.
+                                  properties:
+                                    group:
+                                      default: ""
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When unspecified or empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Service
+                                      description: |-
+                                        Kind is the Kubernetes resource kind of the referent. For example
+                                        "Service".
+                                        
+                                        Defaults to "Service" when not specified.
+                                        
+                                        ExternalName services can refer to CNAME DNS records that may live
+                                        outside of the cluster and as such are difficult to reason about in
+                                        terms of conformance. They also may not be safe to forward to (see
+                                        CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                        support ExternalName Services.
+                                        
+                                        Support: Core (Services with a type other than ExternalName)
+                                        
+                                        Support: Implementation-specific (Services with type ExternalName)
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the backend. When unspecified, the local
+                                        namespace is inferred.
+                                        
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+                                        
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port specifies the destination port number to use for this resource.
+                                        Port is required when the referent is a Kubernetes Service. In this
+                                        case, the port number is the service port number, not the target port.
+                                        For other resources, destination port might be derived from the referent
+                                        resource or this field.
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                  required:
+                                    - name
+                                  type: object
+                                  x-kubernetes-validations:
+                                    - message: Must have port for Service reference
+                                      rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                                    ? has(self.port) : true'
+                                forwardBody:
+                                  description: |-
+                                    ForwardBody controls if requests to the authorization server should include
+                                    the body of the client request; and if so, how big that body is allowed
+                                    to be.
+                                    
+                                    It is expected that implementations will buffer the request body up to
+                                    `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                    4xx series error (413 or 403 are common examples), and fail processing
+                                    of the filter.
+                                    
+                                    If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                    be forwarded.
+                                    
+                                    Feature Name: HTTPRouteExternalAuthForwardBody
+                                  properties:
+                                    maxSize:
+                                      description: |-
+                                        MaxSize specifies how large in bytes the largest body that will be buffered
+                                        and sent to the authorization server. If the body size is larger than
+                                        `maxSize`, then the body sent to the authorization server must be
+                                        truncated to `maxSize` bytes.
+                                        
+                                        Experimental note: This behavior needs to be checked against
+                                        various dataplanes; it may need to be changed.
+                                        See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                        for more.
+                                        
+                                        If 0, the body will not be sent to the authorization server.
+                                      type: integer
+                                  type: object
+                                grpc:
+                                  description: |-
+                                    GRPCAuthConfig contains configuration for communication with ext_authz
+                                    protocol-speaking backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        If this list is empty, then all headers must be sent.
+                                        
+                                        If the list has entries, only those entries must be sent.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                  type: object
+                                http:
+                                  description: |-
+                                    HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                    backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what additional headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        The following headers must always be sent to the authorization server,
+                                        regardless of this setting:
+                                        
+                                        * `Host`
+                                        * `Method`
+                                        * `Path`
+                                        * `Content-Length`
+                                        * `Authorization`
+                                        
+                                        If this list is empty, then only those headers must be sent.
+                                        
+                                        Note that `Content-Length` has a special behavior, in that the length
+                                        sent must be correct for the actual request to the external authorization
+                                        server - that is, it must reflect the actual number of bytes sent in the
+                                        body of the request to the authorization server.
+                                        
+                                        So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                        to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                        to anything other than `0`, then the `Content-Length` of the authorization
+                                        request must be set to the actual number of bytes forwarded.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowedResponseHeaders:
+                                      description: |-
+                                        AllowedResponseHeaders specifies what headers from the authorization response
+                                        will be copied into the request to the backend.
+                                        
+                                        If this list is empty, then all headers from the authorization server
+                                        except Authority or Host must be copied.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    path:
+                                      description: |-
+                                        Path sets the prefix that paths from the client request will have added
+                                        when forwarded to the authorization server.
+                                        
+                                        When empty or unspecified, no prefix is added.
+                                        
+                                        Valid values are the same as the "value" regex for path values in the `match`
+                                        stanza, and the validation regex will screen out invalid paths in the same way.
+                                        Even with the validation, implementations MUST sanitize this input before using it
+                                        directly.
+                                      maxLength: 1024
+                                      pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                      type: string
+                                  type: object
+                                protocol:
+                                  description: |-
+                                    ExternalAuthProtocol describes which protocol to use when communicating with an
+                                    ext_authz authorization server.
+                                    
+                                    When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                    on the port specified in `backendRefs`. Requests and responses are defined
+                                    in the protobufs explained at:
+                                    https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                    
+                                    When this is set to HTTP, each backend must respond with a `200` status
+                                    code in on a successful authorization. Any other code is considered
+                                    an authorization failure.
+                                    
+                                    Feature Names:
+                                    GRPC Support - HTTPRouteExternalAuthGRPC
+                                    HTTP Support - HTTPRouteExternalAuthHTTP
+                                  enum:
+                                    - HTTP
+                                    - GRPC
+                                  type: string
+                              required:
+                                - backendRef
+                                - protocol
+                              type: object
+                              x-kubernetes-validations:
+                                - message: grpc must be specified when protocol is set
+                                    to 'GRPC'
+                                  rule: 'self.protocol == ''GRPC'' ? has(self.grpc) :
+                                true'
+                                - message: protocol must be 'GRPC' when grpc is set
+                                  rule: 'has(self.grpc) ? self.protocol == ''GRPC'' :
+                                true'
+                                - message: http must be specified when protocol is set
+                                    to 'HTTP'
+                                  rule: 'self.protocol == ''HTTP'' ? has(self.http) :
+                                true'
+                                - message: protocol must be 'HTTP' when http is set
+                                  rule: 'has(self.http) ? self.protocol == ''HTTP'' :
+                                true'
                             requestHeaderModifier:
                               description: |-
                                 RequestHeaderModifier defines a schema for a filter that modifies request
@@ -12357,6 +14600,7 @@ spec:
                                 - URLRewrite
                                 - ExtensionRef
                                 - CORS
+                                - ExternalAuth
                               type: string
                             urlRewrite:
                               description: |-
@@ -12491,8 +14735,15 @@ spec:
                               rule: '!(has(self.cors) && self.type != ''CORS'')'
                             - message: filter.cors must be specified for CORS filter.type
                               rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                            - message: filter.externalAuth must be nil if the filter.type
+                                is not ExternalAuth
+                              rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                            - message: filter.externalAuth must be specified for ExternalAuth
+                                filter.type
+                              rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: May specify either httpRouteFilterRequestRedirect
                               or httpRouteFilterRequestRewrite, but not both
@@ -12804,6 +15055,7 @@ spec:
                           type: object
                         maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -12899,6 +15151,7 @@ spec:
                               minimum: 400
                               type: integer
                             type: array
+                            x-kubernetes-list-type: atomic
                         type: object
                       sessionPersistence:
                         description: |-
@@ -13094,6 +15347,7 @@ spec:
                       != ''PathPrefix'') ? false : true) : true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -13112,6 +15366,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of HTTPRoute.
@@ -13376,11 +15648,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -13406,9 +15680,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -13527,6 +15800,7 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                 to:
                   description: |-
                     To describes the resources that may be referenced by the resources
@@ -13576,6 +15850,7 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - from
                 - to
@@ -13599,9 +15874,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tcproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -13858,6 +16132,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -14022,6 +16297,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -14031,14 +16307,35 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
                 - rules
               type: object
@@ -14305,11 +16602,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -14335,9 +16634,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tlsroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -14442,6 +16740,7 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
                   description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
@@ -14654,6 +16953,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -14821,6 +17121,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -14830,14 +17131,35 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
                 - rules
               type: object
@@ -15104,11 +17426,810 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - parents
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: false
+      subresources:
+        status: {}
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha3
+      schema:
+        openAPIV3Schema:
+          description: |-
+            The TLSRoute resource is similar to TCPRoute, but can be configured
+            to match against TLS-specific metadata. This allows more flexibility
+            in matching streams for a given TLS listener.
+            
+            If you need to forward traffic to a single target for a TLS listener, you
+            could choose to use a TCPRoute with a TLS listener.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of TLSRoute.
+              properties:
+                hostnames:
+                  description: |-
+                    Hostnames defines a set of SNI hostnames that should match against the
+                    SNI attribute of TLS ClientHello message in TLS handshake. This matches
+                    the RFC 1123 definition of a hostname with 2 notable exceptions:
+                    
+                    1. IPs are not allowed in SNI hostnames per RFC 6066.
+                    2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
+                       label must appear by itself as the first label.
+                    
+                    If a hostname is specified by both the Listener and TLSRoute, there
+                    must be at least one intersecting hostname for the TLSRoute to be
+                    attached to the Listener. For example:
+                    
+                    * A Listener with `test.example.com` as the hostname matches TLSRoutes
+                      that have specified at least one of `test.example.com` or
+                      `*.example.com`.
+                    * A Listener with `*.example.com` as the hostname matches TLSRoutes
+                      that have specified at least one hostname that matches the Listener
+                      hostname. For example, `test.example.com` and `*.example.com` would both
+                      match. On the other hand, `example.com` and `test.example.net` would not
+                      match.
+                    
+                    If both the Listener and TLSRoute have specified hostnames, any
+                    TLSRoute hostnames that do not match the Listener hostname MUST be
+                    ignored. For example, if a Listener specified `*.example.com`, and the
+                    TLSRoute specified `test.example.com` and `test.example.net`,
+                    `test.example.net` must not be considered for a match.
+                    
+                    If both the Listener and TLSRoute have specified hostnames, and none
+                    match with the criteria above, then the TLSRoute is not accepted. The
+                    implementation must raise an 'Accepted' Condition with a status of
+                    `False` in the corresponding RouteParentStatus.
+                    
+                    Support: Core
+                  items:
+                    description: |-
+                      Hostname is the fully qualified domain name of a network host. This matches
+                      the RFC 1123 definition of a hostname with 2 notable exceptions:
+                      
+                       1. IPs are not allowed.
+                       2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
+                          label must appear by itself as the first label.
+                      
+                      Hostname can be "precise" which is a domain name without the terminating
+                      dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
+                      domain name prefixed with a single wildcard label (e.g. `*.example.com`).
+                      
+                      Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
+                      alphanumeric characters or '-', and must start and end with an alphanumeric
+                      character. No other punctuation is allowed.
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
+                parentRefs:
+                  description: |-
+                    ParentRefs references the resources (usually Gateways) that a Route wants
+                    to be attached to. Note that the referenced parent resource needs to
+                    allow this for the attachment to be complete. For Gateways, that means
+                    the Gateway needs to allow attachment from Routes of this kind and
+                    namespace. For Services, that means the Service must either be in the same
+                    namespace for a "producer" route, or the mesh implementation must support
+                    and allow "consumer" routes for the referenced Service. ReferenceGrant is
+                    not applicable for governing ParentRefs to Services - it is not possible to
+                    create a "producer" route for a Service in a different namespace from the
+                    Route.
+                    
+                    There are two kinds of parent resources with "Core" support:
+                    
+                    * Gateway (Gateway conformance profile)
+                    * Service (Mesh conformance profile, ClusterIP Services only)
+                    
+                    This API may be extended in the future to support additional kinds of parent
+                    resources.
+                    
+                    ParentRefs must be _distinct_. This means either that:
+                    
+                    * They select different objects.  If this is the case, then parentRef
+                      entries are distinct. In terms of fields, this means that the
+                      multi-part key defined by `group`, `kind`, `namespace`, and `name` must
+                      be unique across all parentRef entries in the Route.
+                    * They do not select different objects, but for each optional field used,
+                      each ParentRef that selects the same object must set the same set of
+                      optional fields to different values. If one ParentRef sets a
+                      combination of optional fields, all must set the same combination.
+                    
+                    Some examples:
+                    
+                    * If one ParentRef sets `sectionName`, all ParentRefs referencing the
+                      same object must also set `sectionName`.
+                    * If one ParentRef sets `port`, all ParentRefs referencing the same
+                      object must also set `port`.
+                    * If one ParentRef sets `sectionName` and `port`, all ParentRefs
+                      referencing the same object must also set `sectionName` and `port`.
+                    
+                    It is possible to separately reference multiple distinct objects that may
+                    be collapsed by an implementation. For example, some implementations may
+                    choose to merge compatible Gateway Listeners together. If that is the
+                    case, the list of routes attached to those resources should also be
+                    merged.
+                    
+                    Note that for ParentRefs that cross namespace boundaries, there are specific
+                    rules. Cross-namespace references are only valid if they are explicitly
+                    allowed by something in the namespace they are referring to. For example,
+                    Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                    generic way to enable other kinds of cross-namespace reference.
+                    
+                    
+                    ParentRefs from a Route to a Service in the same namespace are "producer"
+                    routes, which apply default routing rules to inbound connections from
+                    any namespace to the Service.
+                    
+                    ParentRefs from a Route to a Service in a different namespace are
+                    "consumer" routes, and these routing rules are only applied to outbound
+                    connections originating from the same namespace as the Route, for which
+                    the intended destination of the connections are a Service targeted as a
+                    ParentRef of the Route.
+                  items:
+                    description: |-
+                      ParentReference identifies an API object (usually a Gateway) that can be considered
+                      a parent of this resource (usually a route). There are two kinds of parent resources
+                      with "Core" support:
+                      
+                      * Gateway (Gateway conformance profile)
+                      * Service (Mesh conformance profile, ClusterIP Services only)
+                      
+                      This API may be extended in the future to support additional kinds of parent
+                      resources.
+                      
+                      The API object must be valid in the cluster; the Group and Kind must
+                      be registered in the cluster for this reference to be valid.
+                    properties:
+                      group:
+                        default: gateway.networking.k8s.io
+                        description: |-
+                          Group is the group of the referent.
+                          When unspecified, "gateway.networking.k8s.io" is inferred.
+                          To set the core API group (such as for a "Service" kind referent),
+                          Group must be explicitly set to "" (empty string).
+                          
+                          Support: Core
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        default: Gateway
+                        description: |-
+                          Kind is kind of the referent.
+                          
+                          There are two kinds of parent resources with "Core" support:
+                          
+                          * Gateway (Gateway conformance profile)
+                          * Service (Mesh conformance profile, ClusterIP Services only)
+                          
+                          Support for other resources is Implementation-Specific.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: |-
+                          Name is the name of the referent.
+                          
+                          Support: Core
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      namespace:
+                        description: |-
+                          Namespace is the namespace of the referent. When unspecified, this refers
+                          to the local namespace of the Route.
+                          
+                          Note that there are specific rules for ParentRefs which cross namespace
+                          boundaries. Cross-namespace references are only valid if they are explicitly
+                          allowed by something in the namespace they are referring to. For example:
+                          Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                          generic way to enable any other kind of cross-namespace reference.
+                          
+                          
+                          ParentRefs from a Route to a Service in the same namespace are "producer"
+                          routes, which apply default routing rules to inbound connections from
+                          any namespace to the Service.
+                          
+                          ParentRefs from a Route to a Service in a different namespace are
+                          "consumer" routes, and these routing rules are only applied to outbound
+                          connections originating from the same namespace as the Route, for which
+                          the intended destination of the connections are a Service targeted as a
+                          ParentRef of the Route.
+                          
+                          
+                          Support: Core
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                        type: string
+                      port:
+                        description: |-
+                          Port is the network port this Route targets. It can be interpreted
+                          differently based on the type of parent resource.
+                          
+                          When the parent resource is a Gateway, this targets all listeners
+                          listening on the specified port that also support this kind of Route(and
+                          select this Route). It's not recommended to set `Port` unless the
+                          networking behaviors specified in a Route must apply to a specific port
+                          as opposed to a listener(s) whose port(s) may be changed. When both Port
+                          and SectionName are specified, the name and port of the selected listener
+                          must match both specified values.
+                          
+                          
+                          When the parent resource is a Service, this targets a specific port in the
+                          Service spec. When both Port (experimental) and SectionName are specified,
+                          the name and port of the selected port must match both specified values.
+                          
+                          
+                          Implementations MAY choose to support other parent resources.
+                          Implementations supporting other types of parent resources MUST clearly
+                          document how/if Port is interpreted.
+                          
+                          For the purpose of status, an attachment is considered successful as
+                          long as the parent resource accepts it partially. For example, Gateway
+                          listeners can restrict which Routes can attach to them by Route kind,
+                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                          from the referencing Route, the Route MUST be considered successfully
+                          attached. If no Gateway listeners accept attachment from this Route,
+                          the Route MUST be considered detached from the Gateway.
+                          
+                          Support: Extended
+                        format: int32
+                        maximum: 65535
+                        minimum: 1
+                        type: integer
+                      sectionName:
+                        description: |-
+                          SectionName is the name of a section within the target resource. In the
+                          following resources, SectionName is interpreted as the following:
+                          
+                          * Gateway: Listener name. When both Port (experimental) and SectionName
+                          are specified, the name and port of the selected listener must match
+                          both specified values.
+                          * Service: Port name. When both Port (experimental) and SectionName
+                          are specified, the name and port of the selected listener must match
+                          both specified values.
+                          
+                          Implementations MAY choose to support attaching Routes to other resources.
+                          If that is the case, they MUST clearly document how SectionName is
+                          interpreted.
+                          
+                          When unspecified (empty string), this will reference the entire resource.
+                          For the purpose of status, an attachment is considered successful if at
+                          least one section in the parent resource accepts it. For example, Gateway
+                          listeners can restrict which Routes can attach to them by Route kind,
+                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                          the referencing Route, the Route MUST be considered successfully
+                          attached. If no Gateway listeners accept attachment from this Route, the
+                          Route MUST be considered detached from the Gateway.
+                          
+                          Support: Core
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - name
+                    type: object
+                  maxItems: 32
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: sectionName or port must be specified when parentRefs includes
+                        2 or more references to the same parent
+                      rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
+                    || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
+                    == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
+                    p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
+                    || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
+                    == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
+                    || p2.port == 0)): true))'
+                    - message: sectionName or port must be unique when parentRefs includes
+                        2 or more references to the same parent
+                      rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                        == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
+                        || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
+                        == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
+                        p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
+                        || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                        == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                        == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
+                        || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
+                        == p2.port))))
+                rules:
+                  description: Rules are a list of actions.
+                  items:
+                    description: TLSRouteRule is the configuration for a given rule.
+                    properties:
+                      backendRefs:
+                        description: |-
+                          BackendRefs defines the backend(s) where matching requests should be
+                          sent. If unspecified or invalid (refers to a nonexistent resource or
+                          a Service with no endpoints), the rule performs no forwarding; if no
+                          filters are specified that would result in a response being sent, the
+                          underlying implementation must actively reject request attempts to this
+                          backend, by rejecting the connection or returning a 500 status code.
+                          Request rejections must respect weight; if an invalid backend is
+                          requested to have 80% of requests, then 80% of requests must be rejected
+                          instead.
+                          
+                          Support: Core for Kubernetes Service
+                          
+                          Support: Extended for Kubernetes ServiceImport
+                          
+                          Support: Implementation-specific for any other resource
+                          
+                          Support for weight: Extended
+                        items:
+                          description: |-
+                            BackendRef defines how a Route should forward a request to a Kubernetes
+                            resource.
+                            
+                            Note that when a namespace different than the local namespace is specified, a
+                            ReferenceGrant object is required in the referent namespace to allow that
+                            namespace's owner to accept the reference. See the ReferenceGrant
+                            documentation for details.
+                            
+                            
+                            When the BackendRef points to a Kubernetes Service, implementations SHOULD
+                            honor the appProtocol field if it is set for the target Service Port.
+                            
+                            Implementations supporting appProtocol SHOULD recognize the Kubernetes
+                            Standard Application Protocols defined in KEP-3726.
+                            
+                            If a Service appProtocol isn't specified, an implementation MAY infer the
+                            backend protocol through its own means. Implementations MAY infer the
+                            protocol from the Route type referring to the backend Service.
+                            
+                            If a Route is not able to send traffic to the backend using the specified
+                            protocol then the backend is considered invalid. Implementations MUST set the
+                            "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
+                            
+                            
+                            Note that when the BackendTLSPolicy object is enabled by the implementation,
+                            there are some extra rules about validity to consider here. See the fields
+                            where this struct is used for more information about the exact behavior.
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+                                
+                                Defaults to "Service" when not specified.
+                                
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+                                
+                                Support: Core (Services with a type other than ExternalName)
+                                
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            weight:
+                              default: 1
+                              description: |-
+                                Weight specifies the proportion of requests forwarded to the referenced
+                                backend. This is computed as weight/(sum of all weights in this
+                                BackendRefs list). For non-zero values, there may be some epsilon from
+                                the exact proportion defined here depending on the precision an
+                                implementation supports. Weight is not a percentage and the sum of
+                                weights does not need to equal 100.
+                                
+                                If only one backend is specified and it has a weight greater than 0, 100%
+                                of the traffic is forwarded to that backend. If weight is set to 0, no
+                                traffic should be forwarded for this entry. If unspecified, weight
+                                defaults to 1.
+                                
+                                Support for this field varies based on the context where used.
+                              format: int32
+                              maximum: 1000000
+                              minimum: 0
+                              type: integer
+                          required:
+                            - name
+                          type: object
+                          x-kubernetes-validations:
+                            - message: Must have port for Service reference
+                              rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                            ? has(self.port) : true'
+                        maxItems: 16
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      name:
+                        description: |-
+                          Name is the name of the route rule. This name MUST be unique within a Route if it is set.
+                          
+                          Support: Extended
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - backendRefs
+                    type: object
+                  maxItems: 1
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: Rule name must be unique within the route
+                      rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
+                        && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
+              required:
+                - hostnames
+                - rules
+              type: object
+            status:
+              description: Status defines the current state of TLSRoute.
+              properties:
+                parents:
+                  description: |-
+                    Parents is a list of parent resources (usually Gateways) that are
+                    associated with the route, and the status of the route with respect to
+                    each parent. When this route attaches to a parent, the controller that
+                    manages the parent must add an entry to this list when the controller
+                    first sees the route and should update the entry as appropriate when the
+                    route or gateway is modified.
+                    
+                    Note that parent references that cannot be resolved by an implementation
+                    of this API will not be added to this list. Implementations of this API
+                    can only populate Route status for the Gateways/parent resources they are
+                    responsible for.
+                    
+                    A maximum of 32 Gateways will be represented in this list. An empty list
+                    means the route has not been attached to any Gateway.
+                  items:
+                    description: |-
+                      RouteParentStatus describes the status of a route with respect to an
+                      associated Parent.
+                    properties:
+                      conditions:
+                        description: |-
+                          Conditions describes the status of the route with respect to the Gateway.
+                          Note that the route's availability is also subject to the Gateway's own
+                          status conditions and listener status.
+                          
+                          If the Route's ParentRef specifies an existing Gateway that supports
+                          Routes of this kind AND that Gateway's controller has sufficient access,
+                          then that Gateway's controller MUST set the "Accepted" condition on the
+                          Route, to indicate whether the route has been accepted or rejected by the
+                          Gateway, and why.
+                          
+                          A Route MUST be considered "Accepted" if at least one of the Route's
+                          rules is implemented by the Gateway.
+                          
+                          There are a number of cases where the "Accepted" condition may not be set
+                          due to lack of controller visibility, that includes when:
+                          
+                          * The Route refers to a nonexistent parent.
+                          * The Route is of a type that the controller does not support.
+                          * The Route is in a namespace the controller does not have access to.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      controllerName:
+                        description: |-
+                          ControllerName is a domain/path string that indicates the name of the
+                          controller that wrote this status. This corresponds with the
+                          controllerName field on GatewayClass.
+                          
+                          Example: "example.net/gateway-controller".
+                          
+                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                          valid Kubernetes names
+                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                          
+                          Controllers MUST populate this field when writing status. Controllers should ensure that
+                          entries to status populated with their ControllerName are cleaned up when they are no
+                          longer necessary.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                        type: string
+                      parentRef:
+                        description: |-
+                          ParentRef corresponds with a ParentRef in the spec that this
+                          RouteParentStatus struct describes the status of.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: |-
+                              Group is the group of the referent.
+                              When unspecified, "gateway.networking.k8s.io" is inferred.
+                              To set the core API group (such as for a "Service" kind referent),
+                              Group must be explicitly set to "" (empty string).
+                              
+                              Support: Core
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Gateway
+                            description: |-
+                              Kind is kind of the referent.
+                              
+                              There are two kinds of parent resources with "Core" support:
+                              
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+                              
+                              Support for other resources is Implementation-Specific.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: |-
+                              Name is the name of the referent.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the referent. When unspecified, this refers
+                              to the local namespace of the Route.
+                              
+                              Note that there are specific rules for ParentRefs which cross namespace
+                              boundaries. Cross-namespace references are only valid if they are explicitly
+                              allowed by something in the namespace they are referring to. For example:
+                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                              generic way to enable any other kind of cross-namespace reference.
+                              
+                              
+                              ParentRefs from a Route to a Service in the same namespace are "producer"
+                              routes, which apply default routing rules to inbound connections from
+                              any namespace to the Service.
+                              
+                              ParentRefs from a Route to a Service in a different namespace are
+                              "consumer" routes, and these routing rules are only applied to outbound
+                              connections originating from the same namespace as the Route, for which
+                              the intended destination of the connections are a Service targeted as a
+                              ParentRef of the Route.
+                              
+                              
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port is the network port this Route targets. It can be interpreted
+                              differently based on the type of parent resource.
+                              
+                              When the parent resource is a Gateway, this targets all listeners
+                              listening on the specified port that also support this kind of Route(and
+                              select this Route). It's not recommended to set `Port` unless the
+                              networking behaviors specified in a Route must apply to a specific port
+                              as opposed to a listener(s) whose port(s) may be changed. When both Port
+                              and SectionName are specified, the name and port of the selected listener
+                              must match both specified values.
+                              
+                              
+                              When the parent resource is a Service, this targets a specific port in the
+                              Service spec. When both Port (experimental) and SectionName are specified,
+                              the name and port of the selected port must match both specified values.
+                              
+                              
+                              Implementations MAY choose to support other parent resources.
+                              Implementations supporting other types of parent resources MUST clearly
+                              document how/if Port is interpreted.
+                              
+                              For the purpose of status, an attachment is considered successful as
+                              long as the parent resource accepts it partially. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                              from the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route,
+                              the Route MUST be considered detached from the Gateway.
+                              
+                              Support: Extended
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          sectionName:
+                            description: |-
+                              SectionName is the name of a section within the target resource. In the
+                              following resources, SectionName is interpreted as the following:
+                              
+                              * Gateway: Listener name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              * Service: Port name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              
+                              Implementations MAY choose to support attaching Routes to other resources.
+                              If that is the case, they MUST clearly document how SectionName is
+                              interpreted.
+                              
+                              When unspecified (empty string), this will reference the entire resource.
+                              For the purpose of status, an attachment is considered successful if at
+                              least one section in the parent resource accepts it. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                              the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route, the
+                              Route MUST be considered detached from the Gateway.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                        required:
+                          - name
+                        type: object
+                    required:
+                      - conditions
+                      - controllerName
+                      - parentRef
+                    type: object
+                  maxItems: 32
+                  type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -15134,9 +18255,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: udproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -15393,6 +18513,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -15557,6 +18678,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -15566,14 +18688,35 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
                 - rules
               type: object
@@ -15840,11 +18983,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -15870,9 +19015,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: xbackendtrafficpolicies.gateway.networking.x-k8s.io
@@ -16450,10 +19594,12 @@ spec:
                         type: string
                     required:
                       - ancestorRef
+                      - conditions
                       - controllerName
                     type: object
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - ancestors
               type: object
@@ -16479,9 +19625,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: xlistenersets.gateway.networking.x-k8s.io
 spec:
   group: gateway.networking.x-k8s.io
@@ -16510,8 +19655,33 @@ spec:
       schema:
         openAPIV3Schema:
           description: |-
-            XListenerSet defines a set of additional listeners
-            to attach to an existing Gateway.
+            XListenerSet defines a set of additional listeners to attach to an existing Gateway.
+            This resource provides a mechanism to merge multiple listeners into a single Gateway.
+            
+            The parent Gateway must explicitly allow ListenerSet attachment through its
+            AllowedListeners configuration. By default, Gateways do not allow ListenerSet
+            attachment.
+            
+            Routes can attach to a ListenerSet by specifying it as a parentRef, and can
+            optionally target specific listeners using the sectionName field.
+            
+            Policy Attachment:
+            - Policies that attach to a ListenerSet apply to all listeners defined in that resource
+            - Policies do not impact listeners in the parent Gateway
+            - Different ListenerSets attached to the same Gateway can have different policies
+            - If an implementation cannot apply a policy to specific listeners, it should reject the policy
+            
+            ReferenceGrant Semantics:
+            - ReferenceGrants applied to a Gateway are not inherited by child ListenerSets
+            - ReferenceGrants applied to a ListenerSet do not grant permission to the parent Gateway's listeners
+            - A ListenerSet can reference secrets/backends in its own namespace without a ReferenceGrant
+            
+            Gateway Integration:
+            - The parent Gateway's status will include an "AttachedListenerSets" condition
+            - This condition will be:
+              - True: when AllowedListeners is set and at least one child ListenerSet is attached
+              - False: when AllowedListeners is set but no valid listeners are attached, or when AllowedListeners is not set or false
+              - Unknown: when no AllowedListeners config is present
           properties:
             apiVersion:
               description: |-
@@ -16549,10 +19719,10 @@ spec:
                     
                     1. "parent" Gateway
                     2. ListenerSet ordered by creation time (oldest first)
-                    3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
+                    3. ListenerSet ordered alphabetically by "{namespace}/{name}".
                     
                     An implementation MAY reject listeners by setting the ListenerEntryStatus
-                    `Accepted`` condition to False with the Reason `TooManyListeners`
+                    `Accepted` condition to False with the Reason `TooManyListeners`
                     
                     If a listener has a conflict, this will be reported in the
                     Status.ListenerEntryStatus setting the `Conflicted` condition to True.
@@ -16625,6 +19795,7 @@ spec:
                               type: object
                             maxItems: 8
                             type: array
+                            x-kubernetes-list-type: atomic
                           namespaces:
                             default:
                               from: Same
@@ -16747,12 +19918,18 @@ spec:
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       port:
+                        default: 0
                         description: |-
                           Port is the network port. Multiple listeners may use the
                           same port, subject to the Listener compatibility rules.
+                          
+                          If the port is not set or specified as zero, the implementation will assign
+                          a unique port. If the implementation does not support dynamic port
+                          assignment, it MUST set `Accepted` condition to `False` with the
+                          `UnsupportedPort` reason.
                         format: int32
                         maximum: 65535
-                        minimum: 1
+                        minimum: 0
                         type: integer
                       protocol:
                         description: Protocol specifies the network protocol this listener
@@ -16767,7 +19944,7 @@ spec:
                           the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
                           if the Protocol field is "HTTP", "TCP", or "UDP".
                           
-                          The association of SNIs to Certificate defined in GatewayTLSConfig is
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
                           defined based on the Hostname field for this listener.
                           
                           The GatewayClass MUST use the longest matching SNI out of all
@@ -16852,93 +20029,7 @@ spec:
                               type: object
                             maxItems: 64
                             type: array
-                          frontendValidation:
-                            description: |-
-                              FrontendValidation holds configuration information for validating the frontend (client).
-                              Setting this field will require clients to send a client certificate
-                              required for validation during the TLS handshake. In browsers this may result in a dialog appearing
-                              that requests a user to specify the client certificate.
-                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
-                              
-                              Support: Extended
-                            properties:
-                              caCertificateRefs:
-                                description: |-
-                                  CACertificateRefs contains one or more references to
-                                  Kubernetes objects that contain TLS certificates of
-                                  the Certificate Authorities that can be used
-                                  as a trust anchor to validate the certificates presented by the client.
-                                  
-                                  A single CA certificate reference to a Kubernetes ConfigMap
-                                  has "Core" support.
-                                  Implementations MAY choose to support attaching multiple CA certificates to
-                                  a Listener, but this behavior is implementation-specific.
-                                  
-                                  Support: Core - A single reference to a Kubernetes ConfigMap
-                                  with the CA certificate in a key named `ca.crt`.
-                                  
-                                  Support: Implementation-specific (More than one reference, or other kinds
-                                  of resources).
-                                  
-                                  References to a resource in a different namespace are invalid UNLESS there
-                                  is a ReferenceGrant in the target namespace that allows the certificate
-                                  to be attached. If a ReferenceGrant does not allow this reference, the
-                                  "ResolvedRefs" condition MUST be set to False for this listener with the
-                                  "RefNotPermitted" reason.
-                                items:
-                                  description: |-
-                                    ObjectReference identifies an API object including its namespace.
-                                    
-                                    The API object must be valid in the cluster; the Group and Kind must
-                                    be registered in the cluster for this reference to be valid.
-                                    
-                                    References to objects with invalid Group and Kind are not valid, and must
-                                    be rejected by the implementation, with appropriate Conditions set
-                                    on the containing object.
-                                  properties:
-                                    group:
-                                      description: |-
-                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                        When set to the empty string, core API group is inferred.
-                                      maxLength: 253
-                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                      type: string
-                                    kind:
-                                      description: Kind is kind of the referent. For
-                                        example "ConfigMap" or "Service".
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                      type: string
-                                    name:
-                                      description: Name is the name of the referent.
-                                      maxLength: 253
-                                      minLength: 1
-                                      type: string
-                                    namespace:
-                                      description: |-
-                                        Namespace is the namespace of the referenced object. When unspecified, the local
-                                        namespace is inferred.
-                                        
-                                        Note that when a namespace different than the local namespace is specified,
-                                        a ReferenceGrant object is required in the referent namespace to allow that
-                                        namespace's owner to accept the reference. See the ReferenceGrant
-                                        documentation for details.
-                                        
-                                        Support: Core
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                      type: string
-                                  required:
-                                    - group
-                                    - kind
-                                    - name
-                                  type: object
-                                maxItems: 8
-                                minItems: 1
-                                type: array
-                            type: object
+                            x-kubernetes-list-type: atomic
                           mode:
                             default: Terminate
                             description: |-
@@ -16990,7 +20081,6 @@ spec:
                           > 0 || size(self.options) > 0 : true'
                     required:
                       - name
-                      - port
                       - protocol
                     type: object
                   maxItems: 64
@@ -17290,6 +20380,7 @@ spec:
                           type: object
                         maxItems: 8
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                       - attachedRoutes
                       - conditions
@@ -17316,3 +20407,255 @@ status:
     plural: ""
   conditions: null
   storedVersions: null
+---
+#
+# config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml
+#
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  name: xmeshes.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+      - gateway-api
+    kind: XMesh
+    listKind: XMeshList
+    plural: xmeshes
+    shortNames:
+      - mesh
+    singular: xmesh
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type=="Accepted")].status
+          name: Accepted
+          type: string
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: XMesh defines mesh-wide characteristics of a GAMMA-compliant
+            service mesh.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of XMesh.
+              properties:
+                controllerName:
+                  description: |-
+                    ControllerName is the name of a controller that is managing Gateway API
+                    resources for mesh traffic management. The value of this field MUST be a
+                    domain prefixed path.
+                    
+                    Example: "example.com/awesome-mesh".
+                    
+                    This field is not mutable and cannot be empty.
+                    
+                    Support: Core
+                  maxLength: 253
+                  minLength: 1
+                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                  type: string
+                  x-kubernetes-validations:
+                    - message: Value is immutable
+                      rule: self == oldSelf
+                description:
+                  description: Description optionally provides a human-readable description
+                    of a Mesh.
+                  maxLength: 64
+                  type: string
+                parametersRef:
+                  description: |-
+                    ParametersRef is an optional reference to a resource that contains
+                    implementation-specific configuration for this Mesh. If no
+                    implementation-specific parameters are needed, this field MUST be
+                    omitted.
+                    
+                    ParametersRef can reference a standard Kubernetes resource, i.e.
+                    ConfigMap, or an implementation-specific custom resource. The resource
+                    can be cluster-scoped or namespace-scoped.
+                    
+                    If the referent cannot be found, refers to an unsupported kind, or when
+                    the data within that resource is malformed, the Mesh MUST be rejected
+                    with the "Accepted" status condition set to "False" and an
+                    "InvalidParameters" reason.
+                    
+                    Support: Implementation-specific
+                  properties:
+                    group:
+                      description: Group is the group of the referent.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the referent.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the referent.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace is the namespace of the referent.
+                        This field is required when referring to a Namespace-scoped resource and
+                        MUST be unset when referring to a Cluster-scoped resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                      type: string
+                  required:
+                    - group
+                    - kind
+                    - name
+                  type: object
+              required:
+                - controllerName
+              type: object
+            status:
+              default:
+                conditions:
+                  - lastTransitionTime: "1970-01-01T00:00:00Z"
+                    message: Waiting for controller
+                    reason: Pending
+                    status: Unknown
+                    type: Accepted
+              description: Status defines the current state of XMesh.
+              properties:
+                conditions:
+                  default:
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Accepted
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Programmed
+                  description: |-
+                    Conditions is the current status from the controller for
+                    this Mesh.
+                    
+                    Controllers should prefer to publish conditions using values
+                    of MeshConditionType for the type of each Condition.
+                  items:
+                    description: Condition contains details for one aspect of the current
+                      state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  maxItems: 8
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                supportedFeatures:
+                  description: |-
+                    SupportedFeatures is the set of features the Mesh support.
+                    It MUST be sorted in ascending alphabetical order by the Name key.
+                  items:
+                    properties:
+                      name:
+                        description: |-
+                          FeatureName is used to describe distinct features that are covered by
+                          conformance tests.
+                        type: string
+                    required:
+                      - name
+                    type: object
+                  maxItems: 64
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integration/fixtures/k8s-conformance/01-rbac.yml b/integration/fixtures/gateway-api-conformance/01-rbac.yml
similarity index 100%
rename from integration/fixtures/k8s-conformance/01-rbac.yml
rename to integration/fixtures/gateway-api-conformance/01-rbac.yml
diff --git a/integration/fixtures/k8s-conformance/02-traefik.yml b/integration/fixtures/gateway-api-conformance/02-traefik.yml
similarity index 100%
rename from integration/fixtures/k8s-conformance/02-traefik.yml
rename to integration/fixtures/gateway-api-conformance/02-traefik.yml
diff --git a/integration/fixtures/healthcheck/simple_passive.toml b/integration/fixtures/healthcheck/simple_passive.toml
new file mode 100644
index 000000000..02fb698b4
--- /dev/null
+++ b/integration/fixtures/healthcheck/simple_passive.toml
@@ -0,0 +1,31 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[log]
+  level = "DEBUG"
+  noColor = true
+
+[entryPoints]
+  [entryPoints.web]
+    address = ":8000"
+
+[api]
+  insecure = true
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[http.routers]
+  [http.routers.router1]
+    service = "service1"
+    rule = "Host(`test.localhost`)"
+
+[http.services]
+  [http.services.service1.loadBalancer]
+    [http.services.service1.loadBalancer.passiveHealthCheck]
+      failureWindow = "2s"
+    [[http.services.service1.loadBalancer.servers]]
+      url = "http://{{.Server1}}:80"
diff --git a/integration/fixtures/highest_random_weight.toml b/integration/fixtures/highest_random_weight.toml
new file mode 100644
index 000000000..de6bd1d4a
--- /dev/null
+++ b/integration/fixtures/highest_random_weight.toml
@@ -0,0 +1,48 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[api]
+  insecure = true
+
+[log]
+  level = "DEBUG"
+  noColor = true
+
+[entryPoints]
+
+  [entryPoints.web]
+    address = ":8000"
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[http.routers]
+  [http.routers.router]
+    service = "hrw"
+    rule = "Path(`/whoami`)"
+
+
+[http.services]
+  [http.services.hrw.highestRandomWeight]
+  [[http.services.hrw.highestRandomWeight.services]]
+    name = "service1"
+    weight = 10
+  [[http.services.hrw.highestRandomWeight.services]]
+    name = "service2"
+    weight = 20
+  [[http.services.hrw.highestRandomWeight.services]]
+    name = "service3"
+    weight = 30
+
+  [http.services.service1.loadBalancer]
+    [[http.services.service1.loadBalancer.servers]]
+      url = "{{ .Service1Server }}"
+  [http.services.service2.loadBalancer]
+    [[http.services.service2.loadBalancer.servers]]
+      url = "{{ .Service2Server }}"
+  [http.services.service3.loadBalancer]
+    [[http.services.service3.loadBalancer.servers]]
+      url = "{{ .Service3Server }}"
\ No newline at end of file
diff --git a/integration/fixtures/k8s/00-experimental-v1.2.1.yml b/integration/fixtures/k8s/00-experimental-v1.4.0.yml
similarity index 68%
rename from integration/fixtures/k8s/00-experimental-v1.2.1.yml
rename to integration/fixtures/k8s/00-experimental-v1.4.0.yml
index 69b689846..b1e7bd2f2 100644
--- a/integration/fixtures/k8s/00-experimental-v1.2.1.yml
+++ b/integration/fixtures/k8s/00-experimental-v1.4.0.yml
@@ -1,4 +1,4 @@
-# Copyright 2024 The Kubernetes Authors.
+# Copyright 2025 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,507 +17,6 @@
 #
 ---
 #
-# config/crd/experimental/gateway.networking.k8s.io_backendlbpolicies.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
-    gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
-  labels:
-    gateway.networking.k8s.io/policy: Direct
-  name: backendlbpolicies.gateway.networking.k8s.io
-spec:
-  group: gateway.networking.k8s.io
-  names:
-    categories:
-      - gateway-api
-    kind: BackendLBPolicy
-    listKind: BackendLBPolicyList
-    plural: backendlbpolicies
-    shortNames:
-      - blbpolicy
-    singular: backendlbpolicy
-  scope: Namespaced
-  versions:
-    - additionalPrinterColumns:
-        - jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1alpha2
-      schema:
-        openAPIV3Schema:
-          description: |-
-            BackendLBPolicy provides a way to define load balancing rules
-            for a backend.
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: Spec defines the desired state of BackendLBPolicy.
-              properties:
-                sessionPersistence:
-                  description: |-
-                    SessionPersistence defines and configures session persistence
-                    for the backend.
-                    
-                    Support: Extended
-                  properties:
-                    absoluteTimeout:
-                      description: |-
-                        AbsoluteTimeout defines the absolute timeout of the persistent
-                        session. Once the AbsoluteTimeout duration has elapsed, the
-                        session becomes invalid.
-                        
-                        Support: Extended
-                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
-                      type: string
-                    cookieConfig:
-                      description: |-
-                        CookieConfig provides configuration settings that are specific
-                        to cookie-based session persistence.
-                        
-                        Support: Core
-                      properties:
-                        lifetimeType:
-                          default: Session
-                          description: |-
-                            LifetimeType specifies whether the cookie has a permanent or
-                            session-based lifetime. A permanent cookie persists until its
-                            specified expiry time, defined by the Expires or Max-Age cookie
-                            attributes, while a session cookie is deleted when the current
-                            session ends.
-                            
-                            When set to "Permanent", AbsoluteTimeout indicates the
-                            cookie's lifetime via the Expires or Max-Age cookie attributes
-                            and is required.
-                            
-                            When set to "Session", AbsoluteTimeout indicates the
-                            absolute lifetime of the cookie tracked by the gateway and
-                            is optional.
-                            
-                            Support: Core for "Session" type
-                            
-                            Support: Extended for "Permanent" type
-                          enum:
-                            - Permanent
-                            - Session
-                          type: string
-                      type: object
-                    idleTimeout:
-                      description: |-
-                        IdleTimeout defines the idle timeout of the persistent session.
-                        Once the session has been idle for more than the specified
-                        IdleTimeout duration, the session becomes invalid.
-                        
-                        Support: Extended
-                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
-                      type: string
-                    sessionName:
-                      description: |-
-                        SessionName defines the name of the persistent session token
-                        which may be reflected in the cookie or the header. Users
-                        should avoid reusing session names to prevent unintended
-                        consequences, such as rejection or unpredictable behavior.
-                        
-                        Support: Implementation-specific
-                      maxLength: 128
-                      type: string
-                    type:
-                      default: Cookie
-                      description: |-
-                        Type defines the type of session persistence such as through
-                        the use a header or cookie. Defaults to cookie based session
-                        persistence.
-                        
-                        Support: Core for "Cookie" type
-                        
-                        Support: Extended for "Header" type
-                      enum:
-                        - Cookie
-                        - Header
-                      type: string
-                  type: object
-                  x-kubernetes-validations:
-                    - message: AbsoluteTimeout must be specified when cookie lifetimeType
-                        is Permanent
-                      rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
-                    || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
-                targetRefs:
-                  description: |-
-                    TargetRef identifies an API object to apply policy to.
-                    Currently, Backends (i.e. Service, ServiceImport, or any
-                    implementation-specific backendRef) are the only valid API
-                    target references.
-                  items:
-                    description: |-
-                      LocalPolicyTargetReference identifies an API object to apply a direct or
-                      inherited policy to. This should be used as part of Policy resources
-                      that can target Gateway API resources. For more information on how this
-                      policy attachment model works, and a sample Policy resource, refer to
-                      the policy attachment documentation for Gateway API.
-                    properties:
-                      group:
-                        description: Group is the group of the target resource.
-                        maxLength: 253
-                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                        type: string
-                      kind:
-                        description: Kind is kind of the target resource.
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                        type: string
-                      name:
-                        description: Name is the name of the target resource.
-                        maxLength: 253
-                        minLength: 1
-                        type: string
-                    required:
-                      - group
-                      - kind
-                      - name
-                    type: object
-                  maxItems: 16
-                  minItems: 1
-                  type: array
-                  x-kubernetes-list-map-keys:
-                    - group
-                    - kind
-                    - name
-                  x-kubernetes-list-type: map
-              required:
-                - targetRefs
-              type: object
-            status:
-              description: Status defines the current state of BackendLBPolicy.
-              properties:
-                ancestors:
-                  description: |-
-                    Ancestors is a list of ancestor resources (usually Gateways) that are
-                    associated with the policy, and the status of the policy with respect to
-                    each ancestor. When this policy attaches to a parent, the controller that
-                    manages the parent and the ancestors MUST add an entry to this list when
-                    the controller first sees the policy and SHOULD update the entry as
-                    appropriate when the relevant ancestor is modified.
-                    
-                    Note that choosing the relevant ancestor is left to the Policy designers;
-                    an important part of Policy design is designing the right object level at
-                    which to namespace this status.
-                    
-                    Note also that implementations MUST ONLY populate ancestor status for
-                    the Ancestor resources they are responsible for. Implementations MUST
-                    use the ControllerName field to uniquely identify the entries in this list
-                    that they are responsible for.
-                    
-                    Note that to achieve this, the list of PolicyAncestorStatus structs
-                    MUST be treated as a map with a composite key, made up of the AncestorRef
-                    and ControllerName fields combined.
-                    
-                    A maximum of 16 ancestors will be represented in this list. An empty list
-                    means the Policy is not relevant for any ancestors.
-                    
-                    If this slice is full, implementations MUST NOT add further entries.
-                    Instead they MUST consider the policy unimplementable and signal that
-                    on any related resources such as the ancestor that would be referenced
-                    here. For example, if this list was full on BackendTLSPolicy, no
-                    additional Gateways would be able to reference the Service targeted by
-                    the BackendTLSPolicy.
-                  items:
-                    description: |-
-                      PolicyAncestorStatus describes the status of a route with respect to an
-                      associated Ancestor.
-                      
-                      Ancestors refer to objects that are either the Target of a policy or above it
-                      in terms of object hierarchy. For example, if a policy targets a Service, the
-                      Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
-                      the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
-                      useful object to place Policy status on, so we recommend that implementations
-                      SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
-                      have a _very_ good reason otherwise.
-                      
-                      In the context of policy attachment, the Ancestor is used to distinguish which
-                      resource results in a distinct application of this policy. For example, if a policy
-                      targets a Service, it may have a distinct result per attached Gateway.
-                      
-                      Policies targeting the same resource may have different effects depending on the
-                      ancestors of those resources. For example, different Gateways targeting the same
-                      Service may have different capabilities, especially if they have different underlying
-                      implementations.
-                      
-                      For example, in BackendTLSPolicy, the Policy attaches to a Service that is
-                      used as a backend in a HTTPRoute that is itself attached to a Gateway.
-                      In this case, the relevant object for status is the Gateway, and that is the
-                      ancestor object referred to in this status.
-                      
-                      Note that a parent is also an ancestor, so for objects where the parent is the
-                      relevant object for status, this struct SHOULD still be used.
-                      
-                      This struct is intended to be used in a slice that's effectively a map,
-                      with a composite key made up of the AncestorRef and the ControllerName.
-                    properties:
-                      ancestorRef:
-                        description: |-
-                          AncestorRef corresponds with a ParentRef in the spec that this
-                          PolicyAncestorStatus struct describes the status of.
-                        properties:
-                          group:
-                            default: gateway.networking.k8s.io
-                            description: |-
-                              Group is the group of the referent.
-                              When unspecified, "gateway.networking.k8s.io" is inferred.
-                              To set the core API group (such as for a "Service" kind referent),
-                              Group must be explicitly set to "" (empty string).
-                              
-                              Support: Core
-                            maxLength: 253
-                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            type: string
-                          kind:
-                            default: Gateway
-                            description: |-
-                              Kind is kind of the referent.
-                              
-                              There are two kinds of parent resources with "Core" support:
-                              
-                              * Gateway (Gateway conformance profile)
-                              * Service (Mesh conformance profile, ClusterIP Services only)
-                              
-                              Support for other resources is Implementation-Specific.
-                            maxLength: 63
-                            minLength: 1
-                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                            type: string
-                          name:
-                            description: |-
-                              Name is the name of the referent.
-                              
-                              Support: Core
-                            maxLength: 253
-                            minLength: 1
-                            type: string
-                          namespace:
-                            description: |-
-                              Namespace is the namespace of the referent. When unspecified, this refers
-                              to the local namespace of the Route.
-                              
-                              Note that there are specific rules for ParentRefs which cross namespace
-                              boundaries. Cross-namespace references are only valid if they are explicitly
-                              allowed by something in the namespace they are referring to. For example:
-                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-                              generic way to enable any other kind of cross-namespace reference.
-                              
-                              
-                              ParentRefs from a Route to a Service in the same namespace are "producer"
-                              routes, which apply default routing rules to inbound connections from
-                              any namespace to the Service.
-                              
-                              ParentRefs from a Route to a Service in a different namespace are
-                              "consumer" routes, and these routing rules are only applied to outbound
-                              connections originating from the same namespace as the Route, for which
-                              the intended destination of the connections are a Service targeted as a
-                              ParentRef of the Route.
-                              
-                              
-                              Support: Core
-                            maxLength: 63
-                            minLength: 1
-                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                            type: string
-                          port:
-                            description: |-
-                              Port is the network port this Route targets. It can be interpreted
-                              differently based on the type of parent resource.
-                              
-                              When the parent resource is a Gateway, this targets all listeners
-                              listening on the specified port that also support this kind of Route(and
-                              select this Route). It's not recommended to set `Port` unless the
-                              networking behaviors specified in a Route must apply to a specific port
-                              as opposed to a listener(s) whose port(s) may be changed. When both Port
-                              and SectionName are specified, the name and port of the selected listener
-                              must match both specified values.
-                              
-                              
-                              When the parent resource is a Service, this targets a specific port in the
-                              Service spec. When both Port (experimental) and SectionName are specified,
-                              the name and port of the selected port must match both specified values.
-                              
-                              
-                              Implementations MAY choose to support other parent resources.
-                              Implementations supporting other types of parent resources MUST clearly
-                              document how/if Port is interpreted.
-                              
-                              For the purpose of status, an attachment is considered successful as
-                              long as the parent resource accepts it partially. For example, Gateway
-                              listeners can restrict which Routes can attach to them by Route kind,
-                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
-                              from the referencing Route, the Route MUST be considered successfully
-                              attached. If no Gateway listeners accept attachment from this Route,
-                              the Route MUST be considered detached from the Gateway.
-                              
-                              Support: Extended
-                            format: int32
-                            maximum: 65535
-                            minimum: 1
-                            type: integer
-                          sectionName:
-                            description: |-
-                              SectionName is the name of a section within the target resource. In the
-                              following resources, SectionName is interpreted as the following:
-                              
-                              * Gateway: Listener name. When both Port (experimental) and SectionName
-                              are specified, the name and port of the selected listener must match
-                              both specified values.
-                              * Service: Port name. When both Port (experimental) and SectionName
-                              are specified, the name and port of the selected listener must match
-                              both specified values.
-                              
-                              Implementations MAY choose to support attaching Routes to other resources.
-                              If that is the case, they MUST clearly document how SectionName is
-                              interpreted.
-                              
-                              When unspecified (empty string), this will reference the entire resource.
-                              For the purpose of status, an attachment is considered successful if at
-                              least one section in the parent resource accepts it. For example, Gateway
-                              listeners can restrict which Routes can attach to them by Route kind,
-                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
-                              the referencing Route, the Route MUST be considered successfully
-                              attached. If no Gateway listeners accept attachment from this Route, the
-                              Route MUST be considered detached from the Gateway.
-                              
-                              Support: Core
-                            maxLength: 253
-                            minLength: 1
-                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                            type: string
-                        required:
-                          - name
-                        type: object
-                      conditions:
-                        description: Conditions describes the status of the Policy with
-                          respect to the given Ancestor.
-                        items:
-                          description: Condition contains details for one aspect of
-                            the current state of this API Resource.
-                          properties:
-                            lastTransitionTime:
-                              description: |-
-                                lastTransitionTime is the last time the condition transitioned from one status to another.
-                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                              format: date-time
-                              type: string
-                            message:
-                              description: |-
-                                message is a human readable message indicating details about the transition.
-                                This may be an empty string.
-                              maxLength: 32768
-                              type: string
-                            observedGeneration:
-                              description: |-
-                                observedGeneration represents the .metadata.generation that the condition was set based upon.
-                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-                                with respect to the current state of the instance.
-                              format: int64
-                              minimum: 0
-                              type: integer
-                            reason:
-                              description: |-
-                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
-                                Producers of specific condition types may define expected values and meanings for this field,
-                                and whether the values are considered a guaranteed API.
-                                The value should be a CamelCase string.
-                                This field may not be empty.
-                              maxLength: 1024
-                              minLength: 1
-                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                              type: string
-                            status:
-                              description: status of the condition, one of True, False,
-                                Unknown.
-                              enum:
-                                - "True"
-                                - "False"
-                                - Unknown
-                              type: string
-                            type:
-                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                              maxLength: 316
-                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                              type: string
-                          required:
-                            - lastTransitionTime
-                            - message
-                            - reason
-                            - status
-                            - type
-                          type: object
-                        maxItems: 8
-                        minItems: 1
-                        type: array
-                        x-kubernetes-list-map-keys:
-                          - type
-                        x-kubernetes-list-type: map
-                      controllerName:
-                        description: |-
-                          ControllerName is a domain/path string that indicates the name of the
-                          controller that wrote this status. This corresponds with the
-                          controllerName field on GatewayClass.
-                          
-                          Example: "example.net/gateway-controller".
-                          
-                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
-                          valid Kubernetes names
-                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-                          
-                          Controllers MUST populate this field when writing status. Controllers should ensure that
-                          entries to status populated with their ControllerName are cleaned up when they are no
-                          longer necessary.
-                        maxLength: 253
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
-                        type: string
-                    required:
-                      - ancestorRef
-                      - controllerName
-                    type: object
-                  maxItems: 16
-                  type: array
-              required:
-                - ancestors
-              type: object
-          required:
-            - spec
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: null
-  storedVersions: null
----
-#
 # config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
 #
 apiVersion: apiextensions.k8s.io/v1
@@ -525,9 +24,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: backendtlspolicies.gateway.networking.k8s.io
@@ -548,7 +46,7 @@ spec:
         - jsonPath: .metadata.creationTimestamp
           name: Age
           type: date
-      name: v1alpha3
+      name: v1
       schema:
         openAPIV3Schema:
           description: |-
@@ -607,6 +105,30 @@ spec:
                     by default, but this default may change in the future to provide
                     a more granular application of the policy.
                     
+                    TargetRefs must be _distinct_. This means either that:
+                    
+                    * They select different targets. If this is the case, then targetRef
+                      entries are distinct. In terms of fields, this means that the
+                      multi-part key defined by `group`, `kind`, and `name` must
+                      be unique across all targetRef entries in the BackendTLSPolicy.
+                    * They select different sectionNames in the same target.
+                    
+                    When more than one BackendTLSPolicy selects the same target and
+                    sectionName, implementations MUST determine precedence using the
+                    following criteria, continuing on ties:
+                    
+                    * The older policy by creation timestamp takes precedence. For
+                      example, a policy with a creation timestamp of "2021-07-15
+                      01:02:03" MUST be given precedence over a policy with a
+                      creation timestamp of "2021-07-15 01:02:04".
+                    * The policy appearing first in alphabetical order by {name}.
+                      For example, a policy named `bar` is given precedence over a
+                      policy named `baz`.
+                    
+                    For any BackendTLSPolicy that does not take precedence, the
+                    implementation MUST ensure the `Accepted` Condition is set to
+                    `status: False`, with Reason `Conflicted`.
+                    
                     Support: Extended for Kubernetes Service
                     
                     Support: Implementation-specific for any other resource
@@ -663,6 +185,21 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: sectionName must be specified when targetRefs includes
+                        2 or more references to the same target
+                      rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                    - message: sectionName must be unique when targetRefs includes 2 or
+                        more references to the same target
+                      rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                        == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                        p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                        == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                        == p2.sectionName))))
                 validation:
                   description: Validation contains backend TLS validation configuration.
                   properties:
@@ -674,11 +211,34 @@ spec:
                         
                         If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
                         specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
-                        not both. If CACertifcateRefs is empty or unspecified, the configuration for
+                        not both. If CACertificateRefs is empty or unspecified, the configuration for
                         WellKnownCACertificates MUST be honored instead if supported by the implementation.
                         
-                        References to a resource in a different namespace are invalid for the
-                        moment, although we will revisit this in the future.
+                        A CACertificateRef is invalid if:
+                        
+                        * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                          does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                          named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                          and the Message of the Condition must indicate which reference is invalid and why.
+                        
+                        * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                          must be set to `InvalidKind` and the Message of the Condition must explain which
+                          kind of resource is unknown or unsupported.
+                        
+                        * It refers to a resource in another namespace. This may change in future
+                          spec updates.
+                        
+                        Implementations MAY choose to perform further validation of the certificate
+                        content (e.g., checking expiry or enforcing specific formats). In such cases,
+                        an implementation-specific Reason and Message must be set for the invalid reference.
+                        
+                        In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                        the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                        that indicate the cause of the error. Connections using an invalid
+                        CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                        response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                        ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                        `status: False`, with a Reason `NoValidCACertificate`.
                         
                         A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
                         Implementations MAY choose to support attaching multiple certificates to
@@ -687,8 +247,8 @@ spec:
                         Support: Core - An optional single reference to a Kubernetes ConfigMap,
                         with the CA certificate in a key named `ca.crt`.
                         
-                        Support: Implementation-specific (More than one reference, or other kinds
-                        of resources).
+                        Support: Implementation-specific - More than one reference, other kinds
+                        of resources, or a single reference that includes multiple certificates.
                       items:
                         description: |-
                           LocalObjectReference identifies an API object within the namespace of the
@@ -726,15 +286,18 @@ spec:
                         type: object
                       maxItems: 8
                       type: array
+                      x-kubernetes-list-type: atomic
                     hostname:
                       description: |-
                         Hostname is used for two purposes in the connection between Gateways and
                         backends:
                         
                         1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-                        2. If SubjectAltNames is not specified, Hostname MUST be used for
-                           authentication and MUST match the certificate served by the matching
-                           backend.
+                        2. Hostname MUST be used for authentication and MUST match the certificate
+                           served by the matching backend, unless SubjectAltNames is specified.
+                        3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                           but MUST NOT be used for authentication. If you want to use the value
+                           of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
                         
                         Support: Core
                       maxLength: 253
@@ -744,10 +307,10 @@ spec:
                     subjectAltNames:
                       description: |-
                         SubjectAltNames contains one or more Subject Alternative Names.
-                        When specified, the certificate served from the backend MUST have at least one
-                        Subject Alternate Name matching one of the specified SubjectAltNames.
+                        When specified the certificate served from the backend MUST
+                        have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
                         
-                        Support: Core
+                        Support: Extended
                       items:
                         description: SubjectAltName represents Subject Alternative Name.
                         properties:
@@ -804,6 +367,7 @@ spec:
                           "")'
                       maxItems: 5
                       type: array
+                      x-kubernetes-list-type: atomic
                     wellKnownCACertificates:
                       description: |-
                         WellKnownCACertificates specifies whether system CA certificates may be used in
@@ -811,10 +375,11 @@ spec:
                         
                         If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
                         must be specified with at least one entry for a valid configuration. Only one of
-                        CACertificateRefs or WellKnownCACertificates may be specified, not both. If an
-                        implementation does not support the WellKnownCACertificates field or the value
-                        supplied is not supported, the Status Conditions on the Policy MUST be
-                        updated to include an Accepted: False Condition with Reason: Invalid.
+                        CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                        If an implementation does not support the WellKnownCACertificates field, or
+                        the supplied value is not recognized, the implementation MUST ensure the
+                        `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                        a Reason `Invalid`.
                         
                         Support: Implementation-specific
                       enum:
@@ -1125,10 +690,12 @@ spec:
                         type: string
                     required:
                       - ancestorRef
+                      - conditions
                       - controllerName
                     type: object
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - ancestors
               type: object
@@ -1139,6 +706,667 @@ spec:
       storage: true
       subresources:
         status: {}
+    - deprecated: true
+      deprecationWarning: The v1alpha3 version of BackendTLSPolicy has been deprecated
+        and will be removed in a future release of the API. Please upgrade to v1.
+      name: v1alpha3
+      schema:
+        openAPIV3Schema:
+          description: |-
+            BackendTLSPolicy provides a way to configure how a Gateway
+            connects to a Backend via TLS.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of BackendTLSPolicy.
+              properties:
+                options:
+                  additionalProperties:
+                    description: |-
+                      AnnotationValue is the value of an annotation in Gateway API. This is used
+                      for validation of maps such as TLS options. This roughly matches Kubernetes
+                      annotation validation, although the length validation in that case is based
+                      on the entire size of the annotations struct.
+                    maxLength: 4096
+                    minLength: 0
+                    type: string
+                  description: |-
+                    Options are a list of key/value pairs to enable extended TLS
+                    configuration for each implementation. For example, configuring the
+                    minimum TLS version or supported cipher suites.
+                    
+                    A set of common keys MAY be defined by the API in the future. To avoid
+                    any ambiguity, implementation-specific definitions MUST use
+                    domain-prefixed names, such as `example.com/my-custom-option`.
+                    Un-prefixed names are reserved for key names defined by Gateway API.
+                    
+                    Support: Implementation-specific
+                  maxProperties: 16
+                  type: object
+                targetRefs:
+                  description: |-
+                    TargetRefs identifies an API object to apply the policy to.
+                    Only Services have Extended support. Implementations MAY support
+                    additional objects, with Implementation Specific support.
+                    Note that this config applies to the entire referenced resource
+                    by default, but this default may change in the future to provide
+                    a more granular application of the policy.
+                    
+                    TargetRefs must be _distinct_. This means either that:
+                    
+                    * They select different targets. If this is the case, then targetRef
+                      entries are distinct. In terms of fields, this means that the
+                      multi-part key defined by `group`, `kind`, and `name` must
+                      be unique across all targetRef entries in the BackendTLSPolicy.
+                    * They select different sectionNames in the same target.
+                    
+                    When more than one BackendTLSPolicy selects the same target and
+                    sectionName, implementations MUST determine precedence using the
+                    following criteria, continuing on ties:
+                    
+                    * The older policy by creation timestamp takes precedence. For
+                      example, a policy with a creation timestamp of "2021-07-15
+                      01:02:03" MUST be given precedence over a policy with a
+                      creation timestamp of "2021-07-15 01:02:04".
+                    * The policy appearing first in alphabetical order by {name}.
+                      For example, a policy named `bar` is given precedence over a
+                      policy named `baz`.
+                    
+                    For any BackendTLSPolicy that does not take precedence, the
+                    implementation MUST ensure the `Accepted` Condition is set to
+                    `status: False`, with Reason `Conflicted`.
+                    
+                    Support: Extended for Kubernetes Service
+                    
+                    Support: Implementation-specific for any other resource
+                  items:
+                    description: |-
+                      LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+                      direct policy to. This should be used as part of Policy resources that can
+                      target single resources. For more information on how this policy attachment
+                      mode works, and a sample Policy resource, refer to the policy attachment
+                      documentation for Gateway API.
+                      
+                      Note: This should only be used for direct policy attachment when references
+                      to SectionName are actually needed. In all other cases,
+                      LocalPolicyTargetReference should be used.
+                    properties:
+                      group:
+                        description: Group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        description: Kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: Name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      sectionName:
+                        description: |-
+                          SectionName is the name of a section within the target resource. When
+                          unspecified, this targetRef targets the entire resource. In the following
+                          resources, SectionName is interpreted as the following:
+                          
+                          * Gateway: Listener name
+                          * HTTPRoute: HTTPRouteRule name
+                          * Service: Port name
+                          
+                          If a SectionName is specified, but does not exist on the targeted object,
+                          the Policy must fail to attach, and the policy implementation should record
+                          a `ResolvedRefs` or similar Condition in the Policy's status.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - group
+                      - kind
+                      - name
+                    type: object
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: sectionName must be specified when targetRefs includes
+                        2 or more references to the same target
+                      rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                    - message: sectionName must be unique when targetRefs includes 2 or
+                        more references to the same target
+                      rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                        == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                        p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                        == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                        == p2.sectionName))))
+                validation:
+                  description: Validation contains backend TLS validation configuration.
+                  properties:
+                    caCertificateRefs:
+                      description: |-
+                        CACertificateRefs contains one or more references to Kubernetes objects that
+                        contain a PEM-encoded TLS CA certificate bundle, which is used to
+                        validate a TLS handshake between the Gateway and backend Pod.
+                        
+                        If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+                        specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+                        not both. If CACertificateRefs is empty or unspecified, the configuration for
+                        WellKnownCACertificates MUST be honored instead if supported by the implementation.
+                        
+                        A CACertificateRef is invalid if:
+                        
+                        * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                          does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                          named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                          and the Message of the Condition must indicate which reference is invalid and why.
+                        
+                        * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                          must be set to `InvalidKind` and the Message of the Condition must explain which
+                          kind of resource is unknown or unsupported.
+                        
+                        * It refers to a resource in another namespace. This may change in future
+                          spec updates.
+                        
+                        Implementations MAY choose to perform further validation of the certificate
+                        content (e.g., checking expiry or enforcing specific formats). In such cases,
+                        an implementation-specific Reason and Message must be set for the invalid reference.
+                        
+                        In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                        the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                        that indicate the cause of the error. Connections using an invalid
+                        CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                        response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                        ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                        `status: False`, with a Reason `NoValidCACertificate`.
+                        
+                        A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+                        Implementations MAY choose to support attaching multiple certificates to
+                        a backend, but this behavior is implementation-specific.
+                        
+                        Support: Core - An optional single reference to a Kubernetes ConfigMap,
+                        with the CA certificate in a key named `ca.crt`.
+                        
+                        Support: Implementation-specific - More than one reference, other kinds
+                        of resources, or a single reference that includes multiple certificates.
+                      items:
+                        description: |-
+                          LocalObjectReference identifies an API object within the namespace of the
+                          referrer.
+                          The API object must be valid in the cluster; the Group and Kind must
+                          be registered in the cluster for this reference to be valid.
+                          
+                          References to objects with invalid Group and Kind are not valid, and must
+                          be rejected by the implementation, with appropriate Conditions set
+                          on the containing object.
+                        properties:
+                          group:
+                            description: |-
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            description: Kind is kind of the referent. For example "HTTPRoute"
+                              or "Service".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                        required:
+                          - group
+                          - kind
+                          - name
+                        type: object
+                      maxItems: 8
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    hostname:
+                      description: |-
+                        Hostname is used for two purposes in the connection between Gateways and
+                        backends:
+                        
+                        1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+                        2. Hostname MUST be used for authentication and MUST match the certificate
+                           served by the matching backend, unless SubjectAltNames is specified.
+                        3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                           but MUST NOT be used for authentication. If you want to use the value
+                           of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+                        
+                        Support: Core
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    subjectAltNames:
+                      description: |-
+                        SubjectAltNames contains one or more Subject Alternative Names.
+                        When specified the certificate served from the backend MUST
+                        have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+                        
+                        Support: Extended
+                      items:
+                        description: SubjectAltName represents Subject Alternative Name.
+                        properties:
+                          hostname:
+                            description: |-
+                              Hostname contains Subject Alternative Name specified in DNS name format.
+                              Required when Type is set to Hostname, ignored otherwise.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          type:
+                            description: |-
+                              Type determines the format of the Subject Alternative Name. Always required.
+                              
+                              Support: Core
+                            enum:
+                              - Hostname
+                              - URI
+                            type: string
+                          uri:
+                            description: |-
+                              URI contains Subject Alternative Name specified in a full URI format.
+                              It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+                              Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+                              Required when Type is set to URI, ignored otherwise.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                            type: string
+                        required:
+                          - type
+                        type: object
+                        x-kubernetes-validations:
+                          - message: SubjectAltName element must contain Hostname, if
+                              Type is set to Hostname
+                            rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
+                          self.hostname == ""))'
+                          - message: SubjectAltName element must not contain Hostname,
+                              if Type is not set to Hostname
+                            rule: '!(self.type != "Hostname" && has(self.hostname) &&
+                          self.hostname != "")'
+                          - message: SubjectAltName element must contain URI, if Type
+                              is set to URI
+                            rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
+                          == ""))'
+                          - message: SubjectAltName element must not contain URI, if Type
+                              is not set to URI
+                            rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
+                          "")'
+                      maxItems: 5
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    wellKnownCACertificates:
+                      description: |-
+                        WellKnownCACertificates specifies whether system CA certificates may be used in
+                        the TLS handshake between the gateway and backend pod.
+                        
+                        If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+                        must be specified with at least one entry for a valid configuration. Only one of
+                        CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                        If an implementation does not support the WellKnownCACertificates field, or
+                        the supplied value is not recognized, the implementation MUST ensure the
+                        `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                        a Reason `Invalid`.
+                        
+                        Support: Implementation-specific
+                      enum:
+                        - System
+                      type: string
+                  required:
+                    - hostname
+                  type: object
+                  x-kubernetes-validations:
+                    - message: must not contain both CACertificateRefs and WellKnownCACertificates
+                      rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")'
+                    - message: must specify either CACertificateRefs or WellKnownCACertificates
+                      rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                        > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                        != "")
+              required:
+                - targetRefs
+                - validation
+              type: object
+            status:
+              description: Status defines the current state of BackendTLSPolicy.
+              properties:
+                ancestors:
+                  description: |-
+                    Ancestors is a list of ancestor resources (usually Gateways) that are
+                    associated with the policy, and the status of the policy with respect to
+                    each ancestor. When this policy attaches to a parent, the controller that
+                    manages the parent and the ancestors MUST add an entry to this list when
+                    the controller first sees the policy and SHOULD update the entry as
+                    appropriate when the relevant ancestor is modified.
+                    
+                    Note that choosing the relevant ancestor is left to the Policy designers;
+                    an important part of Policy design is designing the right object level at
+                    which to namespace this status.
+                    
+                    Note also that implementations MUST ONLY populate ancestor status for
+                    the Ancestor resources they are responsible for. Implementations MUST
+                    use the ControllerName field to uniquely identify the entries in this list
+                    that they are responsible for.
+                    
+                    Note that to achieve this, the list of PolicyAncestorStatus structs
+                    MUST be treated as a map with a composite key, made up of the AncestorRef
+                    and ControllerName fields combined.
+                    
+                    A maximum of 16 ancestors will be represented in this list. An empty list
+                    means the Policy is not relevant for any ancestors.
+                    
+                    If this slice is full, implementations MUST NOT add further entries.
+                    Instead they MUST consider the policy unimplementable and signal that
+                    on any related resources such as the ancestor that would be referenced
+                    here. For example, if this list was full on BackendTLSPolicy, no
+                    additional Gateways would be able to reference the Service targeted by
+                    the BackendTLSPolicy.
+                  items:
+                    description: |-
+                      PolicyAncestorStatus describes the status of a route with respect to an
+                      associated Ancestor.
+                      
+                      Ancestors refer to objects that are either the Target of a policy or above it
+                      in terms of object hierarchy. For example, if a policy targets a Service, the
+                      Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                      the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                      useful object to place Policy status on, so we recommend that implementations
+                      SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                      have a _very_ good reason otherwise.
+                      
+                      In the context of policy attachment, the Ancestor is used to distinguish which
+                      resource results in a distinct application of this policy. For example, if a policy
+                      targets a Service, it may have a distinct result per attached Gateway.
+                      
+                      Policies targeting the same resource may have different effects depending on the
+                      ancestors of those resources. For example, different Gateways targeting the same
+                      Service may have different capabilities, especially if they have different underlying
+                      implementations.
+                      
+                      For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                      used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                      In this case, the relevant object for status is the Gateway, and that is the
+                      ancestor object referred to in this status.
+                      
+                      Note that a parent is also an ancestor, so for objects where the parent is the
+                      relevant object for status, this struct SHOULD still be used.
+                      
+                      This struct is intended to be used in a slice that's effectively a map,
+                      with a composite key made up of the AncestorRef and the ControllerName.
+                    properties:
+                      ancestorRef:
+                        description: |-
+                          AncestorRef corresponds with a ParentRef in the spec that this
+                          PolicyAncestorStatus struct describes the status of.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: |-
+                              Group is the group of the referent.
+                              When unspecified, "gateway.networking.k8s.io" is inferred.
+                              To set the core API group (such as for a "Service" kind referent),
+                              Group must be explicitly set to "" (empty string).
+                              
+                              Support: Core
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Gateway
+                            description: |-
+                              Kind is kind of the referent.
+                              
+                              There are two kinds of parent resources with "Core" support:
+                              
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+                              
+                              Support for other resources is Implementation-Specific.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: |-
+                              Name is the name of the referent.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the referent. When unspecified, this refers
+                              to the local namespace of the Route.
+                              
+                              Note that there are specific rules for ParentRefs which cross namespace
+                              boundaries. Cross-namespace references are only valid if they are explicitly
+                              allowed by something in the namespace they are referring to. For example:
+                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                              generic way to enable any other kind of cross-namespace reference.
+                              
+                              
+                              ParentRefs from a Route to a Service in the same namespace are "producer"
+                              routes, which apply default routing rules to inbound connections from
+                              any namespace to the Service.
+                              
+                              ParentRefs from a Route to a Service in a different namespace are
+                              "consumer" routes, and these routing rules are only applied to outbound
+                              connections originating from the same namespace as the Route, for which
+                              the intended destination of the connections are a Service targeted as a
+                              ParentRef of the Route.
+                              
+                              
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port is the network port this Route targets. It can be interpreted
+                              differently based on the type of parent resource.
+                              
+                              When the parent resource is a Gateway, this targets all listeners
+                              listening on the specified port that also support this kind of Route(and
+                              select this Route). It's not recommended to set `Port` unless the
+                              networking behaviors specified in a Route must apply to a specific port
+                              as opposed to a listener(s) whose port(s) may be changed. When both Port
+                              and SectionName are specified, the name and port of the selected listener
+                              must match both specified values.
+                              
+                              
+                              When the parent resource is a Service, this targets a specific port in the
+                              Service spec. When both Port (experimental) and SectionName are specified,
+                              the name and port of the selected port must match both specified values.
+                              
+                              
+                              Implementations MAY choose to support other parent resources.
+                              Implementations supporting other types of parent resources MUST clearly
+                              document how/if Port is interpreted.
+                              
+                              For the purpose of status, an attachment is considered successful as
+                              long as the parent resource accepts it partially. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                              from the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route,
+                              the Route MUST be considered detached from the Gateway.
+                              
+                              Support: Extended
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          sectionName:
+                            description: |-
+                              SectionName is the name of a section within the target resource. In the
+                              following resources, SectionName is interpreted as the following:
+                              
+                              * Gateway: Listener name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              * Service: Port name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              
+                              Implementations MAY choose to support attaching Routes to other resources.
+                              If that is the case, they MUST clearly document how SectionName is
+                              interpreted.
+                              
+                              When unspecified (empty string), this will reference the entire resource.
+                              For the purpose of status, an attachment is considered successful if at
+                              least one section in the parent resource accepts it. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                              the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route, the
+                              Route MUST be considered detached from the Gateway.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                        required:
+                          - name
+                        type: object
+                      conditions:
+                        description: Conditions describes the status of the Policy with
+                          respect to the given Ancestor.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      controllerName:
+                        description: |-
+                          ControllerName is a domain/path string that indicates the name of the
+                          controller that wrote this status. This corresponds with the
+                          controllerName field on GatewayClass.
+                          
+                          Example: "example.net/gateway-controller".
+                          
+                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                          valid Kubernetes names
+                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                          
+                          Controllers MUST populate this field when writing status. Controllers should ensure that
+                          entries to status populated with their ControllerName are cleaned up when they are no
+                          longer necessary.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                        type: string
+                    required:
+                      - ancestorRef
+                      - conditions
+                      - controllerName
+                    type: object
+                  maxItems: 16
+                  type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - ancestors
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: false
 status:
   acceptedNames:
     kind: ""
@@ -1154,9 +1382,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -1389,7 +1616,7 @@ spec:
                     - type
                   x-kubernetes-list-type: map
                 supportedFeatures:
-                  description: |
+                  description: |-
                     SupportedFeatures is the set of features the GatewayClass support.
                     It MUST be sorted in ascending alphabetical order by the Name key.
                   items:
@@ -1633,7 +1860,7 @@ spec:
                     - type
                   x-kubernetes-list-type: map
                 supportedFeatures:
-                  description: |
+                  description: |-
                     SupportedFeatures is the set of features the GatewayClass support.
                     It MUST be sorted in ascending alphabetical order by the Name key.
                   items:
@@ -1674,9 +1901,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -1732,11 +1958,11 @@ spec:
               description: Spec defines the desired state of Gateway.
               properties:
                 addresses:
-                  description: |+
+                  description: |-
                     Addresses requested for this Gateway. This is optional and behavior can
                     depend on the implementation. If a value is set in the spec and the
                     requested address is invalid or unavailable, the implementation MUST
-                    indicate this in the associated entry in GatewayStatus.Addresses.
+                    indicate this in an associated entry in GatewayStatus.Conditions.
                     
                     The Addresses field represents a request for the address(es) on the
                     "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -1753,10 +1979,9 @@ spec:
                     GatewayStatus.Addresses.
                     
                     Support: Extended
-
                   items:
-                    description: GatewayAddress describes an address that can be bound
-                      to a Gateway.
+                    description: GatewaySpecAddress describes an address that can be
+                      bound to a Gateway.
                     oneOf:
                       - properties:
                           type:
@@ -1781,96 +2006,137 @@ spec:
                         type: string
                       value:
                         description: |-
-                          Value of the address. The validity of the values will depend
-                          on the type and support by the controller.
+                          When a value is unspecified, an implementation SHOULD automatically
+                          assign an address matching the requested type if possible.
+                          
+                          If an implementation does not support an empty value, they MUST set the
+                          "Programmed" condition in status to False with a reason of "AddressNotAssigned".
                           
                           Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
                         maxLength: 253
-                        minLength: 1
                         type: string
-                    required:
-                      - value
                     type: object
                     x-kubernetes-validations:
-                      - message: Hostname value must only contain valid characters (matching
-                          ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                        rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                      - message: Hostname value must be empty or contain only valid characters
+                          (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                        rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: IPAddress values must be unique
-                      rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                     - message: Hostname values must be unique
-                      rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
-                backendTLS:
-                  description: |+
-                    BackendTLS configures TLS settings for when this Gateway is connecting to
-                    backends with TLS.
-                    
-                    Support: Core
-
+                      rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
+                allowedListeners:
+                  description: |-
+                    AllowedListeners defines which ListenerSets can be attached to this Gateway.
+                    While this feature is experimental, the default value is to allow no ListenerSets.
                   properties:
-                    clientCertificateRef:
-                      description: |+
-                        ClientCertificateRef is a reference to an object that contains a Client
-                        Certificate and the associated private key.
-                        
-                        References to a resource in different namespace are invalid UNLESS there
-                        is a ReferenceGrant in the target namespace that allows the certificate
-                        to be attached. If a ReferenceGrant does not allow this reference, the
-                        "ResolvedRefs" condition MUST be set to False for this listener with the
-                        "RefNotPermitted" reason.
-                        
-                        ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                        Secret, or implementation-specific custom resources.
-                        
-                        This setting can be overridden on the service level by use of BackendTLSPolicy.
-                        
-                        Support: Core
-
+                    namespaces:
+                      default:
+                        from: None
+                      description: |-
+                        Namespaces defines which namespaces ListenerSets can be attached to this Gateway.
+                        While this feature is experimental, the default value is to allow no ListenerSets.
                       properties:
-                        group:
-                          default: ""
+                        from:
+                          default: None
                           description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            From indicates where ListenerSets can attach to this Gateway. Possible
+                            values are:
+                            
+                            * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+                            * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
+                            * All: ListenerSets in all namespaces may be attached to this Gateway.
+                            * None: Only listeners defined in the Gateway's spec are allowed
+                            
+                            While this feature is experimental, the default value None
+                          enum:
+                            - All
+                            - Selector
+                            - Same
+                            - None
                           type: string
-                        kind:
-                          default: Secret
-                          description: Kind is kind of the referent. For example "Secret".
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
+                        selector:
                           description: |-
-                            Namespace is the namespace of the referenced object. When unspecified, the local
-                            namespace is inferred.
-                            
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-                            
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                      required:
-                        - name
+                            Selector must be specified when From is set to "Selector". In that case,
+                            only ListenerSets in Namespaces matching this Selector will be selected by this
+                            Gateway. This field is ignored for other values of "From".
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                  - key
+                                  - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
                       type: object
                   type: object
+                defaultScope:
+                  description: |-
+                    DefaultScope, when set, configures the Gateway as a default Gateway,
+                    meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                    attached to it, according to the scope configured here.
+                    
+                    If unset (the default) or set to None, the Gateway will not act as a
+                    default Gateway; if set, the Gateway will claim any Route with a
+                    matching scope set in its UseDefaultGateway field, subject to the usual
+                    rules about which routes the Gateway can attach to.
+                    
+                    Think carefully before using this functionality! While the normal rules
+                    about which Route can apply are still enforced, it is simply easier for
+                    the wrong Route to be accidentally attached to this Gateway in this
+                    configuration. If the Gateway operator is not also the operator in
+                    control of the scope (e.g. namespace) with tight controls and checks on
+                    what kind of workloads and Routes get added in that scope, we strongly
+                    recommend not using this just because it seems convenient, and instead
+                    stick to direct Route attachment.
+                  enum:
+                    - All
+                    - None
+                  type: string
                 gatewayClassName:
                   description: |-
                     GatewayClassName used for this Gateway. This is the name of a
@@ -1965,6 +2231,11 @@ spec:
                         the merging behavior is implementation specific.
                         It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
                         
+                        If the referent cannot be found, refers to an unsupported kind, or when
+                        the data within that resource is malformed, the Gateway SHOULD be
+                        rejected with the "Accepted" status condition set to "False" and an
+                        "InvalidParameters" reason.
+                        
                         Support: Implementation-specific
                       properties:
                         group:
@@ -1995,6 +2266,8 @@ spec:
                     logical endpoints that are bound on this Gateway's addresses.
                     At least one Listener MUST be specified.
                     
+                    ## Distinct Listeners
+                    
                     Each Listener in a set of Listeners (for example, in a single Gateway)
                     MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
                     exactly one listener. (This section uses "set of Listeners" rather than
@@ -2006,55 +2279,76 @@ spec:
                     combination of Port, Protocol, and, if supported by the protocol, Hostname.
                     
                     Some combinations of port, protocol, and TLS settings are considered
-                    Core support and MUST be supported by implementations based on their
-                    targeted conformance profile:
+                    Core support and MUST be supported by implementations based on the objects
+                    they support:
                     
-                    HTTP Profile
+                    HTTPRoute
                     
                     1. HTTPRoute, Port: 80, Protocol: HTTP
                     2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
                     
-                    TLS Profile
+                    TLSRoute
                     
                     1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
                     
                     "Distinct" Listeners have the following property:
                     
-                    The implementation can match inbound requests to a single distinct
-                    Listener. When multiple Listeners share values for fields (for
+                    **The implementation can match inbound requests to a single distinct
+                    Listener**.
+                    
+                    When multiple Listeners share values for fields (for
                     example, two Listeners with the same Port value), the implementation
                     can match requests to only one of the Listeners using other
                     Listener fields.
                     
-                    For example, the following Listener scenarios are distinct:
+                    When multiple listeners have the same value for the Protocol field, then
+                    each of the Listeners with matching Protocol values MUST have different
+                    values for other fields.
                     
-                    1. Multiple Listeners with the same Port that all use the "HTTP"
-                       Protocol that all have unique Hostname values.
-                    2. Multiple Listeners with the same Port that use either the "HTTPS" or
-                       "TLS" Protocol that all have unique Hostname values.
-                    3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
-                       with the same Protocol has the same Port value.
+                    The set of fields that MUST be different for a Listener differs per protocol.
+                    The following rules define the rules for what fields MUST be considered for
+                    Listeners to be distinct with each protocol currently defined in the
+                    Gateway API spec.
                     
-                    Some fields in the Listener struct have possible values that affect
-                    whether the Listener is distinct. Hostname is particularly relevant
-                    for HTTP or HTTPS protocols.
+                    The set of listeners that all share a protocol value MUST have _different_
+                    values for _at least one_ of these fields to be distinct:
                     
-                    When using the Hostname value to select between same-Port, same-Protocol
-                    Listeners, the Hostname value must be different on each Listener for the
-                    Listener to be distinct.
+                    * **HTTP, HTTPS, TLS**: Port, Hostname
+                    * **TCP, UDP**: Port
                     
-                    When the Listeners are distinct based on Hostname, inbound request
+                    One **very** important rule to call out involves what happens when an
+                    implementation:
+                    
+                    * Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol
+                      Listeners, and
+                    * sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP
+                      Protocol.
+                    
+                    In this case all the Listeners that share a port with the
+                    TCP Listener are not distinct and so MUST NOT be accepted.
+                    
+                    If an implementation does not support TCP Protocol Listeners, then the
+                    previous rule does not apply, and the TCP Listeners SHOULD NOT be
+                    accepted.
+                    
+                    Note that the `tls` field is not used for determining if a listener is distinct, because
+                    Listeners that _only_ differ on TLS config will still conflict in all cases.
+                    
+                    ### Listeners that are distinct only by Hostname
+                    
+                    When the Listeners are distinct based only on Hostname, inbound request
                     hostnames MUST match from the most specific to least specific Hostname
                     values to choose the correct Listener and its associated set of Routes.
                     
-                    Exact matches must be processed before wildcard matches, and wildcard
-                    matches must be processed before fallback (empty Hostname value)
+                    Exact matches MUST be processed before wildcard matches, and wildcard
+                    matches MUST be processed before fallback (empty Hostname value)
                     matches. For example, `"foo.example.com"` takes precedence over
                     `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
                     
                     Additionally, if there are multiple wildcard entries, more specific
                     wildcard entries must be processed before less specific wildcard entries.
                     For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
+                    
                     The precise definition here is that the higher the number of dots in the
                     hostname to the right of the wildcard character, the higher the precedence.
                     
@@ -2062,18 +2356,26 @@ spec:
                     the left, however, so `"*.example.com"` will match both
                     `"foo.bar.example.com"` _and_ `"bar.example.com"`.
                     
+                    ## Handling indistinct Listeners
+                    
                     If a set of Listeners contains Listeners that are not distinct, then those
-                    Listeners are Conflicted, and the implementation MUST set the "Conflicted"
+                    Listeners are _Conflicted_, and the implementation MUST set the "Conflicted"
                     condition in the Listener Status to "True".
                     
+                    The words "indistinct" and "conflicted" are considered equivalent for the
+                    purpose of this documentation.
+                    
                     Implementations MAY choose to accept a Gateway with some Conflicted
                     Listeners only if they only accept the partial Listener set that contains
-                    no Conflicted Listeners. To put this another way, implementations may
-                    accept a partial Listener set only if they throw out *all* the conflicting
-                    Listeners. No picking one of the conflicting listeners as the winner.
-                    This also means that the Gateway must have at least one non-conflicting
-                    Listener in this case, otherwise it violates the requirement that at
-                    least one Listener must be present.
+                    no Conflicted Listeners.
+                    
+                    Specifically, an implementation MAY accept a partial Listener set subject to
+                    the following rules:
+                    
+                    * The implementation MUST NOT pick one conflicting Listener as the winner.
+                      ALL indistinct Listeners must not be accepted for processing.
+                    * At least one distinct Listener MUST be present, or else the Gateway effectively
+                      contains _no_ Listeners, and must be rejected from processing as a whole.
                     
                     The implementation MUST set a "ListenersNotValid" condition on the
                     Gateway Status when the Gateway contains Conflicted Listeners whether or
@@ -2082,7 +2384,25 @@ spec:
                     Accepted. Additionally, the Listener status for those listeners SHOULD
                     indicate which Listeners are conflicted and not Accepted.
                     
-                    A Gateway's Listeners are considered "compatible" if:
+                    ## General Listener behavior
+                    
+                    Note that, for all distinct Listeners, requests SHOULD match at most one Listener.
+                    For example, if Listeners are defined for "foo.example.com" and "*.example.com", a
+                    request to "foo.example.com" SHOULD only be routed using routes attached
+                    to the "foo.example.com" Listener (and not the "*.example.com" Listener).
+                    
+                    This concept is known as "Listener Isolation", and it is an Extended feature
+                    of Gateway API. Implementations that do not support Listener Isolation MUST
+                    clearly document this, and MUST NOT claim support for the
+                    `GatewayHTTPListenerIsolation` feature.
+                    
+                    Implementations that _do_ support Listener Isolation SHOULD claim support
+                    for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated
+                    conformance tests.
+                    
+                    ## Compatible Listeners
+                    
+                    A Gateway's Listeners are considered _compatible_ if:
                     
                     1. They are distinct.
                     2. The implementation can serve them in compliance with the Addresses
@@ -2097,16 +2417,11 @@ spec:
                     on the same address, or cannot mix HTTPS and generic TLS listens on the same port
                     would not consider those cases compatible, even though they are distinct.
                     
-                    Note that requests SHOULD match at most one Listener. For example, if
-                    Listeners are defined for "foo.example.com" and "*.example.com", a
-                    request to "foo.example.com" SHOULD only be routed using routes attached
-                    to the "foo.example.com" Listener (and not the "*.example.com" Listener).
-                    This concept is known as "Listener Isolation". Implementations that do
-                    not support Listener Isolation MUST clearly document this.
-                    
                     Implementations MAY merge separate Gateways onto a single set of
                     Addresses if all Listeners across all Gateways are compatible.
                     
+                    In a future release the MinItems=1 requirement MAY be dropped.
+                    
                     Support: Core
                   items:
                     description: |-
@@ -2177,6 +2492,7 @@ spec:
                               type: object
                             maxItems: 8
                             type: array
+                            x-kubernetes-list-type: atomic
                           namespaces:
                             default:
                               from: Same
@@ -2268,10 +2584,31 @@ spec:
                           
                           * TLS: The Listener Hostname MUST match the SNI.
                           * HTTP: The Listener Hostname MUST match the Host header of the request.
-                          * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                            protocol layers as described above. If an implementation does not
-                            ensure that both the SNI and Host header match the Listener hostname,
-                            it MUST clearly document that.
+                          * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                            Note that this does not require the SNI and Host header to be the same.
+                            The semantics of this are described in more detail below.
+                          
+                          To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                          implementations that rely on SNI hostname matching MUST also verify
+                          hostnames within the application protocol.
+                          
+                          Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                          reuse of a connection by responding with the HTTP 421 Misdirected Request
+                          status code. This indicates that the origin server has rejected the
+                          request because it appears to have been misdirected.
+                          
+                          To detect misdirected requests, Gateways SHOULD match the authority of
+                          the requests with all the SNI hostname(s) configured across all the
+                          Gateway Listeners on the same port and protocol:
+                          
+                          * If another Listener has an exact match or more specific wildcard entry,
+                            the Gateway SHOULD return a 421.
+                          * If the current Listener (selected by SNI matching during ClientHello)
+                            does not match the Host:
+                              * If another Listener does match the Host the Gateway SHOULD return a
+                                421.
+                              * If no other Listener matches the Host, the Gateway MUST return a
+                                404.
                           
                           For HTTPRoute and TLSRoute resources, there is an interaction with the
                           `spec.hostnames` array. When both listener and route specify hostnames,
@@ -2323,7 +2660,7 @@ spec:
                           the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
                           if the Protocol field is "HTTP", "TCP", or "UDP".
                           
-                          The association of SNIs to Certificate defined in GatewayTLSConfig is
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
                           defined based on the Hostname field for this listener.
                           
                           The GatewayClass MUST use the longest matching SNI out of all
@@ -2410,94 +2747,7 @@ spec:
                               type: object
                             maxItems: 64
                             type: array
-                          frontendValidation:
-                            description: |+
-                              FrontendValidation holds configuration information for validating the frontend (client).
-                              Setting this field will require clients to send a client certificate
-                              required for validation during the TLS handshake. In browsers this may result in a dialog appearing
-                              that requests a user to specify the client certificate.
-                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
-                              
-                              Support: Extended
-
-                            properties:
-                              caCertificateRefs:
-                                description: |-
-                                  CACertificateRefs contains one or more references to
-                                  Kubernetes objects that contain TLS certificates of
-                                  the Certificate Authorities that can be used
-                                  as a trust anchor to validate the certificates presented by the client.
-                                  
-                                  A single CA certificate reference to a Kubernetes ConfigMap
-                                  has "Core" support.
-                                  Implementations MAY choose to support attaching multiple CA certificates to
-                                  a Listener, but this behavior is implementation-specific.
-                                  
-                                  Support: Core - A single reference to a Kubernetes ConfigMap
-                                  with the CA certificate in a key named `ca.crt`.
-                                  
-                                  Support: Implementation-specific (More than one reference, or other kinds
-                                  of resources).
-                                  
-                                  References to a resource in a different namespace are invalid UNLESS there
-                                  is a ReferenceGrant in the target namespace that allows the certificate
-                                  to be attached. If a ReferenceGrant does not allow this reference, the
-                                  "ResolvedRefs" condition MUST be set to False for this listener with the
-                                  "RefNotPermitted" reason.
-                                items:
-                                  description: |-
-                                    ObjectReference identifies an API object including its namespace.
-                                    
-                                    The API object must be valid in the cluster; the Group and Kind must
-                                    be registered in the cluster for this reference to be valid.
-                                    
-                                    References to objects with invalid Group and Kind are not valid, and must
-                                    be rejected by the implementation, with appropriate Conditions set
-                                    on the containing object.
-                                  properties:
-                                    group:
-                                      description: |-
-                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                        When unspecified or empty string, core API group is inferred.
-                                      maxLength: 253
-                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                      type: string
-                                    kind:
-                                      description: Kind is kind of the referent. For
-                                        example "ConfigMap" or "Service".
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                      type: string
-                                    name:
-                                      description: Name is the name of the referent.
-                                      maxLength: 253
-                                      minLength: 1
-                                      type: string
-                                    namespace:
-                                      description: |-
-                                        Namespace is the namespace of the referenced object. When unspecified, the local
-                                        namespace is inferred.
-                                        
-                                        Note that when a namespace different than the local namespace is specified,
-                                        a ReferenceGrant object is required in the referent namespace to allow that
-                                        namespace's owner to accept the reference. See the ReferenceGrant
-                                        documentation for details.
-                                        
-                                        Support: Core
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                      type: string
-                                  required:
-                                    - group
-                                    - kind
-                                    - name
-                                  type: object
-                                maxItems: 8
-                                minItems: 1
-                                type: array
-                            type: object
+                            x-kubernetes-list-type: atomic
                           mode:
                             default: Terminate
                             description: |-
@@ -2576,6 +2826,366 @@ spec:
                       rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
                     == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
+                tls:
+                  description: |-
+                    TLS specifies frontend and backend tls configuration for entire gateway.
+                    
+                    Support: Extended
+                  properties:
+                    backend:
+                      description: |-
+                        Backend describes TLS configuration for gateway when connecting
+                        to backends.
+                        
+                        Note that this contains only details for the Gateway as a TLS client,
+                        and does _not_ imply behavior about how to choose which backend should
+                        get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+                        
+                        Support: Core
+                      properties:
+                        clientCertificateRef:
+                          description: |-
+                            ClientCertificateRef is a reference to an object that contains a Client
+                            Certificate and the associated private key.
+                            
+                            References to a resource in different namespace are invalid UNLESS there
+                            is a ReferenceGrant in the target namespace that allows the certificate
+                            to be attached. If a ReferenceGrant does not allow this reference, the
+                            "ResolvedRefs" condition MUST be set to False for this listener with the
+                            "RefNotPermitted" reason.
+                            
+                            ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                            Secret, or implementation-specific custom resources.
+                            
+                            Support: Core
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Secret
+                              description: Kind is kind of the referent. For example
+                                "Secret".
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    frontend:
+                      description: |-
+                        Frontend describes TLS config when client connects to Gateway.
+                        Support: Core
+                      properties:
+                        default:
+                          description: |-
+                            Default specifies the default client certificate validation configuration
+                            for all Listeners handling HTTPS traffic, unless a per-port configuration
+                            is defined.
+                            
+                            support: Core
+                          properties:
+                            validation:
+                              description: |-
+                                Validation holds configuration information for validating the frontend (client).
+                                Setting this field will result in mutual authentication when connecting to the gateway.
+                                In browsers this may result in a dialog appearing
+                                that requests a user to specify the client certificate.
+                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                
+                                Support: Core
+                              properties:
+                                caCertificateRefs:
+                                  description: |-
+                                    CACertificateRefs contains one or more references to
+                                    Kubernetes objects that contain TLS certificates of
+                                    the Certificate Authorities that can be used
+                                    as a trust anchor to validate the certificates presented by the client.
+                                    
+                                    A single CA certificate reference to a Kubernetes ConfigMap
+                                    has "Core" support.
+                                    Implementations MAY choose to support attaching multiple CA certificates to
+                                    a Listener, but this behavior is implementation-specific.
+                                    
+                                    Support: Core - A single reference to a Kubernetes ConfigMap
+                                    with the CA certificate in a key named `ca.crt`.
+                                    
+                                    Support: Implementation-specific (More than one certificate in a ConfigMap
+                                    with different keys or more than one reference, or other kinds of resources).
+                                    
+                                    References to a resource in a different namespace are invalid UNLESS there
+                                    is a ReferenceGrant in the target namespace that allows the certificate
+                                    to be attached. If a ReferenceGrant does not allow this reference, the
+                                    "ResolvedRefs" condition MUST be set to False for this listener with the
+                                    "RefNotPermitted" reason.
+                                  items:
+                                    description: |-
+                                      ObjectReference identifies an API object including its namespace.
+                                      
+                                      The API object must be valid in the cluster; the Group and Kind must
+                                      be registered in the cluster for this reference to be valid.
+                                      
+                                      References to objects with invalid Group and Kind are not valid, and must
+                                      be rejected by the implementation, with appropriate Conditions set
+                                      on the containing object.
+                                    properties:
+                                      group:
+                                        description: |-
+                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                          When set to the empty string, core API group is inferred.
+                                        maxLength: 253
+                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                      kind:
+                                        description: Kind is kind of the referent. For
+                                          example "ConfigMap" or "Service".
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                        type: string
+                                      name:
+                                        description: Name is the name of the referent.
+                                        maxLength: 253
+                                        minLength: 1
+                                        type: string
+                                      namespace:
+                                        description: |-
+                                          Namespace is the namespace of the referenced object. When unspecified, the local
+                                          namespace is inferred.
+                                          
+                                          Note that when a namespace different than the local namespace is specified,
+                                          a ReferenceGrant object is required in the referent namespace to allow that
+                                          namespace's owner to accept the reference. See the ReferenceGrant
+                                          documentation for details.
+                                          
+                                          Support: Core
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                        type: string
+                                    required:
+                                      - group
+                                      - kind
+                                      - name
+                                    type: object
+                                  maxItems: 8
+                                  minItems: 1
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mode:
+                                  default: AllowValidOnly
+                                  description: |-
+                                    FrontendValidationMode defines the mode for validating the client certificate.
+                                    There are two possible modes:
+                                    
+                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                      the client presents a valid certificate. This certificate must successfully
+                                      pass validation against the CA certificates specified in `CACertificateRefs`.
+                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                      even if the client certificate is not presented or fails verification.
+                                    
+                                      This approach delegates client authorization to the backend and introduce
+                                      a significant security risk. It should be used in testing environments or
+                                      on a temporary basis in non-testing environments.
+                                    
+                                    Defaults to AllowValidOnly.
+                                    
+                                    Support: Core
+                                  enum:
+                                    - AllowValidOnly
+                                    - AllowInsecureFallback
+                                  type: string
+                              required:
+                                - caCertificateRefs
+                              type: object
+                          type: object
+                        perPort:
+                          description: |-
+                            PerPort specifies tls configuration assigned per port.
+                            Per port configuration is optional. Once set this configuration overrides
+                            the default configuration for all Listeners handling HTTPS traffic
+                            that match this port.
+                            Each override port requires a unique TLS configuration.
+                            
+                            support: Core
+                          items:
+                            properties:
+                              port:
+                                description: |-
+                                  The Port indicates the Port Number to which the TLS configuration will be
+                                  applied. This configuration will be applied to all Listeners handling HTTPS
+                                  traffic that match this port.
+                                  
+                                  Support: Core
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                              tls:
+                                description: |-
+                                  TLS store the configuration that will be applied to all Listeners handling
+                                  HTTPS traffic and matching given port.
+                                  
+                                  Support: Core
+                                properties:
+                                  validation:
+                                    description: |-
+                                      Validation holds configuration information for validating the frontend (client).
+                                      Setting this field will result in mutual authentication when connecting to the gateway.
+                                      In browsers this may result in a dialog appearing
+                                      that requests a user to specify the client certificate.
+                                      The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                      
+                                      Support: Core
+                                    properties:
+                                      caCertificateRefs:
+                                        description: |-
+                                          CACertificateRefs contains one or more references to
+                                          Kubernetes objects that contain TLS certificates of
+                                          the Certificate Authorities that can be used
+                                          as a trust anchor to validate the certificates presented by the client.
+                                          
+                                          A single CA certificate reference to a Kubernetes ConfigMap
+                                          has "Core" support.
+                                          Implementations MAY choose to support attaching multiple CA certificates to
+                                          a Listener, but this behavior is implementation-specific.
+                                          
+                                          Support: Core - A single reference to a Kubernetes ConfigMap
+                                          with the CA certificate in a key named `ca.crt`.
+                                          
+                                          Support: Implementation-specific (More than one certificate in a ConfigMap
+                                          with different keys or more than one reference, or other kinds of resources).
+                                          
+                                          References to a resource in a different namespace are invalid UNLESS there
+                                          is a ReferenceGrant in the target namespace that allows the certificate
+                                          to be attached. If a ReferenceGrant does not allow this reference, the
+                                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                                          "RefNotPermitted" reason.
+                                        items:
+                                          description: |-
+                                            ObjectReference identifies an API object including its namespace.
+                                            
+                                            The API object must be valid in the cluster; the Group and Kind must
+                                            be registered in the cluster for this reference to be valid.
+                                            
+                                            References to objects with invalid Group and Kind are not valid, and must
+                                            be rejected by the implementation, with appropriate Conditions set
+                                            on the containing object.
+                                          properties:
+                                            group:
+                                              description: |-
+                                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                                When set to the empty string, core API group is inferred.
+                                              maxLength: 253
+                                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
+                                            kind:
+                                              description: Kind is kind of the referent.
+                                                For example "ConfigMap" or "Service".
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                              type: string
+                                            name:
+                                              description: Name is the name of the referent.
+                                              maxLength: 253
+                                              minLength: 1
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                                namespace is inferred.
+                                                
+                                                Note that when a namespace different than the local namespace is specified,
+                                                a ReferenceGrant object is required in the referent namespace to allow that
+                                                namespace's owner to accept the reference. See the ReferenceGrant
+                                                documentation for details.
+                                                
+                                                Support: Core
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                              type: string
+                                          required:
+                                            - group
+                                            - kind
+                                            - name
+                                          type: object
+                                        maxItems: 8
+                                        minItems: 1
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mode:
+                                        default: AllowValidOnly
+                                        description: |-
+                                          FrontendValidationMode defines the mode for validating the client certificate.
+                                          There are two possible modes:
+                                          
+                                          - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                            the client presents a valid certificate. This certificate must successfully
+                                            pass validation against the CA certificates specified in `CACertificateRefs`.
+                                          - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                            even if the client certificate is not presented or fails verification.
+                                          
+                                            This approach delegates client authorization to the backend and introduce
+                                            a significant security risk. It should be used in testing environments or
+                                            on a temporary basis in non-testing environments.
+                                          
+                                          Defaults to AllowValidOnly.
+                                          
+                                          Support: Core
+                                        enum:
+                                          - AllowValidOnly
+                                          - AllowInsecureFallback
+                                        type: string
+                                    required:
+                                      - caCertificateRefs
+                                    type: object
+                                type: object
+                            required:
+                              - port
+                              - tls
+                            type: object
+                          maxItems: 64
+                          type: array
+                          x-kubernetes-list-map-keys:
+                            - port
+                          x-kubernetes-list-type: map
+                          x-kubernetes-validations:
+                            - message: Port for TLS configuration must be unique within
+                                the Gateway
+                              rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                      required:
+                        - default
+                      type: object
+                  type: object
               required:
                 - gatewayClassName
                 - listeners
@@ -2596,7 +3206,7 @@ spec:
               description: Status defines the current state of Gateway.
               properties:
                 addresses:
-                  description: |+
+                  description: |-
                     Addresses lists the network addresses that have been bound to the
                     Gateway.
                     
@@ -2606,7 +3216,6 @@ spec:
                       * no addresses are specified, all addresses are dynamically assigned
                       * a combination of specified and dynamic addresses are assigned
                       * a specified address was unusable (e.g. already in use)
-
                   items:
                     description: GatewayStatusAddress describes a network address that
                       is bound to a Gateway.
@@ -2651,6 +3260,7 @@ spec:
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 conditions:
                   default:
                     - lastTransitionTime: "1970-01-01T00:00:00Z"
@@ -2864,6 +3474,7 @@ spec:
                           type: object
                         maxItems: 8
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                       - attachedRoutes
                       - conditions
@@ -2924,11 +3535,11 @@ spec:
               description: Spec defines the desired state of Gateway.
               properties:
                 addresses:
-                  description: |+
+                  description: |-
                     Addresses requested for this Gateway. This is optional and behavior can
                     depend on the implementation. If a value is set in the spec and the
                     requested address is invalid or unavailable, the implementation MUST
-                    indicate this in the associated entry in GatewayStatus.Addresses.
+                    indicate this in an associated entry in GatewayStatus.Conditions.
                     
                     The Addresses field represents a request for the address(es) on the
                     "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -2945,10 +3556,9 @@ spec:
                     GatewayStatus.Addresses.
                     
                     Support: Extended
-
                   items:
-                    description: GatewayAddress describes an address that can be bound
-                      to a Gateway.
+                    description: GatewaySpecAddress describes an address that can be
+                      bound to a Gateway.
                     oneOf:
                       - properties:
                           type:
@@ -2973,96 +3583,137 @@ spec:
                         type: string
                       value:
                         description: |-
-                          Value of the address. The validity of the values will depend
-                          on the type and support by the controller.
+                          When a value is unspecified, an implementation SHOULD automatically
+                          assign an address matching the requested type if possible.
+                          
+                          If an implementation does not support an empty value, they MUST set the
+                          "Programmed" condition in status to False with a reason of "AddressNotAssigned".
                           
                           Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
                         maxLength: 253
-                        minLength: 1
                         type: string
-                    required:
-                      - value
                     type: object
                     x-kubernetes-validations:
-                      - message: Hostname value must only contain valid characters (matching
-                          ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                        rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                      - message: Hostname value must be empty or contain only valid characters
+                          (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                        rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: IPAddress values must be unique
-                      rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                      rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                     - message: Hostname values must be unique
-                      rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
-                backendTLS:
-                  description: |+
-                    BackendTLS configures TLS settings for when this Gateway is connecting to
-                    backends with TLS.
-                    
-                    Support: Core
-
+                      rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
+                allowedListeners:
+                  description: |-
+                    AllowedListeners defines which ListenerSets can be attached to this Gateway.
+                    While this feature is experimental, the default value is to allow no ListenerSets.
                   properties:
-                    clientCertificateRef:
-                      description: |+
-                        ClientCertificateRef is a reference to an object that contains a Client
-                        Certificate and the associated private key.
-                        
-                        References to a resource in different namespace are invalid UNLESS there
-                        is a ReferenceGrant in the target namespace that allows the certificate
-                        to be attached. If a ReferenceGrant does not allow this reference, the
-                        "ResolvedRefs" condition MUST be set to False for this listener with the
-                        "RefNotPermitted" reason.
-                        
-                        ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                        Secret, or implementation-specific custom resources.
-                        
-                        This setting can be overridden on the service level by use of BackendTLSPolicy.
-                        
-                        Support: Core
-
+                    namespaces:
+                      default:
+                        from: None
+                      description: |-
+                        Namespaces defines which namespaces ListenerSets can be attached to this Gateway.
+                        While this feature is experimental, the default value is to allow no ListenerSets.
                       properties:
-                        group:
-                          default: ""
+                        from:
+                          default: None
                           description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            From indicates where ListenerSets can attach to this Gateway. Possible
+                            values are:
+                            
+                            * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+                            * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
+                            * All: ListenerSets in all namespaces may be attached to this Gateway.
+                            * None: Only listeners defined in the Gateway's spec are allowed
+                            
+                            While this feature is experimental, the default value None
+                          enum:
+                            - All
+                            - Selector
+                            - Same
+                            - None
                           type: string
-                        kind:
-                          default: Secret
-                          description: Kind is kind of the referent. For example "Secret".
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
+                        selector:
                           description: |-
-                            Namespace is the namespace of the referenced object. When unspecified, the local
-                            namespace is inferred.
-                            
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-                            
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                      required:
-                        - name
+                            Selector must be specified when From is set to "Selector". In that case,
+                            only ListenerSets in Namespaces matching this Selector will be selected by this
+                            Gateway. This field is ignored for other values of "From".
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                  - key
+                                  - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
                       type: object
                   type: object
+                defaultScope:
+                  description: |-
+                    DefaultScope, when set, configures the Gateway as a default Gateway,
+                    meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                    attached to it, according to the scope configured here.
+                    
+                    If unset (the default) or set to None, the Gateway will not act as a
+                    default Gateway; if set, the Gateway will claim any Route with a
+                    matching scope set in its UseDefaultGateway field, subject to the usual
+                    rules about which routes the Gateway can attach to.
+                    
+                    Think carefully before using this functionality! While the normal rules
+                    about which Route can apply are still enforced, it is simply easier for
+                    the wrong Route to be accidentally attached to this Gateway in this
+                    configuration. If the Gateway operator is not also the operator in
+                    control of the scope (e.g. namespace) with tight controls and checks on
+                    what kind of workloads and Routes get added in that scope, we strongly
+                    recommend not using this just because it seems convenient, and instead
+                    stick to direct Route attachment.
+                  enum:
+                    - All
+                    - None
+                  type: string
                 gatewayClassName:
                   description: |-
                     GatewayClassName used for this Gateway. This is the name of a
@@ -3157,6 +3808,11 @@ spec:
                         the merging behavior is implementation specific.
                         It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
                         
+                        If the referent cannot be found, refers to an unsupported kind, or when
+                        the data within that resource is malformed, the Gateway SHOULD be
+                        rejected with the "Accepted" status condition set to "False" and an
+                        "InvalidParameters" reason.
+                        
                         Support: Implementation-specific
                       properties:
                         group:
@@ -3187,6 +3843,8 @@ spec:
                     logical endpoints that are bound on this Gateway's addresses.
                     At least one Listener MUST be specified.
                     
+                    ## Distinct Listeners
+                    
                     Each Listener in a set of Listeners (for example, in a single Gateway)
                     MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
                     exactly one listener. (This section uses "set of Listeners" rather than
@@ -3198,55 +3856,76 @@ spec:
                     combination of Port, Protocol, and, if supported by the protocol, Hostname.
                     
                     Some combinations of port, protocol, and TLS settings are considered
-                    Core support and MUST be supported by implementations based on their
-                    targeted conformance profile:
+                    Core support and MUST be supported by implementations based on the objects
+                    they support:
                     
-                    HTTP Profile
+                    HTTPRoute
                     
                     1. HTTPRoute, Port: 80, Protocol: HTTP
                     2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
                     
-                    TLS Profile
+                    TLSRoute
                     
                     1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
                     
                     "Distinct" Listeners have the following property:
                     
-                    The implementation can match inbound requests to a single distinct
-                    Listener. When multiple Listeners share values for fields (for
+                    **The implementation can match inbound requests to a single distinct
+                    Listener**.
+                    
+                    When multiple Listeners share values for fields (for
                     example, two Listeners with the same Port value), the implementation
                     can match requests to only one of the Listeners using other
                     Listener fields.
                     
-                    For example, the following Listener scenarios are distinct:
+                    When multiple listeners have the same value for the Protocol field, then
+                    each of the Listeners with matching Protocol values MUST have different
+                    values for other fields.
                     
-                    1. Multiple Listeners with the same Port that all use the "HTTP"
-                       Protocol that all have unique Hostname values.
-                    2. Multiple Listeners with the same Port that use either the "HTTPS" or
-                       "TLS" Protocol that all have unique Hostname values.
-                    3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
-                       with the same Protocol has the same Port value.
+                    The set of fields that MUST be different for a Listener differs per protocol.
+                    The following rules define the rules for what fields MUST be considered for
+                    Listeners to be distinct with each protocol currently defined in the
+                    Gateway API spec.
                     
-                    Some fields in the Listener struct have possible values that affect
-                    whether the Listener is distinct. Hostname is particularly relevant
-                    for HTTP or HTTPS protocols.
+                    The set of listeners that all share a protocol value MUST have _different_
+                    values for _at least one_ of these fields to be distinct:
                     
-                    When using the Hostname value to select between same-Port, same-Protocol
-                    Listeners, the Hostname value must be different on each Listener for the
-                    Listener to be distinct.
+                    * **HTTP, HTTPS, TLS**: Port, Hostname
+                    * **TCP, UDP**: Port
                     
-                    When the Listeners are distinct based on Hostname, inbound request
+                    One **very** important rule to call out involves what happens when an
+                    implementation:
+                    
+                    * Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol
+                      Listeners, and
+                    * sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP
+                      Protocol.
+                    
+                    In this case all the Listeners that share a port with the
+                    TCP Listener are not distinct and so MUST NOT be accepted.
+                    
+                    If an implementation does not support TCP Protocol Listeners, then the
+                    previous rule does not apply, and the TCP Listeners SHOULD NOT be
+                    accepted.
+                    
+                    Note that the `tls` field is not used for determining if a listener is distinct, because
+                    Listeners that _only_ differ on TLS config will still conflict in all cases.
+                    
+                    ### Listeners that are distinct only by Hostname
+                    
+                    When the Listeners are distinct based only on Hostname, inbound request
                     hostnames MUST match from the most specific to least specific Hostname
                     values to choose the correct Listener and its associated set of Routes.
                     
-                    Exact matches must be processed before wildcard matches, and wildcard
-                    matches must be processed before fallback (empty Hostname value)
+                    Exact matches MUST be processed before wildcard matches, and wildcard
+                    matches MUST be processed before fallback (empty Hostname value)
                     matches. For example, `"foo.example.com"` takes precedence over
                     `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
                     
                     Additionally, if there are multiple wildcard entries, more specific
                     wildcard entries must be processed before less specific wildcard entries.
                     For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
+                    
                     The precise definition here is that the higher the number of dots in the
                     hostname to the right of the wildcard character, the higher the precedence.
                     
@@ -3254,18 +3933,26 @@ spec:
                     the left, however, so `"*.example.com"` will match both
                     `"foo.bar.example.com"` _and_ `"bar.example.com"`.
                     
+                    ## Handling indistinct Listeners
+                    
                     If a set of Listeners contains Listeners that are not distinct, then those
-                    Listeners are Conflicted, and the implementation MUST set the "Conflicted"
+                    Listeners are _Conflicted_, and the implementation MUST set the "Conflicted"
                     condition in the Listener Status to "True".
                     
+                    The words "indistinct" and "conflicted" are considered equivalent for the
+                    purpose of this documentation.
+                    
                     Implementations MAY choose to accept a Gateway with some Conflicted
                     Listeners only if they only accept the partial Listener set that contains
-                    no Conflicted Listeners. To put this another way, implementations may
-                    accept a partial Listener set only if they throw out *all* the conflicting
-                    Listeners. No picking one of the conflicting listeners as the winner.
-                    This also means that the Gateway must have at least one non-conflicting
-                    Listener in this case, otherwise it violates the requirement that at
-                    least one Listener must be present.
+                    no Conflicted Listeners.
+                    
+                    Specifically, an implementation MAY accept a partial Listener set subject to
+                    the following rules:
+                    
+                    * The implementation MUST NOT pick one conflicting Listener as the winner.
+                      ALL indistinct Listeners must not be accepted for processing.
+                    * At least one distinct Listener MUST be present, or else the Gateway effectively
+                      contains _no_ Listeners, and must be rejected from processing as a whole.
                     
                     The implementation MUST set a "ListenersNotValid" condition on the
                     Gateway Status when the Gateway contains Conflicted Listeners whether or
@@ -3274,7 +3961,25 @@ spec:
                     Accepted. Additionally, the Listener status for those listeners SHOULD
                     indicate which Listeners are conflicted and not Accepted.
                     
-                    A Gateway's Listeners are considered "compatible" if:
+                    ## General Listener behavior
+                    
+                    Note that, for all distinct Listeners, requests SHOULD match at most one Listener.
+                    For example, if Listeners are defined for "foo.example.com" and "*.example.com", a
+                    request to "foo.example.com" SHOULD only be routed using routes attached
+                    to the "foo.example.com" Listener (and not the "*.example.com" Listener).
+                    
+                    This concept is known as "Listener Isolation", and it is an Extended feature
+                    of Gateway API. Implementations that do not support Listener Isolation MUST
+                    clearly document this, and MUST NOT claim support for the
+                    `GatewayHTTPListenerIsolation` feature.
+                    
+                    Implementations that _do_ support Listener Isolation SHOULD claim support
+                    for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated
+                    conformance tests.
+                    
+                    ## Compatible Listeners
+                    
+                    A Gateway's Listeners are considered _compatible_ if:
                     
                     1. They are distinct.
                     2. The implementation can serve them in compliance with the Addresses
@@ -3289,16 +3994,11 @@ spec:
                     on the same address, or cannot mix HTTPS and generic TLS listens on the same port
                     would not consider those cases compatible, even though they are distinct.
                     
-                    Note that requests SHOULD match at most one Listener. For example, if
-                    Listeners are defined for "foo.example.com" and "*.example.com", a
-                    request to "foo.example.com" SHOULD only be routed using routes attached
-                    to the "foo.example.com" Listener (and not the "*.example.com" Listener).
-                    This concept is known as "Listener Isolation". Implementations that do
-                    not support Listener Isolation MUST clearly document this.
-                    
                     Implementations MAY merge separate Gateways onto a single set of
                     Addresses if all Listeners across all Gateways are compatible.
                     
+                    In a future release the MinItems=1 requirement MAY be dropped.
+                    
                     Support: Core
                   items:
                     description: |-
@@ -3369,6 +4069,7 @@ spec:
                               type: object
                             maxItems: 8
                             type: array
+                            x-kubernetes-list-type: atomic
                           namespaces:
                             default:
                               from: Same
@@ -3460,10 +4161,31 @@ spec:
                           
                           * TLS: The Listener Hostname MUST match the SNI.
                           * HTTP: The Listener Hostname MUST match the Host header of the request.
-                          * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                            protocol layers as described above. If an implementation does not
-                            ensure that both the SNI and Host header match the Listener hostname,
-                            it MUST clearly document that.
+                          * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                            Note that this does not require the SNI and Host header to be the same.
+                            The semantics of this are described in more detail below.
+                          
+                          To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                          implementations that rely on SNI hostname matching MUST also verify
+                          hostnames within the application protocol.
+                          
+                          Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                          reuse of a connection by responding with the HTTP 421 Misdirected Request
+                          status code. This indicates that the origin server has rejected the
+                          request because it appears to have been misdirected.
+                          
+                          To detect misdirected requests, Gateways SHOULD match the authority of
+                          the requests with all the SNI hostname(s) configured across all the
+                          Gateway Listeners on the same port and protocol:
+                          
+                          * If another Listener has an exact match or more specific wildcard entry,
+                            the Gateway SHOULD return a 421.
+                          * If the current Listener (selected by SNI matching during ClientHello)
+                            does not match the Host:
+                              * If another Listener does match the Host the Gateway SHOULD return a
+                                421.
+                              * If no other Listener matches the Host, the Gateway MUST return a
+                                404.
                           
                           For HTTPRoute and TLSRoute resources, there is an interaction with the
                           `spec.hostnames` array. When both listener and route specify hostnames,
@@ -3515,7 +4237,7 @@ spec:
                           the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
                           if the Protocol field is "HTTP", "TCP", or "UDP".
                           
-                          The association of SNIs to Certificate defined in GatewayTLSConfig is
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
                           defined based on the Hostname field for this listener.
                           
                           The GatewayClass MUST use the longest matching SNI out of all
@@ -3602,94 +4324,7 @@ spec:
                               type: object
                             maxItems: 64
                             type: array
-                          frontendValidation:
-                            description: |+
-                              FrontendValidation holds configuration information for validating the frontend (client).
-                              Setting this field will require clients to send a client certificate
-                              required for validation during the TLS handshake. In browsers this may result in a dialog appearing
-                              that requests a user to specify the client certificate.
-                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
-                              
-                              Support: Extended
-
-                            properties:
-                              caCertificateRefs:
-                                description: |-
-                                  CACertificateRefs contains one or more references to
-                                  Kubernetes objects that contain TLS certificates of
-                                  the Certificate Authorities that can be used
-                                  as a trust anchor to validate the certificates presented by the client.
-                                  
-                                  A single CA certificate reference to a Kubernetes ConfigMap
-                                  has "Core" support.
-                                  Implementations MAY choose to support attaching multiple CA certificates to
-                                  a Listener, but this behavior is implementation-specific.
-                                  
-                                  Support: Core - A single reference to a Kubernetes ConfigMap
-                                  with the CA certificate in a key named `ca.crt`.
-                                  
-                                  Support: Implementation-specific (More than one reference, or other kinds
-                                  of resources).
-                                  
-                                  References to a resource in a different namespace are invalid UNLESS there
-                                  is a ReferenceGrant in the target namespace that allows the certificate
-                                  to be attached. If a ReferenceGrant does not allow this reference, the
-                                  "ResolvedRefs" condition MUST be set to False for this listener with the
-                                  "RefNotPermitted" reason.
-                                items:
-                                  description: |-
-                                    ObjectReference identifies an API object including its namespace.
-                                    
-                                    The API object must be valid in the cluster; the Group and Kind must
-                                    be registered in the cluster for this reference to be valid.
-                                    
-                                    References to objects with invalid Group and Kind are not valid, and must
-                                    be rejected by the implementation, with appropriate Conditions set
-                                    on the containing object.
-                                  properties:
-                                    group:
-                                      description: |-
-                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                        When unspecified or empty string, core API group is inferred.
-                                      maxLength: 253
-                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                      type: string
-                                    kind:
-                                      description: Kind is kind of the referent. For
-                                        example "ConfigMap" or "Service".
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                      type: string
-                                    name:
-                                      description: Name is the name of the referent.
-                                      maxLength: 253
-                                      minLength: 1
-                                      type: string
-                                    namespace:
-                                      description: |-
-                                        Namespace is the namespace of the referenced object. When unspecified, the local
-                                        namespace is inferred.
-                                        
-                                        Note that when a namespace different than the local namespace is specified,
-                                        a ReferenceGrant object is required in the referent namespace to allow that
-                                        namespace's owner to accept the reference. See the ReferenceGrant
-                                        documentation for details.
-                                        
-                                        Support: Core
-                                      maxLength: 63
-                                      minLength: 1
-                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                      type: string
-                                  required:
-                                    - group
-                                    - kind
-                                    - name
-                                  type: object
-                                maxItems: 8
-                                minItems: 1
-                                type: array
-                            type: object
+                            x-kubernetes-list-type: atomic
                           mode:
                             default: Terminate
                             description: |-
@@ -3768,6 +4403,366 @@ spec:
                       rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
                     == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
+                tls:
+                  description: |-
+                    TLS specifies frontend and backend tls configuration for entire gateway.
+                    
+                    Support: Extended
+                  properties:
+                    backend:
+                      description: |-
+                        Backend describes TLS configuration for gateway when connecting
+                        to backends.
+                        
+                        Note that this contains only details for the Gateway as a TLS client,
+                        and does _not_ imply behavior about how to choose which backend should
+                        get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+                        
+                        Support: Core
+                      properties:
+                        clientCertificateRef:
+                          description: |-
+                            ClientCertificateRef is a reference to an object that contains a Client
+                            Certificate and the associated private key.
+                            
+                            References to a resource in different namespace are invalid UNLESS there
+                            is a ReferenceGrant in the target namespace that allows the certificate
+                            to be attached. If a ReferenceGrant does not allow this reference, the
+                            "ResolvedRefs" condition MUST be set to False for this listener with the
+                            "RefNotPermitted" reason.
+                            
+                            ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                            Secret, or implementation-specific custom resources.
+                            
+                            Support: Core
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Secret
+                              description: Kind is kind of the referent. For example
+                                "Secret".
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                          required:
+                            - name
+                          type: object
+                      type: object
+                    frontend:
+                      description: |-
+                        Frontend describes TLS config when client connects to Gateway.
+                        Support: Core
+                      properties:
+                        default:
+                          description: |-
+                            Default specifies the default client certificate validation configuration
+                            for all Listeners handling HTTPS traffic, unless a per-port configuration
+                            is defined.
+                            
+                            support: Core
+                          properties:
+                            validation:
+                              description: |-
+                                Validation holds configuration information for validating the frontend (client).
+                                Setting this field will result in mutual authentication when connecting to the gateway.
+                                In browsers this may result in a dialog appearing
+                                that requests a user to specify the client certificate.
+                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                
+                                Support: Core
+                              properties:
+                                caCertificateRefs:
+                                  description: |-
+                                    CACertificateRefs contains one or more references to
+                                    Kubernetes objects that contain TLS certificates of
+                                    the Certificate Authorities that can be used
+                                    as a trust anchor to validate the certificates presented by the client.
+                                    
+                                    A single CA certificate reference to a Kubernetes ConfigMap
+                                    has "Core" support.
+                                    Implementations MAY choose to support attaching multiple CA certificates to
+                                    a Listener, but this behavior is implementation-specific.
+                                    
+                                    Support: Core - A single reference to a Kubernetes ConfigMap
+                                    with the CA certificate in a key named `ca.crt`.
+                                    
+                                    Support: Implementation-specific (More than one certificate in a ConfigMap
+                                    with different keys or more than one reference, or other kinds of resources).
+                                    
+                                    References to a resource in a different namespace are invalid UNLESS there
+                                    is a ReferenceGrant in the target namespace that allows the certificate
+                                    to be attached. If a ReferenceGrant does not allow this reference, the
+                                    "ResolvedRefs" condition MUST be set to False for this listener with the
+                                    "RefNotPermitted" reason.
+                                  items:
+                                    description: |-
+                                      ObjectReference identifies an API object including its namespace.
+                                      
+                                      The API object must be valid in the cluster; the Group and Kind must
+                                      be registered in the cluster for this reference to be valid.
+                                      
+                                      References to objects with invalid Group and Kind are not valid, and must
+                                      be rejected by the implementation, with appropriate Conditions set
+                                      on the containing object.
+                                    properties:
+                                      group:
+                                        description: |-
+                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                          When set to the empty string, core API group is inferred.
+                                        maxLength: 253
+                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                        type: string
+                                      kind:
+                                        description: Kind is kind of the referent. For
+                                          example "ConfigMap" or "Service".
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                        type: string
+                                      name:
+                                        description: Name is the name of the referent.
+                                        maxLength: 253
+                                        minLength: 1
+                                        type: string
+                                      namespace:
+                                        description: |-
+                                          Namespace is the namespace of the referenced object. When unspecified, the local
+                                          namespace is inferred.
+                                          
+                                          Note that when a namespace different than the local namespace is specified,
+                                          a ReferenceGrant object is required in the referent namespace to allow that
+                                          namespace's owner to accept the reference. See the ReferenceGrant
+                                          documentation for details.
+                                          
+                                          Support: Core
+                                        maxLength: 63
+                                        minLength: 1
+                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                        type: string
+                                    required:
+                                      - group
+                                      - kind
+                                      - name
+                                    type: object
+                                  maxItems: 8
+                                  minItems: 1
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                mode:
+                                  default: AllowValidOnly
+                                  description: |-
+                                    FrontendValidationMode defines the mode for validating the client certificate.
+                                    There are two possible modes:
+                                    
+                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                      the client presents a valid certificate. This certificate must successfully
+                                      pass validation against the CA certificates specified in `CACertificateRefs`.
+                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                      even if the client certificate is not presented or fails verification.
+                                    
+                                      This approach delegates client authorization to the backend and introduce
+                                      a significant security risk. It should be used in testing environments or
+                                      on a temporary basis in non-testing environments.
+                                    
+                                    Defaults to AllowValidOnly.
+                                    
+                                    Support: Core
+                                  enum:
+                                    - AllowValidOnly
+                                    - AllowInsecureFallback
+                                  type: string
+                              required:
+                                - caCertificateRefs
+                              type: object
+                          type: object
+                        perPort:
+                          description: |-
+                            PerPort specifies tls configuration assigned per port.
+                            Per port configuration is optional. Once set this configuration overrides
+                            the default configuration for all Listeners handling HTTPS traffic
+                            that match this port.
+                            Each override port requires a unique TLS configuration.
+                            
+                            support: Core
+                          items:
+                            properties:
+                              port:
+                                description: |-
+                                  The Port indicates the Port Number to which the TLS configuration will be
+                                  applied. This configuration will be applied to all Listeners handling HTTPS
+                                  traffic that match this port.
+                                  
+                                  Support: Core
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                              tls:
+                                description: |-
+                                  TLS store the configuration that will be applied to all Listeners handling
+                                  HTTPS traffic and matching given port.
+                                  
+                                  Support: Core
+                                properties:
+                                  validation:
+                                    description: |-
+                                      Validation holds configuration information for validating the frontend (client).
+                                      Setting this field will result in mutual authentication when connecting to the gateway.
+                                      In browsers this may result in a dialog appearing
+                                      that requests a user to specify the client certificate.
+                                      The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                                      
+                                      Support: Core
+                                    properties:
+                                      caCertificateRefs:
+                                        description: |-
+                                          CACertificateRefs contains one or more references to
+                                          Kubernetes objects that contain TLS certificates of
+                                          the Certificate Authorities that can be used
+                                          as a trust anchor to validate the certificates presented by the client.
+                                          
+                                          A single CA certificate reference to a Kubernetes ConfigMap
+                                          has "Core" support.
+                                          Implementations MAY choose to support attaching multiple CA certificates to
+                                          a Listener, but this behavior is implementation-specific.
+                                          
+                                          Support: Core - A single reference to a Kubernetes ConfigMap
+                                          with the CA certificate in a key named `ca.crt`.
+                                          
+                                          Support: Implementation-specific (More than one certificate in a ConfigMap
+                                          with different keys or more than one reference, or other kinds of resources).
+                                          
+                                          References to a resource in a different namespace are invalid UNLESS there
+                                          is a ReferenceGrant in the target namespace that allows the certificate
+                                          to be attached. If a ReferenceGrant does not allow this reference, the
+                                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                                          "RefNotPermitted" reason.
+                                        items:
+                                          description: |-
+                                            ObjectReference identifies an API object including its namespace.
+                                            
+                                            The API object must be valid in the cluster; the Group and Kind must
+                                            be registered in the cluster for this reference to be valid.
+                                            
+                                            References to objects with invalid Group and Kind are not valid, and must
+                                            be rejected by the implementation, with appropriate Conditions set
+                                            on the containing object.
+                                          properties:
+                                            group:
+                                              description: |-
+                                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                                When set to the empty string, core API group is inferred.
+                                              maxLength: 253
+                                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                              type: string
+                                            kind:
+                                              description: Kind is kind of the referent.
+                                                For example "ConfigMap" or "Service".
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                              type: string
+                                            name:
+                                              description: Name is the name of the referent.
+                                              maxLength: 253
+                                              minLength: 1
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of the referenced object. When unspecified, the local
+                                                namespace is inferred.
+                                                
+                                                Note that when a namespace different than the local namespace is specified,
+                                                a ReferenceGrant object is required in the referent namespace to allow that
+                                                namespace's owner to accept the reference. See the ReferenceGrant
+                                                documentation for details.
+                                                
+                                                Support: Core
+                                              maxLength: 63
+                                              minLength: 1
+                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                              type: string
+                                          required:
+                                            - group
+                                            - kind
+                                            - name
+                                          type: object
+                                        maxItems: 8
+                                        minItems: 1
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                      mode:
+                                        default: AllowValidOnly
+                                        description: |-
+                                          FrontendValidationMode defines the mode for validating the client certificate.
+                                          There are two possible modes:
+                                          
+                                          - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                            the client presents a valid certificate. This certificate must successfully
+                                            pass validation against the CA certificates specified in `CACertificateRefs`.
+                                          - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                            even if the client certificate is not presented or fails verification.
+                                          
+                                            This approach delegates client authorization to the backend and introduce
+                                            a significant security risk. It should be used in testing environments or
+                                            on a temporary basis in non-testing environments.
+                                          
+                                          Defaults to AllowValidOnly.
+                                          
+                                          Support: Core
+                                        enum:
+                                          - AllowValidOnly
+                                          - AllowInsecureFallback
+                                        type: string
+                                    required:
+                                      - caCertificateRefs
+                                    type: object
+                                type: object
+                            required:
+                              - port
+                              - tls
+                            type: object
+                          maxItems: 64
+                          type: array
+                          x-kubernetes-list-map-keys:
+                            - port
+                          x-kubernetes-list-type: map
+                          x-kubernetes-validations:
+                            - message: Port for TLS configuration must be unique within
+                                the Gateway
+                              rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                      required:
+                        - default
+                      type: object
+                  type: object
               required:
                 - gatewayClassName
                 - listeners
@@ -3788,7 +4783,7 @@ spec:
               description: Status defines the current state of Gateway.
               properties:
                 addresses:
-                  description: |+
+                  description: |-
                     Addresses lists the network addresses that have been bound to the
                     Gateway.
                     
@@ -3798,7 +4793,6 @@ spec:
                       * no addresses are specified, all addresses are dynamically assigned
                       * a combination of specified and dynamic addresses are assigned
                       * a specified address was unusable (e.g. already in use)
-
                   items:
                     description: GatewayStatusAddress describes a network address that
                       is bound to a Gateway.
@@ -3843,6 +4837,7 @@ spec:
                       true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 conditions:
                   default:
                     - lastTransitionTime: "1970-01-01T00:00:00Z"
@@ -4056,6 +5051,7 @@ spec:
                           type: object
                         maxItems: 8
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                       - attachedRoutes
                       - conditions
@@ -4090,9 +5086,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -4238,8 +5233,9 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -4301,11 +5297,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -4455,6 +5446,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -4479,9 +5471,7 @@ spec:
                         || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
                         == p2.port))))
                 rules:
-                  description: |+
-                    Rules are a list of GRPC matchers, filters and actions.
-
+                  description: Rules are a list of GRPC matchers, filters and actions.
                   items:
                     description: |-
                       GRPCRouteRule defines the semantics for matching a gRPC request based on
@@ -4527,7 +5517,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -4542,8 +5531,6 @@ spec:
                             If a Route is not able to send traffic to the backend using the specified
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-                            
-                            </gateway:experimental:description>
                           properties:
                             filters:
                               description: |-
@@ -4629,7 +5616,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -4704,7 +5691,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -4732,7 +5719,7 @@ spec:
                                         x-kubernetes-list-type: map
                                     type: object
                                   requestMirror:
-                                    description: |+
+                                    description: |-
                                       RequestMirror defines a schema for a filter that mirrors requests.
                                       Requests are sent to the specified destination, but responses from
                                       that destination are ignored.
@@ -4742,7 +5729,6 @@ spec:
                                       backends.
                                       
                                       Support: Extended
-
                                     properties:
                                       backendRef:
                                         description: |-
@@ -4838,13 +5824,12 @@ spec:
                                             rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
                                       fraction:
-                                        description: |+
+                                        description: |-
                                           Fraction represents the fraction of requests that should be
                                           mirrored to BackendRef.
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         properties:
                                           denominator:
                                             default: 100
@@ -4863,14 +5848,13 @@ spec:
                                               to denominator
                                             rule: self.numerator <= self.denominator
                                       percent:
-                                        description: |+
+                                        description: |-
                                           Percent represents the percentage of requests that should be
                                           mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                           requests) and its maximum value is 100 (indicating 100% of requests).
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         format: int32
                                         maximum: 100
                                         minimum: 0
@@ -4915,7 +5899,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -4990,7 +5974,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -5018,7 +6002,7 @@ spec:
                                         x-kubernetes-list-type: map
                                     type: object
                                   type:
-                                    description: |+
+                                    description: |-
                                       Type identifies the type of filter to apply. As with other API fields,
                                       types are classified into three conformance levels:
                                       
@@ -5043,7 +6027,6 @@ spec:
                                       If a reference to a custom filter type cannot be resolved, the filter
                                       MUST NOT be skipped. Instead, requests that would have been processed by
                                       that filter MUST receive a HTTP error response.
-
                                     enum:
                                       - ResponseHeaderModifier
                                       - RequestHeaderModifier
@@ -5085,6 +6068,7 @@ spec:
                                     rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
                                 - message: RequestHeaderModifier filter cannot be repeated
                                   rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
@@ -5181,6 +6165,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -5200,7 +6185,7 @@ spec:
                           Specifying the same filter multiple times is not supported unless explicitly
                           indicated in the filter.
                           
-                          If an implementation can not support a combination of filters, it must clearly
+                          If an implementation cannot support a combination of filters, it must clearly
                           document that limitation. In cases where incompatible or unsupported
                           filters are specified and cause the `Accepted` condition to be set to status
                           `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -5283,7 +6268,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -5357,7 +6342,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -5385,7 +6370,7 @@ spec:
                                   x-kubernetes-list-type: map
                               type: object
                             requestMirror:
-                              description: |+
+                              description: |-
                                 RequestMirror defines a schema for a filter that mirrors requests.
                                 Requests are sent to the specified destination, but responses from
                                 that destination are ignored.
@@ -5395,7 +6380,6 @@ spec:
                                 backends.
                                 
                                 Support: Extended
-
                               properties:
                                 backendRef:
                                   description: |-
@@ -5491,13 +6475,12 @@ spec:
                                       rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
                                 fraction:
-                                  description: |+
+                                  description: |-
                                     Fraction represents the fraction of requests that should be
                                     mirrored to BackendRef.
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   properties:
                                     denominator:
                                       default: 100
@@ -5516,14 +6499,13 @@ spec:
                                         denominator
                                       rule: self.numerator <= self.denominator
                                 percent:
-                                  description: |+
+                                  description: |-
                                     Percent represents the percentage of requests that should be
                                     mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                     requests) and its maximum value is 100 (indicating 100% of requests).
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   format: int32
                                   maximum: 100
                                   minimum: 0
@@ -5567,7 +6549,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -5641,7 +6623,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -5669,7 +6651,7 @@ spec:
                                   x-kubernetes-list-type: map
                               type: object
                             type:
-                              description: |+
+                              description: |-
                                 Type identifies the type of filter to apply. As with other API fields,
                                 types are classified into three conformance levels:
                                 
@@ -5694,7 +6676,6 @@ spec:
                                 If a reference to a custom filter type cannot be resolved, the filter
                                 MUST NOT be skipped. Instead, requests that would have been processed by
                                 that filter MUST receive a HTTP error response.
-
                               enum:
                                 - ResponseHeaderModifier
                                 - RequestHeaderModifier
@@ -5735,6 +6716,7 @@ spec:
                               rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: RequestHeaderModifier filter cannot be repeated
                             rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
@@ -5910,10 +6892,11 @@ spec:
                                 has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""):
                                 true'
                           type: object
-                        maxItems: 8
+                        maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
-                        description: |
+                        description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
                           
                           Support: Extended
@@ -5922,12 +6905,11 @@ spec:
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       sessionPersistence:
-                        description: |+
+                        description: |-
                           SessionPersistence defines and configures session persistence
                           for the route rule.
                           
                           Support: Extended
-
                         properties:
                           absoluteTimeout:
                             description: |-
@@ -5962,6 +6944,8 @@ spec:
                                   absolute lifetime of the cookie tracked by the gateway and
                                   is optional.
                                   
+                                  Defaults to "Session".
+                                  
                                   Support: Core for "Session" type
                                   
                                   Support: Extended for "Permanent" type
@@ -6012,6 +6996,7 @@ spec:
                     type: object
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -6036,6 +7021,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of GRPCRoute.
@@ -6079,7 +7082,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -6300,14 +7303,18 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
+          required:
+            - spec
           type: object
       served: true
       storage: true
@@ -6328,9 +7335,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -6456,8 +7462,9 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -6519,11 +7526,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -6673,6 +7675,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -6702,9 +7705,7 @@ spec:
                         - path:
                             type: PathPrefix
                             value: /
-                  description: |+
-                    Rules are a list of HTTP matchers, filters and actions.
-
+                  description: Rules are a list of HTTP matchers, filters and actions.
                   items:
                     description: |-
                       HTTPRouteRule defines semantics for matching an HTTP request based on
@@ -6757,7 +7758,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -6772,8 +7772,6 @@ spec:
                             If a Route is not able to send traffic to the backend using the specified
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-                            
-                            </gateway:experimental:description>
                           properties:
                             filters:
                               description: |-
@@ -6791,6 +7789,290 @@ spec:
                                   authentication strategies, rate-limiting, and traffic shaping. API
                                   guarantee/conformance is defined based on the type of the filter.
                                 properties:
+                                  cors:
+                                    description: |-
+                                      CORS defines a schema for a filter that responds to the
+                                      cross-origin request based on HTTP response header.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      allowCredentials:
+                                        description: |-
+                                          AllowCredentials indicates whether the actual cross-origin request allows
+                                          to include credentials.
+                                          
+                                          When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                          response header with value true (case-sensitive).
+                                          
+                                          When set to false or omitted the gateway will omit the header
+                                          `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                          behavior).
+                                          
+                                          Support: Extended
+                                        type: boolean
+                                      allowHeaders:
+                                        description: |-
+                                          AllowHeaders indicates which HTTP request headers are supported for
+                                          accessing the requested resource.
+                                          
+                                          Header names are not case sensitive.
+                                          
+                                          Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                          response header are separated by a comma (",").
+                                          
+                                          When the `AllowHeaders` field is configured with one or more headers, the
+                                          gateway must return the `Access-Control-Allow-Headers` response header
+                                          which value is present in the `AllowHeaders` field.
+                                          
+                                          If any header name in the `Access-Control-Request-Headers` request header
+                                          is not included in the list of header names specified by the response
+                                          header `Access-Control-Allow-Headers`, it will present an error on the
+                                          client side.
+                                          
+                                          If any header name in the `Access-Control-Allow-Headers` response header
+                                          does not recognize by the client, it will also occur an error on the
+                                          client side.
+                                          
+                                          A wildcard indicates that the requests with all HTTP headers are allowed.
+                                          The `Access-Control-Allow-Headers` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowHeaders` field
+                                          specified with the `*` wildcard, the gateway must specify one or more
+                                          HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                          header. The value of the header `Access-Control-Allow-Headers` is same as
+                                          the `Access-Control-Request-Headers` header provided by the client. If
+                                          the header `Access-Control-Request-Headers` is not included in the
+                                          request, the gateway will omit the `Access-Control-Allow-Headers`
+                                          response header, instead of specifying the `*` wildcard. A Gateway
+                                          implementation may choose to add implementation-specific default headers.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            HTTPHeaderName is the name of an HTTP header.
+                                            
+                                            Valid values include:
+                                            
+                                            * "Authorization"
+                                            * "Set-Cookie"
+                                            
+                                            Invalid values include:
+                                            
+                                              - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                                headers are not currently supported by this type.
+                                              - "/invalid" - "/ " is an invalid character
+                                          maxLength: 256
+                                          minLength: 1
+                                          pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                      allowMethods:
+                                        description: |-
+                                          AllowMethods indicates which HTTP methods are supported for accessing the
+                                          requested resource.
+                                          
+                                          Valid values are any method defined by RFC9110, along with the special
+                                          value `*`, which represents all HTTP methods are allowed.
+                                          
+                                          Method names are case sensitive, so these values are also case-sensitive.
+                                          (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+                                          
+                                          Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                          response header are separated by a comma (",").
+                                          
+                                          A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                          (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                          CORS-safelisted methods are always allowed, regardless of whether they
+                                          are specified in the `AllowMethods` field.
+                                          
+                                          When the `AllowMethods` field is configured with one or more methods, the
+                                          gateway must return the `Access-Control-Allow-Methods` response header
+                                          which value is present in the `AllowMethods` field.
+                                          
+                                          If the HTTP method of the `Access-Control-Request-Method` request header
+                                          is not included in the list of methods specified by the response header
+                                          `Access-Control-Allow-Methods`, it will present an error on the client
+                                          side.
+                                          
+                                          The `Access-Control-Allow-Methods` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowMethods` field
+                                          specified with the `*` wildcard, the gateway must specify one HTTP method
+                                          in the value of the Access-Control-Allow-Methods response header. The
+                                          value of the header `Access-Control-Allow-Methods` is same as the
+                                          `Access-Control-Request-Method` header provided by the client. If the
+                                          header `Access-Control-Request-Method` is not included in the request,
+                                          the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                          instead of specifying the `*` wildcard. A Gateway implementation may
+                                          choose to add implementation-specific default methods.
+                                          
+                                          Support: Extended
+                                        items:
+                                          enum:
+                                            - GET
+                                            - HEAD
+                                            - POST
+                                            - PUT
+                                            - DELETE
+                                            - CONNECT
+                                            - OPTIONS
+                                            - TRACE
+                                            - PATCH
+                                            - '*'
+                                          type: string
+                                        maxItems: 9
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowMethods cannot contain '*' alongside
+                                              other methods
+                                            rule: '!(''*'' in self && self.size() > 1)'
+                                      allowOrigins:
+                                        description: |-
+                                          AllowOrigins indicates whether the response can be shared with requested
+                                          resource from the given `Origin`.
+                                          
+                                          The `Origin` consists of a scheme and a host, with an optional port, and
+                                          takes the form `<scheme>://<host>(:<port>)`.
+                                          
+                                          Valid values for scheme are: `http` and `https`.
+                                          
+                                          Valid values for port are any integer between 1 and 65535 (the list of
+                                          available TCP/UDP ports). Note that, if not included, port `80` is
+                                          assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                          origins. This may affect origin matching.
+                                          
+                                          The host part of the origin may contain the wildcard character `*`. These
+                                          wildcard characters behave as follows:
+                                          
+                                          * `*` is a greedy match to the _left_, including any number of
+                                            DNS labels to the left of its position. This also means that
+                                            `*` will include any number of period `.` characters to the
+                                            left of its position.
+                                          * A wildcard by itself matches all hosts.
+                                          
+                                          An origin value that includes _only_ the `*` character indicates requests
+                                          from all `Origin`s are allowed.
+                                          
+                                          When the `AllowOrigins` field is configured with multiple origins, it
+                                          means the server supports clients from multiple origins. If the request
+                                          `Origin` matches the configured allowed origins, the gateway must return
+                                          the given `Origin` and sets value of the header
+                                          `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                          client.
+                                          
+                                          The status code of a successful response to a "preflight" request is
+                                          always an OK status (i.e., 204 or 200).
+                                          
+                                          If the request `Origin` does not match the configured allowed origins,
+                                          the gateway returns 204/200 response but doesn't set the relevant
+                                          cross-origin response headers. Alternatively, the gateway responds with
+                                          403 status to the "preflight" request is denied, coupled with omitting
+                                          the CORS headers. The cross-origin request fails on the client side.
+                                          Therefore, the client doesn't attempt the actual cross-origin request.
+                                          
+                                          The `Access-Control-Allow-Origin` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowOrigins` field
+                                          specified with the `*` wildcard, the gateway must return a single origin
+                                          in the value of the `Access-Control-Allow-Origin` response header,
+                                          instead of specifying the `*` wildcard. The value of the header
+                                          `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                          the client.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                            encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                            URIs that include an authority MUST include a fully qualified domain name or
+                                            IP address as the host.
+                                          maxLength: 253
+                                          minLength: 1
+                                          pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowOrigins cannot contain '*' alongside
+                                              other origins
+                                            rule: '!(''*'' in self && self.size() > 1)'
+                                      exposeHeaders:
+                                        description: |-
+                                          ExposeHeaders indicates which HTTP response headers can be exposed
+                                          to client-side scripts in response to a cross-origin request.
+                                          
+                                          A CORS-safelisted response header is an HTTP header in a CORS response
+                                          that it is considered safe to expose to the client scripts.
+                                          The CORS-safelisted response headers include the following headers:
+                                          `Cache-Control`
+                                          `Content-Language`
+                                          `Content-Length`
+                                          `Content-Type`
+                                          `Expires`
+                                          `Last-Modified`
+                                          `Pragma`
+                                          (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                          The CORS-safelisted response headers are exposed to client by default.
+                                          
+                                          When an HTTP header name is specified using the `ExposeHeaders` field,
+                                          this additional header will be exposed as part of the response to the
+                                          client.
+                                          
+                                          Header names are not case sensitive.
+                                          
+                                          Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                          response header are separated by a comma (",").
+                                          
+                                          A wildcard indicates that the responses with all HTTP headers are exposed
+                                          to clients. The `Access-Control-Expose-Headers` response header can only
+                                          use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            HTTPHeaderName is the name of an HTTP header.
+                                            
+                                            Valid values include:
+                                            
+                                            * "Authorization"
+                                            * "Set-Cookie"
+                                            
+                                            Invalid values include:
+                                            
+                                              - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                                headers are not currently supported by this type.
+                                              - "/invalid" - "/ " is an invalid character
+                                          maxLength: 256
+                                          minLength: 1
+                                          pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                      maxAge:
+                                        default: 5
+                                        description: |-
+                                          MaxAge indicates the duration (in seconds) for the client to cache the
+                                          results of a "preflight" request.
+                                          
+                                          The information provided by the `Access-Control-Allow-Methods` and
+                                          `Access-Control-Allow-Headers` response headers can be cached by the
+                                          client until the time specified by `Access-Control-Max-Age` elapses.
+                                          
+                                          The default value of `Access-Control-Max-Age` response header is 5
+                                          (seconds).
+                                        format: int32
+                                        minimum: 1
+                                        type: integer
+                                    type: object
                                   extensionRef:
                                     description: |-
                                       ExtensionRef is an optional, implementation-specific extension to the
@@ -6826,6 +8108,253 @@ spec:
                                       - kind
                                       - name
                                     type: object
+                                  externalAuth:
+                                    description: |-
+                                      ExternalAuth configures settings related to sending request details
+                                      to an external auth service. The external service MUST authenticate
+                                      the request, and MAY authorize the request as well.
+                                      
+                                      If there is any problem communicating with the external service,
+                                      this filter MUST fail closed.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef is a reference to a backend to send authorization
+                                          requests to.
+                                          
+                                          The backend must speak the selected protocol (GRPC or HTTP) on the
+                                          referenced port.
+                                          
+                                          If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                          implementation to supply the TLS details to be used to connect to that
+                                          backend.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+                                              
+                                              Defaults to "Service" when not specified.
+                                              
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+                                              
+                                              Support: Core (Services with a type other than ExternalName)
+                                              
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+                                              
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+                                              
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                          - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                          - message: Must have port for Service reference
+                                            rule: '(size(self.group) == 0 && self.kind
+                                          == ''Service'') ? has(self.port) : true'
+                                      forwardBody:
+                                        description: |-
+                                          ForwardBody controls if requests to the authorization server should include
+                                          the body of the client request; and if so, how big that body is allowed
+                                          to be.
+                                          
+                                          It is expected that implementations will buffer the request body up to
+                                          `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                          4xx series error (413 or 403 are common examples), and fail processing
+                                          of the filter.
+                                          
+                                          If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                          be forwarded.
+                                          
+                                          Feature Name: HTTPRouteExternalAuthForwardBody
+                                        properties:
+                                          maxSize:
+                                            description: |-
+                                              MaxSize specifies how large in bytes the largest body that will be buffered
+                                              and sent to the authorization server. If the body size is larger than
+                                              `maxSize`, then the body sent to the authorization server must be
+                                              truncated to `maxSize` bytes.
+                                              
+                                              Experimental note: This behavior needs to be checked against
+                                              various dataplanes; it may need to be changed.
+                                              See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                              for more.
+                                              
+                                              If 0, the body will not be sent to the authorization server.
+                                            type: integer
+                                        type: object
+                                      grpc:
+                                        description: |-
+                                          GRPCAuthConfig contains configuration for communication with ext_authz
+                                          protocol-speaking backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              If this list is empty, then all headers must be sent.
+                                              
+                                              If the list has entries, only those entries must be sent.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        type: object
+                                      http:
+                                        description: |-
+                                          HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                          backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what additional headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              The following headers must always be sent to the authorization server,
+                                              regardless of this setting:
+                                              
+                                              * `Host`
+                                              * `Method`
+                                              * `Path`
+                                              * `Content-Length`
+                                              * `Authorization`
+                                              
+                                              If this list is empty, then only those headers must be sent.
+                                              
+                                              Note that `Content-Length` has a special behavior, in that the length
+                                              sent must be correct for the actual request to the external authorization
+                                              server - that is, it must reflect the actual number of bytes sent in the
+                                              body of the request to the authorization server.
+                                              
+                                              So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                              to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                              to anything other than `0`, then the `Content-Length` of the authorization
+                                              request must be set to the actual number of bytes forwarded.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          allowedResponseHeaders:
+                                            description: |-
+                                              AllowedResponseHeaders specifies what headers from the authorization response
+                                              will be copied into the request to the backend.
+                                              
+                                              If this list is empty, then all headers from the authorization server
+                                              except Authority or Host must be copied.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          path:
+                                            description: |-
+                                              Path sets the prefix that paths from the client request will have added
+                                              when forwarded to the authorization server.
+                                              
+                                              When empty or unspecified, no prefix is added.
+                                              
+                                              Valid values are the same as the "value" regex for path values in the `match`
+                                              stanza, and the validation regex will screen out invalid paths in the same way.
+                                              Even with the validation, implementations MUST sanitize this input before using it
+                                              directly.
+                                            maxLength: 1024
+                                            pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                            type: string
+                                        type: object
+                                      protocol:
+                                        description: |-
+                                          ExternalAuthProtocol describes which protocol to use when communicating with an
+                                          ext_authz authorization server.
+                                          
+                                          When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                          on the port specified in `backendRefs`. Requests and responses are defined
+                                          in the protobufs explained at:
+                                          https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                          
+                                          When this is set to HTTP, each backend must respond with a `200` status
+                                          code in on a successful authorization. Any other code is considered
+                                          an authorization failure.
+                                          
+                                          Feature Names:
+                                          GRPC Support - HTTPRouteExternalAuthGRPC
+                                          HTTP Support - HTTPRouteExternalAuthHTTP
+                                        enum:
+                                          - HTTP
+                                          - GRPC
+                                        type: string
+                                    required:
+                                      - backendRef
+                                      - protocol
+                                    type: object
+                                    x-kubernetes-validations:
+                                      - message: grpc must be specified when protocol
+                                          is set to 'GRPC'
+                                        rule: 'self.protocol == ''GRPC'' ? has(self.grpc)
+                                      : true'
+                                      - message: protocol must be 'GRPC' when grpc is
+                                          set
+                                        rule: 'has(self.grpc) ? self.protocol == ''GRPC''
+                                      : true'
+                                      - message: http must be specified when protocol
+                                          is set to 'HTTP'
+                                        rule: 'self.protocol == ''HTTP'' ? has(self.http)
+                                      : true'
+                                      - message: protocol must be 'HTTP' when http is
+                                          set
+                                        rule: 'has(self.http) ? self.protocol == ''HTTP''
+                                      : true'
                                   requestHeaderModifier:
                                     description: |-
                                       RequestHeaderModifier defines a schema for a filter that modifies request
@@ -6859,7 +8388,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -6934,7 +8463,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -6962,7 +8491,7 @@ spec:
                                         x-kubernetes-list-type: map
                                     type: object
                                   requestMirror:
-                                    description: |+
+                                    description: |-
                                       RequestMirror defines a schema for a filter that mirrors requests.
                                       Requests are sent to the specified destination, but responses from
                                       that destination are ignored.
@@ -6972,7 +8501,6 @@ spec:
                                       backends.
                                       
                                       Support: Extended
-
                                     properties:
                                       backendRef:
                                         description: |-
@@ -7068,13 +8596,12 @@ spec:
                                             rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
                                       fraction:
-                                        description: |+
+                                        description: |-
                                           Fraction represents the fraction of requests that should be
                                           mirrored to BackendRef.
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         properties:
                                           denominator:
                                             default: 100
@@ -7093,14 +8620,13 @@ spec:
                                               to denominator
                                             rule: self.numerator <= self.denominator
                                       percent:
-                                        description: |+
+                                        description: |-
                                           Percent represents the percentage of requests that should be
                                           mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                           requests) and its maximum value is 100 (indicating 100% of requests).
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         format: int32
                                         maximum: 100
                                         minimum: 0
@@ -7298,7 +8824,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -7373,7 +8899,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -7441,6 +8967,8 @@ spec:
                                       - RequestRedirect
                                       - URLRewrite
                                       - ExtensionRef
+                                      - CORS
+                                      - ExternalAuth
                                     type: string
                                   urlRewrite:
                                     description: |-
@@ -7573,13 +9101,21 @@ spec:
                                   - message: filter.extensionRef must be specified for
                                       ExtensionRef filter.type
                                     rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                                  - message: filter.cors must be nil if the filter.type
+                                      is not CORS
+                                    rule: '!(has(self.cors) && self.type != ''CORS'')'
+                                  - message: filter.cors must be specified for CORS filter.type
+                                    rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                                  - message: filter.externalAuth must be nil if the filter.type
+                                      is not ExternalAuth
+                                    rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                                  - message: filter.externalAuth must be specified for
+                                      ExternalAuth filter.type
+                                    rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
-                                - message: May specify either httpRouteFilterRequestRedirect
-                                    or httpRouteFilterRequestRewrite, but not both
-                                  rule: '!(self.exists(f, f.type == ''RequestRedirect'')
-                                && self.exists(f, f.type == ''URLRewrite''))'
                                 - message: May specify either httpRouteFilterRequestRedirect
                                     or httpRouteFilterRequestRewrite, but not both
                                   rule: '!(self.exists(f, f.type == ''RequestRedirect'')
@@ -7685,6 +9221,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -7694,7 +9231,7 @@ spec:
                           they are specified.
                           
                           Implementations MAY choose to implement this ordering strictly, rejecting
-                          any combination or order of filters that can not be supported. If implementations
+                          any combination or order of filters that cannot be supported. If implementations
                           choose a strict interpretation of filter ordering, they MUST clearly document
                           that behavior.
                           
@@ -7716,7 +9253,7 @@ spec:
                           
                           All filters are expected to be compatible with each other except for the
                           URLRewrite and RequestRedirect filters, which may not be combined. If an
-                          implementation can not support other combinations of filters, they must clearly
+                          implementation cannot support other combinations of filters, they must clearly
                           document that limitation. In cases where incompatible or unsupported
                           filters are specified and cause the `Accepted` condition to be set to status
                           `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -7732,6 +9269,290 @@ spec:
                             authentication strategies, rate-limiting, and traffic shaping. API
                             guarantee/conformance is defined based on the type of the filter.
                           properties:
+                            cors:
+                              description: |-
+                                CORS defines a schema for a filter that responds to the
+                                cross-origin request based on HTTP response header.
+                                
+                                Support: Extended
+                              properties:
+                                allowCredentials:
+                                  description: |-
+                                    AllowCredentials indicates whether the actual cross-origin request allows
+                                    to include credentials.
+                                    
+                                    When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                    response header with value true (case-sensitive).
+                                    
+                                    When set to false or omitted the gateway will omit the header
+                                    `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                    behavior).
+                                    
+                                    Support: Extended
+                                  type: boolean
+                                allowHeaders:
+                                  description: |-
+                                    AllowHeaders indicates which HTTP request headers are supported for
+                                    accessing the requested resource.
+                                    
+                                    Header names are not case sensitive.
+                                    
+                                    Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                    response header are separated by a comma (",").
+                                    
+                                    When the `AllowHeaders` field is configured with one or more headers, the
+                                    gateway must return the `Access-Control-Allow-Headers` response header
+                                    which value is present in the `AllowHeaders` field.
+                                    
+                                    If any header name in the `Access-Control-Request-Headers` request header
+                                    is not included in the list of header names specified by the response
+                                    header `Access-Control-Allow-Headers`, it will present an error on the
+                                    client side.
+                                    
+                                    If any header name in the `Access-Control-Allow-Headers` response header
+                                    does not recognize by the client, it will also occur an error on the
+                                    client side.
+                                    
+                                    A wildcard indicates that the requests with all HTTP headers are allowed.
+                                    The `Access-Control-Allow-Headers` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowHeaders` field
+                                    specified with the `*` wildcard, the gateway must specify one or more
+                                    HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                    header. The value of the header `Access-Control-Allow-Headers` is same as
+                                    the `Access-Control-Request-Headers` header provided by the client. If
+                                    the header `Access-Control-Request-Headers` is not included in the
+                                    request, the gateway will omit the `Access-Control-Allow-Headers`
+                                    response header, instead of specifying the `*` wildcard. A Gateway
+                                    implementation may choose to add implementation-specific default headers.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      HTTPHeaderName is the name of an HTTP header.
+                                      
+                                      Valid values include:
+                                      
+                                      * "Authorization"
+                                      * "Set-Cookie"
+                                      
+                                      Invalid values include:
+                                      
+                                        - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                          headers are not currently supported by this type.
+                                        - "/invalid" - "/ " is an invalid character
+                                    maxLength: 256
+                                    minLength: 1
+                                    pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                allowMethods:
+                                  description: |-
+                                    AllowMethods indicates which HTTP methods are supported for accessing the
+                                    requested resource.
+                                    
+                                    Valid values are any method defined by RFC9110, along with the special
+                                    value `*`, which represents all HTTP methods are allowed.
+                                    
+                                    Method names are case sensitive, so these values are also case-sensitive.
+                                    (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+                                    
+                                    Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                    response header are separated by a comma (",").
+                                    
+                                    A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                    (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                    CORS-safelisted methods are always allowed, regardless of whether they
+                                    are specified in the `AllowMethods` field.
+                                    
+                                    When the `AllowMethods` field is configured with one or more methods, the
+                                    gateway must return the `Access-Control-Allow-Methods` response header
+                                    which value is present in the `AllowMethods` field.
+                                    
+                                    If the HTTP method of the `Access-Control-Request-Method` request header
+                                    is not included in the list of methods specified by the response header
+                                    `Access-Control-Allow-Methods`, it will present an error on the client
+                                    side.
+                                    
+                                    The `Access-Control-Allow-Methods` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowMethods` field
+                                    specified with the `*` wildcard, the gateway must specify one HTTP method
+                                    in the value of the Access-Control-Allow-Methods response header. The
+                                    value of the header `Access-Control-Allow-Methods` is same as the
+                                    `Access-Control-Request-Method` header provided by the client. If the
+                                    header `Access-Control-Request-Method` is not included in the request,
+                                    the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                    instead of specifying the `*` wildcard. A Gateway implementation may
+                                    choose to add implementation-specific default methods.
+                                    
+                                    Support: Extended
+                                  items:
+                                    enum:
+                                      - GET
+                                      - HEAD
+                                      - POST
+                                      - PUT
+                                      - DELETE
+                                      - CONNECT
+                                      - OPTIONS
+                                      - TRACE
+                                      - PATCH
+                                      - '*'
+                                    type: string
+                                  maxItems: 9
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowMethods cannot contain '*' alongside
+                                        other methods
+                                      rule: '!(''*'' in self && self.size() > 1)'
+                                allowOrigins:
+                                  description: |-
+                                    AllowOrigins indicates whether the response can be shared with requested
+                                    resource from the given `Origin`.
+                                    
+                                    The `Origin` consists of a scheme and a host, with an optional port, and
+                                    takes the form `<scheme>://<host>(:<port>)`.
+                                    
+                                    Valid values for scheme are: `http` and `https`.
+                                    
+                                    Valid values for port are any integer between 1 and 65535 (the list of
+                                    available TCP/UDP ports). Note that, if not included, port `80` is
+                                    assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                    origins. This may affect origin matching.
+                                    
+                                    The host part of the origin may contain the wildcard character `*`. These
+                                    wildcard characters behave as follows:
+                                    
+                                    * `*` is a greedy match to the _left_, including any number of
+                                      DNS labels to the left of its position. This also means that
+                                      `*` will include any number of period `.` characters to the
+                                      left of its position.
+                                    * A wildcard by itself matches all hosts.
+                                    
+                                    An origin value that includes _only_ the `*` character indicates requests
+                                    from all `Origin`s are allowed.
+                                    
+                                    When the `AllowOrigins` field is configured with multiple origins, it
+                                    means the server supports clients from multiple origins. If the request
+                                    `Origin` matches the configured allowed origins, the gateway must return
+                                    the given `Origin` and sets value of the header
+                                    `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                    client.
+                                    
+                                    The status code of a successful response to a "preflight" request is
+                                    always an OK status (i.e., 204 or 200).
+                                    
+                                    If the request `Origin` does not match the configured allowed origins,
+                                    the gateway returns 204/200 response but doesn't set the relevant
+                                    cross-origin response headers. Alternatively, the gateway responds with
+                                    403 status to the "preflight" request is denied, coupled with omitting
+                                    the CORS headers. The cross-origin request fails on the client side.
+                                    Therefore, the client doesn't attempt the actual cross-origin request.
+                                    
+                                    The `Access-Control-Allow-Origin` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowOrigins` field
+                                    specified with the `*` wildcard, the gateway must return a single origin
+                                    in the value of the `Access-Control-Allow-Origin` response header,
+                                    instead of specifying the `*` wildcard. The value of the header
+                                    `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                    the client.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                      encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                      URIs that include an authority MUST include a fully qualified domain name or
+                                      IP address as the host.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowOrigins cannot contain '*' alongside
+                                        other origins
+                                      rule: '!(''*'' in self && self.size() > 1)'
+                                exposeHeaders:
+                                  description: |-
+                                    ExposeHeaders indicates which HTTP response headers can be exposed
+                                    to client-side scripts in response to a cross-origin request.
+                                    
+                                    A CORS-safelisted response header is an HTTP header in a CORS response
+                                    that it is considered safe to expose to the client scripts.
+                                    The CORS-safelisted response headers include the following headers:
+                                    `Cache-Control`
+                                    `Content-Language`
+                                    `Content-Length`
+                                    `Content-Type`
+                                    `Expires`
+                                    `Last-Modified`
+                                    `Pragma`
+                                    (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                    The CORS-safelisted response headers are exposed to client by default.
+                                    
+                                    When an HTTP header name is specified using the `ExposeHeaders` field,
+                                    this additional header will be exposed as part of the response to the
+                                    client.
+                                    
+                                    Header names are not case sensitive.
+                                    
+                                    Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                    response header are separated by a comma (",").
+                                    
+                                    A wildcard indicates that the responses with all HTTP headers are exposed
+                                    to clients. The `Access-Control-Expose-Headers` response header can only
+                                    use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      HTTPHeaderName is the name of an HTTP header.
+                                      
+                                      Valid values include:
+                                      
+                                      * "Authorization"
+                                      * "Set-Cookie"
+                                      
+                                      Invalid values include:
+                                      
+                                        - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                          headers are not currently supported by this type.
+                                        - "/invalid" - "/ " is an invalid character
+                                    maxLength: 256
+                                    minLength: 1
+                                    pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                maxAge:
+                                  default: 5
+                                  description: |-
+                                    MaxAge indicates the duration (in seconds) for the client to cache the
+                                    results of a "preflight" request.
+                                    
+                                    The information provided by the `Access-Control-Allow-Methods` and
+                                    `Access-Control-Allow-Headers` response headers can be cached by the
+                                    client until the time specified by `Access-Control-Max-Age` elapses.
+                                    
+                                    The default value of `Access-Control-Max-Age` response header is 5
+                                    (seconds).
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                              type: object
                             extensionRef:
                               description: |-
                                 ExtensionRef is an optional, implementation-specific extension to the
@@ -7767,6 +9588,251 @@ spec:
                                 - kind
                                 - name
                               type: object
+                            externalAuth:
+                              description: |-
+                                ExternalAuth configures settings related to sending request details
+                                to an external auth service. The external service MUST authenticate
+                                the request, and MAY authorize the request as well.
+                                
+                                If there is any problem communicating with the external service,
+                                this filter MUST fail closed.
+                                
+                                Support: Extended
+                              properties:
+                                backendRef:
+                                  description: |-
+                                    BackendRef is a reference to a backend to send authorization
+                                    requests to.
+                                    
+                                    The backend must speak the selected protocol (GRPC or HTTP) on the
+                                    referenced port.
+                                    
+                                    If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                    implementation to supply the TLS details to be used to connect to that
+                                    backend.
+                                  properties:
+                                    group:
+                                      default: ""
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When unspecified or empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Service
+                                      description: |-
+                                        Kind is the Kubernetes resource kind of the referent. For example
+                                        "Service".
+                                        
+                                        Defaults to "Service" when not specified.
+                                        
+                                        ExternalName services can refer to CNAME DNS records that may live
+                                        outside of the cluster and as such are difficult to reason about in
+                                        terms of conformance. They also may not be safe to forward to (see
+                                        CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                        support ExternalName Services.
+                                        
+                                        Support: Core (Services with a type other than ExternalName)
+                                        
+                                        Support: Implementation-specific (Services with type ExternalName)
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the backend. When unspecified, the local
+                                        namespace is inferred.
+                                        
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+                                        
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port specifies the destination port number to use for this resource.
+                                        Port is required when the referent is a Kubernetes Service. In this
+                                        case, the port number is the service port number, not the target port.
+                                        For other resources, destination port might be derived from the referent
+                                        resource or this field.
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                  required:
+                                    - name
+                                  type: object
+                                  x-kubernetes-validations:
+                                    - message: Must have port for Service reference
+                                      rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                                    ? has(self.port) : true'
+                                forwardBody:
+                                  description: |-
+                                    ForwardBody controls if requests to the authorization server should include
+                                    the body of the client request; and if so, how big that body is allowed
+                                    to be.
+                                    
+                                    It is expected that implementations will buffer the request body up to
+                                    `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                    4xx series error (413 or 403 are common examples), and fail processing
+                                    of the filter.
+                                    
+                                    If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                    be forwarded.
+                                    
+                                    Feature Name: HTTPRouteExternalAuthForwardBody
+                                  properties:
+                                    maxSize:
+                                      description: |-
+                                        MaxSize specifies how large in bytes the largest body that will be buffered
+                                        and sent to the authorization server. If the body size is larger than
+                                        `maxSize`, then the body sent to the authorization server must be
+                                        truncated to `maxSize` bytes.
+                                        
+                                        Experimental note: This behavior needs to be checked against
+                                        various dataplanes; it may need to be changed.
+                                        See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                        for more.
+                                        
+                                        If 0, the body will not be sent to the authorization server.
+                                      type: integer
+                                  type: object
+                                grpc:
+                                  description: |-
+                                    GRPCAuthConfig contains configuration for communication with ext_authz
+                                    protocol-speaking backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        If this list is empty, then all headers must be sent.
+                                        
+                                        If the list has entries, only those entries must be sent.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                  type: object
+                                http:
+                                  description: |-
+                                    HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                    backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what additional headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        The following headers must always be sent to the authorization server,
+                                        regardless of this setting:
+                                        
+                                        * `Host`
+                                        * `Method`
+                                        * `Path`
+                                        * `Content-Length`
+                                        * `Authorization`
+                                        
+                                        If this list is empty, then only those headers must be sent.
+                                        
+                                        Note that `Content-Length` has a special behavior, in that the length
+                                        sent must be correct for the actual request to the external authorization
+                                        server - that is, it must reflect the actual number of bytes sent in the
+                                        body of the request to the authorization server.
+                                        
+                                        So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                        to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                        to anything other than `0`, then the `Content-Length` of the authorization
+                                        request must be set to the actual number of bytes forwarded.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowedResponseHeaders:
+                                      description: |-
+                                        AllowedResponseHeaders specifies what headers from the authorization response
+                                        will be copied into the request to the backend.
+                                        
+                                        If this list is empty, then all headers from the authorization server
+                                        except Authority or Host must be copied.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    path:
+                                      description: |-
+                                        Path sets the prefix that paths from the client request will have added
+                                        when forwarded to the authorization server.
+                                        
+                                        When empty or unspecified, no prefix is added.
+                                        
+                                        Valid values are the same as the "value" regex for path values in the `match`
+                                        stanza, and the validation regex will screen out invalid paths in the same way.
+                                        Even with the validation, implementations MUST sanitize this input before using it
+                                        directly.
+                                      maxLength: 1024
+                                      pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                      type: string
+                                  type: object
+                                protocol:
+                                  description: |-
+                                    ExternalAuthProtocol describes which protocol to use when communicating with an
+                                    ext_authz authorization server.
+                                    
+                                    When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                    on the port specified in `backendRefs`. Requests and responses are defined
+                                    in the protobufs explained at:
+                                    https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                    
+                                    When this is set to HTTP, each backend must respond with a `200` status
+                                    code in on a successful authorization. Any other code is considered
+                                    an authorization failure.
+                                    
+                                    Feature Names:
+                                    GRPC Support - HTTPRouteExternalAuthGRPC
+                                    HTTP Support - HTTPRouteExternalAuthHTTP
+                                  enum:
+                                    - HTTP
+                                    - GRPC
+                                  type: string
+                              required:
+                                - backendRef
+                                - protocol
+                              type: object
+                              x-kubernetes-validations:
+                                - message: grpc must be specified when protocol is set
+                                    to 'GRPC'
+                                  rule: 'self.protocol == ''GRPC'' ? has(self.grpc) :
+                                true'
+                                - message: protocol must be 'GRPC' when grpc is set
+                                  rule: 'has(self.grpc) ? self.protocol == ''GRPC'' :
+                                true'
+                                - message: http must be specified when protocol is set
+                                    to 'HTTP'
+                                  rule: 'self.protocol == ''HTTP'' ? has(self.http) :
+                                true'
+                                - message: protocol must be 'HTTP' when http is set
+                                  rule: 'has(self.http) ? self.protocol == ''HTTP'' :
+                                true'
                             requestHeaderModifier:
                               description: |-
                                 RequestHeaderModifier defines a schema for a filter that modifies request
@@ -7799,7 +9865,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -7873,7 +9939,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -7901,7 +9967,7 @@ spec:
                                   x-kubernetes-list-type: map
                               type: object
                             requestMirror:
-                              description: |+
+                              description: |-
                                 RequestMirror defines a schema for a filter that mirrors requests.
                                 Requests are sent to the specified destination, but responses from
                                 that destination are ignored.
@@ -7911,7 +9977,6 @@ spec:
                                 backends.
                                 
                                 Support: Extended
-
                               properties:
                                 backendRef:
                                   description: |-
@@ -8007,13 +10072,12 @@ spec:
                                       rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
                                 fraction:
-                                  description: |+
+                                  description: |-
                                     Fraction represents the fraction of requests that should be
                                     mirrored to BackendRef.
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   properties:
                                     denominator:
                                       default: 100
@@ -8032,14 +10096,13 @@ spec:
                                         denominator
                                       rule: self.numerator <= self.denominator
                                 percent:
-                                  description: |+
+                                  description: |-
                                     Percent represents the percentage of requests that should be
                                     mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                     requests) and its maximum value is 100 (indicating 100% of requests).
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   format: int32
                                   maximum: 100
                                   minimum: 0
@@ -8236,7 +10299,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -8310,7 +10373,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -8378,6 +10441,8 @@ spec:
                                 - RequestRedirect
                                 - URLRewrite
                                 - ExtensionRef
+                                - CORS
+                                - ExternalAuth
                               type: string
                             urlRewrite:
                               description: |-
@@ -8507,8 +10572,20 @@ spec:
                             - message: filter.extensionRef must be specified for ExtensionRef
                                 filter.type
                               rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                            - message: filter.cors must be nil if the filter.type is not
+                                CORS
+                              rule: '!(has(self.cors) && self.type != ''CORS'')'
+                            - message: filter.cors must be specified for CORS filter.type
+                              rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                            - message: filter.externalAuth must be nil if the filter.type
+                                is not ExternalAuth
+                              rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                            - message: filter.externalAuth must be specified for ExternalAuth
+                                filter.type
+                              rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: May specify either httpRouteFilterRequestRedirect
                               or httpRouteFilterRequestRewrite, but not both
@@ -8610,7 +10687,7 @@ spec:
                                   name:
                                     description: |-
                                       Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                      case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                      case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                       
                                       If multiple entries specify equivalent header names, only the first
                                       entry with an equivalent name MUST be considered for a match. Subsequent
@@ -8820,8 +10897,9 @@ spec:
                           type: object
                         maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
-                        description: |
+                        description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
                           
                           Support: Extended
@@ -8830,15 +10908,14 @@ spec:
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       retry:
-                        description: |+
+                        description: |-
                           Retry defines the configuration for when to retry an HTTP request.
                           
                           Support: Extended
-
                         properties:
                           attempts:
                             description: |-
-                              Attempts specifies the maxmimum number of times an individual request
+                              Attempts specifies the maximum number of times an individual request
                               from the gateway to a backend should be retried.
                               
                               If the maximum number of retries has been attempted without a successful
@@ -8912,20 +10989,18 @@ spec:
                                 
                                 Implementations MAY support specifying discrete values in the 400-499 range,
                                 which are often inadvisable to retry.
-                                
-                                <gateway:experimental>
                               maximum: 599
                               minimum: 400
                               type: integer
                             type: array
+                            x-kubernetes-list-type: atomic
                         type: object
                       sessionPersistence:
-                        description: |+
+                        description: |-
                           SessionPersistence defines and configures session persistence
                           for the route rule.
                           
                           Support: Extended
-
                         properties:
                           absoluteTimeout:
                             description: |-
@@ -8960,6 +11035,8 @@ spec:
                                   absolute lifetime of the cookie tracked by the gateway and
                                   is optional.
                                   
+                                  Defaults to "Session".
+                                  
                                   Support: Core for "Session" type
                                   
                                   Support: Extended for "Permanent" type
@@ -9112,6 +11189,7 @@ spec:
                       != ''PathPrefix'') ? false : true) : true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -9130,6 +11208,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of HTTPRoute.
@@ -9173,7 +11269,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -9394,11 +11490,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -9522,8 +11620,9 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -9585,11 +11684,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -9739,6 +11833,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -9768,9 +11863,7 @@ spec:
                         - path:
                             type: PathPrefix
                             value: /
-                  description: |+
-                    Rules are a list of HTTP matchers, filters and actions.
-
+                  description: Rules are a list of HTTP matchers, filters and actions.
                   items:
                     description: |-
                       HTTPRouteRule defines semantics for matching an HTTP request based on
@@ -9823,7 +11916,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -9838,8 +11930,6 @@ spec:
                             If a Route is not able to send traffic to the backend using the specified
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-                            
-                            </gateway:experimental:description>
                           properties:
                             filters:
                               description: |-
@@ -9857,6 +11947,290 @@ spec:
                                   authentication strategies, rate-limiting, and traffic shaping. API
                                   guarantee/conformance is defined based on the type of the filter.
                                 properties:
+                                  cors:
+                                    description: |-
+                                      CORS defines a schema for a filter that responds to the
+                                      cross-origin request based on HTTP response header.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      allowCredentials:
+                                        description: |-
+                                          AllowCredentials indicates whether the actual cross-origin request allows
+                                          to include credentials.
+                                          
+                                          When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                          response header with value true (case-sensitive).
+                                          
+                                          When set to false or omitted the gateway will omit the header
+                                          `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                          behavior).
+                                          
+                                          Support: Extended
+                                        type: boolean
+                                      allowHeaders:
+                                        description: |-
+                                          AllowHeaders indicates which HTTP request headers are supported for
+                                          accessing the requested resource.
+                                          
+                                          Header names are not case sensitive.
+                                          
+                                          Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                          response header are separated by a comma (",").
+                                          
+                                          When the `AllowHeaders` field is configured with one or more headers, the
+                                          gateway must return the `Access-Control-Allow-Headers` response header
+                                          which value is present in the `AllowHeaders` field.
+                                          
+                                          If any header name in the `Access-Control-Request-Headers` request header
+                                          is not included in the list of header names specified by the response
+                                          header `Access-Control-Allow-Headers`, it will present an error on the
+                                          client side.
+                                          
+                                          If any header name in the `Access-Control-Allow-Headers` response header
+                                          does not recognize by the client, it will also occur an error on the
+                                          client side.
+                                          
+                                          A wildcard indicates that the requests with all HTTP headers are allowed.
+                                          The `Access-Control-Allow-Headers` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowHeaders` field
+                                          specified with the `*` wildcard, the gateway must specify one or more
+                                          HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                          header. The value of the header `Access-Control-Allow-Headers` is same as
+                                          the `Access-Control-Request-Headers` header provided by the client. If
+                                          the header `Access-Control-Request-Headers` is not included in the
+                                          request, the gateway will omit the `Access-Control-Allow-Headers`
+                                          response header, instead of specifying the `*` wildcard. A Gateway
+                                          implementation may choose to add implementation-specific default headers.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            HTTPHeaderName is the name of an HTTP header.
+                                            
+                                            Valid values include:
+                                            
+                                            * "Authorization"
+                                            * "Set-Cookie"
+                                            
+                                            Invalid values include:
+                                            
+                                              - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                                headers are not currently supported by this type.
+                                              - "/invalid" - "/ " is an invalid character
+                                          maxLength: 256
+                                          minLength: 1
+                                          pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                      allowMethods:
+                                        description: |-
+                                          AllowMethods indicates which HTTP methods are supported for accessing the
+                                          requested resource.
+                                          
+                                          Valid values are any method defined by RFC9110, along with the special
+                                          value `*`, which represents all HTTP methods are allowed.
+                                          
+                                          Method names are case sensitive, so these values are also case-sensitive.
+                                          (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+                                          
+                                          Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                          response header are separated by a comma (",").
+                                          
+                                          A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                          (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                          CORS-safelisted methods are always allowed, regardless of whether they
+                                          are specified in the `AllowMethods` field.
+                                          
+                                          When the `AllowMethods` field is configured with one or more methods, the
+                                          gateway must return the `Access-Control-Allow-Methods` response header
+                                          which value is present in the `AllowMethods` field.
+                                          
+                                          If the HTTP method of the `Access-Control-Request-Method` request header
+                                          is not included in the list of methods specified by the response header
+                                          `Access-Control-Allow-Methods`, it will present an error on the client
+                                          side.
+                                          
+                                          The `Access-Control-Allow-Methods` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowMethods` field
+                                          specified with the `*` wildcard, the gateway must specify one HTTP method
+                                          in the value of the Access-Control-Allow-Methods response header. The
+                                          value of the header `Access-Control-Allow-Methods` is same as the
+                                          `Access-Control-Request-Method` header provided by the client. If the
+                                          header `Access-Control-Request-Method` is not included in the request,
+                                          the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                          instead of specifying the `*` wildcard. A Gateway implementation may
+                                          choose to add implementation-specific default methods.
+                                          
+                                          Support: Extended
+                                        items:
+                                          enum:
+                                            - GET
+                                            - HEAD
+                                            - POST
+                                            - PUT
+                                            - DELETE
+                                            - CONNECT
+                                            - OPTIONS
+                                            - TRACE
+                                            - PATCH
+                                            - '*'
+                                          type: string
+                                        maxItems: 9
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowMethods cannot contain '*' alongside
+                                              other methods
+                                            rule: '!(''*'' in self && self.size() > 1)'
+                                      allowOrigins:
+                                        description: |-
+                                          AllowOrigins indicates whether the response can be shared with requested
+                                          resource from the given `Origin`.
+                                          
+                                          The `Origin` consists of a scheme and a host, with an optional port, and
+                                          takes the form `<scheme>://<host>(:<port>)`.
+                                          
+                                          Valid values for scheme are: `http` and `https`.
+                                          
+                                          Valid values for port are any integer between 1 and 65535 (the list of
+                                          available TCP/UDP ports). Note that, if not included, port `80` is
+                                          assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                          origins. This may affect origin matching.
+                                          
+                                          The host part of the origin may contain the wildcard character `*`. These
+                                          wildcard characters behave as follows:
+                                          
+                                          * `*` is a greedy match to the _left_, including any number of
+                                            DNS labels to the left of its position. This also means that
+                                            `*` will include any number of period `.` characters to the
+                                            left of its position.
+                                          * A wildcard by itself matches all hosts.
+                                          
+                                          An origin value that includes _only_ the `*` character indicates requests
+                                          from all `Origin`s are allowed.
+                                          
+                                          When the `AllowOrigins` field is configured with multiple origins, it
+                                          means the server supports clients from multiple origins. If the request
+                                          `Origin` matches the configured allowed origins, the gateway must return
+                                          the given `Origin` and sets value of the header
+                                          `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                          client.
+                                          
+                                          The status code of a successful response to a "preflight" request is
+                                          always an OK status (i.e., 204 or 200).
+                                          
+                                          If the request `Origin` does not match the configured allowed origins,
+                                          the gateway returns 204/200 response but doesn't set the relevant
+                                          cross-origin response headers. Alternatively, the gateway responds with
+                                          403 status to the "preflight" request is denied, coupled with omitting
+                                          the CORS headers. The cross-origin request fails on the client side.
+                                          Therefore, the client doesn't attempt the actual cross-origin request.
+                                          
+                                          The `Access-Control-Allow-Origin` response header can only use `*`
+                                          wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          When the `AllowCredentials` field is true and `AllowOrigins` field
+                                          specified with the `*` wildcard, the gateway must return a single origin
+                                          in the value of the `Access-Control-Allow-Origin` response header,
+                                          instead of specifying the `*` wildcard. The value of the header
+                                          `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                          the client.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                            encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                            scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                            URIs that include an authority MUST include a fully qualified domain name or
+                                            IP address as the host.
+                                          maxLength: 253
+                                          minLength: 1
+                                          pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                        x-kubernetes-validations:
+                                          - message: AllowOrigins cannot contain '*' alongside
+                                              other origins
+                                            rule: '!(''*'' in self && self.size() > 1)'
+                                      exposeHeaders:
+                                        description: |-
+                                          ExposeHeaders indicates which HTTP response headers can be exposed
+                                          to client-side scripts in response to a cross-origin request.
+                                          
+                                          A CORS-safelisted response header is an HTTP header in a CORS response
+                                          that it is considered safe to expose to the client scripts.
+                                          The CORS-safelisted response headers include the following headers:
+                                          `Cache-Control`
+                                          `Content-Language`
+                                          `Content-Length`
+                                          `Content-Type`
+                                          `Expires`
+                                          `Last-Modified`
+                                          `Pragma`
+                                          (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                          The CORS-safelisted response headers are exposed to client by default.
+                                          
+                                          When an HTTP header name is specified using the `ExposeHeaders` field,
+                                          this additional header will be exposed as part of the response to the
+                                          client.
+                                          
+                                          Header names are not case sensitive.
+                                          
+                                          Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                          response header are separated by a comma (",").
+                                          
+                                          A wildcard indicates that the responses with all HTTP headers are exposed
+                                          to clients. The `Access-Control-Expose-Headers` response header can only
+                                          use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
+                                          
+                                          Support: Extended
+                                        items:
+                                          description: |-
+                                            HTTPHeaderName is the name of an HTTP header.
+                                            
+                                            Valid values include:
+                                            
+                                            * "Authorization"
+                                            * "Set-Cookie"
+                                            
+                                            Invalid values include:
+                                            
+                                              - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                                headers are not currently supported by this type.
+                                              - "/invalid" - "/ " is an invalid character
+                                          maxLength: 256
+                                          minLength: 1
+                                          pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                          type: string
+                                        maxItems: 64
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                      maxAge:
+                                        default: 5
+                                        description: |-
+                                          MaxAge indicates the duration (in seconds) for the client to cache the
+                                          results of a "preflight" request.
+                                          
+                                          The information provided by the `Access-Control-Allow-Methods` and
+                                          `Access-Control-Allow-Headers` response headers can be cached by the
+                                          client until the time specified by `Access-Control-Max-Age` elapses.
+                                          
+                                          The default value of `Access-Control-Max-Age` response header is 5
+                                          (seconds).
+                                        format: int32
+                                        minimum: 1
+                                        type: integer
+                                    type: object
                                   extensionRef:
                                     description: |-
                                       ExtensionRef is an optional, implementation-specific extension to the
@@ -9892,6 +12266,253 @@ spec:
                                       - kind
                                       - name
                                     type: object
+                                  externalAuth:
+                                    description: |-
+                                      ExternalAuth configures settings related to sending request details
+                                      to an external auth service. The external service MUST authenticate
+                                      the request, and MAY authorize the request as well.
+                                      
+                                      If there is any problem communicating with the external service,
+                                      this filter MUST fail closed.
+                                      
+                                      Support: Extended
+                                    properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef is a reference to a backend to send authorization
+                                          requests to.
+                                          
+                                          The backend must speak the selected protocol (GRPC or HTTP) on the
+                                          referenced port.
+                                          
+                                          If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                          implementation to supply the TLS details to be used to connect to that
+                                          backend.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+                                              
+                                              Defaults to "Service" when not specified.
+                                              
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+                                              
+                                              Support: Core (Services with a type other than ExternalName)
+                                              
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+                                              
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+                                              
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                          - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                          - message: Must have port for Service reference
+                                            rule: '(size(self.group) == 0 && self.kind
+                                          == ''Service'') ? has(self.port) : true'
+                                      forwardBody:
+                                        description: |-
+                                          ForwardBody controls if requests to the authorization server should include
+                                          the body of the client request; and if so, how big that body is allowed
+                                          to be.
+                                          
+                                          It is expected that implementations will buffer the request body up to
+                                          `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                          4xx series error (413 or 403 are common examples), and fail processing
+                                          of the filter.
+                                          
+                                          If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                          be forwarded.
+                                          
+                                          Feature Name: HTTPRouteExternalAuthForwardBody
+                                        properties:
+                                          maxSize:
+                                            description: |-
+                                              MaxSize specifies how large in bytes the largest body that will be buffered
+                                              and sent to the authorization server. If the body size is larger than
+                                              `maxSize`, then the body sent to the authorization server must be
+                                              truncated to `maxSize` bytes.
+                                              
+                                              Experimental note: This behavior needs to be checked against
+                                              various dataplanes; it may need to be changed.
+                                              See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                              for more.
+                                              
+                                              If 0, the body will not be sent to the authorization server.
+                                            type: integer
+                                        type: object
+                                      grpc:
+                                        description: |-
+                                          GRPCAuthConfig contains configuration for communication with ext_authz
+                                          protocol-speaking backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              If this list is empty, then all headers must be sent.
+                                              
+                                              If the list has entries, only those entries must be sent.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        type: object
+                                      http:
+                                        description: |-
+                                          HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                          backends.
+                                          
+                                          If unset, implementations must assume the default behavior for each
+                                          included field is intended.
+                                        properties:
+                                          allowedHeaders:
+                                            description: |-
+                                              AllowedRequestHeaders specifies what additional headers from the client request
+                                              will be sent to the authorization server.
+                                              
+                                              The following headers must always be sent to the authorization server,
+                                              regardless of this setting:
+                                              
+                                              * `Host`
+                                              * `Method`
+                                              * `Path`
+                                              * `Content-Length`
+                                              * `Authorization`
+                                              
+                                              If this list is empty, then only those headers must be sent.
+                                              
+                                              Note that `Content-Length` has a special behavior, in that the length
+                                              sent must be correct for the actual request to the external authorization
+                                              server - that is, it must reflect the actual number of bytes sent in the
+                                              body of the request to the authorization server.
+                                              
+                                              So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                              to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                              to anything other than `0`, then the `Content-Length` of the authorization
+                                              request must be set to the actual number of bytes forwarded.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          allowedResponseHeaders:
+                                            description: |-
+                                              AllowedResponseHeaders specifies what headers from the authorization response
+                                              will be copied into the request to the backend.
+                                              
+                                              If this list is empty, then all headers from the authorization server
+                                              except Authority or Host must be copied.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                          path:
+                                            description: |-
+                                              Path sets the prefix that paths from the client request will have added
+                                              when forwarded to the authorization server.
+                                              
+                                              When empty or unspecified, no prefix is added.
+                                              
+                                              Valid values are the same as the "value" regex for path values in the `match`
+                                              stanza, and the validation regex will screen out invalid paths in the same way.
+                                              Even with the validation, implementations MUST sanitize this input before using it
+                                              directly.
+                                            maxLength: 1024
+                                            pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                            type: string
+                                        type: object
+                                      protocol:
+                                        description: |-
+                                          ExternalAuthProtocol describes which protocol to use when communicating with an
+                                          ext_authz authorization server.
+                                          
+                                          When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                          on the port specified in `backendRefs`. Requests and responses are defined
+                                          in the protobufs explained at:
+                                          https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                          
+                                          When this is set to HTTP, each backend must respond with a `200` status
+                                          code in on a successful authorization. Any other code is considered
+                                          an authorization failure.
+                                          
+                                          Feature Names:
+                                          GRPC Support - HTTPRouteExternalAuthGRPC
+                                          HTTP Support - HTTPRouteExternalAuthHTTP
+                                        enum:
+                                          - HTTP
+                                          - GRPC
+                                        type: string
+                                    required:
+                                      - backendRef
+                                      - protocol
+                                    type: object
+                                    x-kubernetes-validations:
+                                      - message: grpc must be specified when protocol
+                                          is set to 'GRPC'
+                                        rule: 'self.protocol == ''GRPC'' ? has(self.grpc)
+                                      : true'
+                                      - message: protocol must be 'GRPC' when grpc is
+                                          set
+                                        rule: 'has(self.grpc) ? self.protocol == ''GRPC''
+                                      : true'
+                                      - message: http must be specified when protocol
+                                          is set to 'HTTP'
+                                        rule: 'self.protocol == ''HTTP'' ? has(self.http)
+                                      : true'
+                                      - message: protocol must be 'HTTP' when http is
+                                          set
+                                        rule: 'has(self.http) ? self.protocol == ''HTTP''
+                                      : true'
                                   requestHeaderModifier:
                                     description: |-
                                       RequestHeaderModifier defines a schema for a filter that modifies request
@@ -9925,7 +12546,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -10000,7 +12621,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -10028,7 +12649,7 @@ spec:
                                         x-kubernetes-list-type: map
                                     type: object
                                   requestMirror:
-                                    description: |+
+                                    description: |-
                                       RequestMirror defines a schema for a filter that mirrors requests.
                                       Requests are sent to the specified destination, but responses from
                                       that destination are ignored.
@@ -10038,7 +12659,6 @@ spec:
                                       backends.
                                       
                                       Support: Extended
-
                                     properties:
                                       backendRef:
                                         description: |-
@@ -10134,13 +12754,12 @@ spec:
                                             rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
                                       fraction:
-                                        description: |+
+                                        description: |-
                                           Fraction represents the fraction of requests that should be
                                           mirrored to BackendRef.
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         properties:
                                           denominator:
                                             default: 100
@@ -10159,14 +12778,13 @@ spec:
                                               to denominator
                                             rule: self.numerator <= self.denominator
                                       percent:
-                                        description: |+
+                                        description: |-
                                           Percent represents the percentage of requests that should be
                                           mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                           requests) and its maximum value is 100 (indicating 100% of requests).
                                           
                                           Only one of Fraction or Percent may be specified. If neither field
                                           is specified, 100% of requests will be mirrored.
-
                                         format: int32
                                         maximum: 100
                                         minimum: 0
@@ -10364,7 +12982,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -10439,7 +13057,7 @@ spec:
                                             name:
                                               description: |-
                                                 Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                                case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                                 
                                                 If multiple entries specify equivalent header names, the first entry with
                                                 an equivalent name MUST be considered for a match. Subsequent entries
@@ -10507,6 +13125,8 @@ spec:
                                       - RequestRedirect
                                       - URLRewrite
                                       - ExtensionRef
+                                      - CORS
+                                      - ExternalAuth
                                     type: string
                                   urlRewrite:
                                     description: |-
@@ -10639,13 +13259,21 @@ spec:
                                   - message: filter.extensionRef must be specified for
                                       ExtensionRef filter.type
                                     rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                                  - message: filter.cors must be nil if the filter.type
+                                      is not CORS
+                                    rule: '!(has(self.cors) && self.type != ''CORS'')'
+                                  - message: filter.cors must be specified for CORS filter.type
+                                    rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                                  - message: filter.externalAuth must be nil if the filter.type
+                                      is not ExternalAuth
+                                    rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                                  - message: filter.externalAuth must be specified for
+                                      ExternalAuth filter.type
+                                    rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                               maxItems: 16
                               type: array
+                              x-kubernetes-list-type: atomic
                               x-kubernetes-validations:
-                                - message: May specify either httpRouteFilterRequestRedirect
-                                    or httpRouteFilterRequestRewrite, but not both
-                                  rule: '!(self.exists(f, f.type == ''RequestRedirect'')
-                                && self.exists(f, f.type == ''URLRewrite''))'
                                 - message: May specify either httpRouteFilterRequestRedirect
                                     or httpRouteFilterRequestRewrite, but not both
                                   rule: '!(self.exists(f, f.type == ''RequestRedirect'')
@@ -10751,6 +13379,7 @@ spec:
                             ? has(self.port) : true'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                       filters:
                         description: |-
                           Filters define the filters that are applied to requests that match
@@ -10760,7 +13389,7 @@ spec:
                           they are specified.
                           
                           Implementations MAY choose to implement this ordering strictly, rejecting
-                          any combination or order of filters that can not be supported. If implementations
+                          any combination or order of filters that cannot be supported. If implementations
                           choose a strict interpretation of filter ordering, they MUST clearly document
                           that behavior.
                           
@@ -10782,7 +13411,7 @@ spec:
                           
                           All filters are expected to be compatible with each other except for the
                           URLRewrite and RequestRedirect filters, which may not be combined. If an
-                          implementation can not support other combinations of filters, they must clearly
+                          implementation cannot support other combinations of filters, they must clearly
                           document that limitation. In cases where incompatible or unsupported
                           filters are specified and cause the `Accepted` condition to be set to status
                           `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -10798,6 +13427,290 @@ spec:
                             authentication strategies, rate-limiting, and traffic shaping. API
                             guarantee/conformance is defined based on the type of the filter.
                           properties:
+                            cors:
+                              description: |-
+                                CORS defines a schema for a filter that responds to the
+                                cross-origin request based on HTTP response header.
+                                
+                                Support: Extended
+                              properties:
+                                allowCredentials:
+                                  description: |-
+                                    AllowCredentials indicates whether the actual cross-origin request allows
+                                    to include credentials.
+                                    
+                                    When set to true, the gateway will include the `Access-Control-Allow-Credentials`
+                                    response header with value true (case-sensitive).
+                                    
+                                    When set to false or omitted the gateway will omit the header
+                                    `Access-Control-Allow-Credentials` entirely (this is the standard CORS
+                                    behavior).
+                                    
+                                    Support: Extended
+                                  type: boolean
+                                allowHeaders:
+                                  description: |-
+                                    AllowHeaders indicates which HTTP request headers are supported for
+                                    accessing the requested resource.
+                                    
+                                    Header names are not case sensitive.
+                                    
+                                    Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                    response header are separated by a comma (",").
+                                    
+                                    When the `AllowHeaders` field is configured with one or more headers, the
+                                    gateway must return the `Access-Control-Allow-Headers` response header
+                                    which value is present in the `AllowHeaders` field.
+                                    
+                                    If any header name in the `Access-Control-Request-Headers` request header
+                                    is not included in the list of header names specified by the response
+                                    header `Access-Control-Allow-Headers`, it will present an error on the
+                                    client side.
+                                    
+                                    If any header name in the `Access-Control-Allow-Headers` response header
+                                    does not recognize by the client, it will also occur an error on the
+                                    client side.
+                                    
+                                    A wildcard indicates that the requests with all HTTP headers are allowed.
+                                    The `Access-Control-Allow-Headers` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowHeaders` field
+                                    specified with the `*` wildcard, the gateway must specify one or more
+                                    HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                    header. The value of the header `Access-Control-Allow-Headers` is same as
+                                    the `Access-Control-Request-Headers` header provided by the client. If
+                                    the header `Access-Control-Request-Headers` is not included in the
+                                    request, the gateway will omit the `Access-Control-Allow-Headers`
+                                    response header, instead of specifying the `*` wildcard. A Gateway
+                                    implementation may choose to add implementation-specific default headers.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      HTTPHeaderName is the name of an HTTP header.
+                                      
+                                      Valid values include:
+                                      
+                                      * "Authorization"
+                                      * "Set-Cookie"
+                                      
+                                      Invalid values include:
+                                      
+                                        - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                          headers are not currently supported by this type.
+                                        - "/invalid" - "/ " is an invalid character
+                                    maxLength: 256
+                                    minLength: 1
+                                    pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                allowMethods:
+                                  description: |-
+                                    AllowMethods indicates which HTTP methods are supported for accessing the
+                                    requested resource.
+                                    
+                                    Valid values are any method defined by RFC9110, along with the special
+                                    value `*`, which represents all HTTP methods are allowed.
+                                    
+                                    Method names are case sensitive, so these values are also case-sensitive.
+                                    (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+                                    
+                                    Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                    response header are separated by a comma (",").
+                                    
+                                    A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                    (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                    CORS-safelisted methods are always allowed, regardless of whether they
+                                    are specified in the `AllowMethods` field.
+                                    
+                                    When the `AllowMethods` field is configured with one or more methods, the
+                                    gateway must return the `Access-Control-Allow-Methods` response header
+                                    which value is present in the `AllowMethods` field.
+                                    
+                                    If the HTTP method of the `Access-Control-Request-Method` request header
+                                    is not included in the list of methods specified by the response header
+                                    `Access-Control-Allow-Methods`, it will present an error on the client
+                                    side.
+                                    
+                                    The `Access-Control-Allow-Methods` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowMethods` field
+                                    specified with the `*` wildcard, the gateway must specify one HTTP method
+                                    in the value of the Access-Control-Allow-Methods response header. The
+                                    value of the header `Access-Control-Allow-Methods` is same as the
+                                    `Access-Control-Request-Method` header provided by the client. If the
+                                    header `Access-Control-Request-Method` is not included in the request,
+                                    the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                    instead of specifying the `*` wildcard. A Gateway implementation may
+                                    choose to add implementation-specific default methods.
+                                    
+                                    Support: Extended
+                                  items:
+                                    enum:
+                                      - GET
+                                      - HEAD
+                                      - POST
+                                      - PUT
+                                      - DELETE
+                                      - CONNECT
+                                      - OPTIONS
+                                      - TRACE
+                                      - PATCH
+                                      - '*'
+                                    type: string
+                                  maxItems: 9
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowMethods cannot contain '*' alongside
+                                        other methods
+                                      rule: '!(''*'' in self && self.size() > 1)'
+                                allowOrigins:
+                                  description: |-
+                                    AllowOrigins indicates whether the response can be shared with requested
+                                    resource from the given `Origin`.
+                                    
+                                    The `Origin` consists of a scheme and a host, with an optional port, and
+                                    takes the form `<scheme>://<host>(:<port>)`.
+                                    
+                                    Valid values for scheme are: `http` and `https`.
+                                    
+                                    Valid values for port are any integer between 1 and 65535 (the list of
+                                    available TCP/UDP ports). Note that, if not included, port `80` is
+                                    assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                    origins. This may affect origin matching.
+                                    
+                                    The host part of the origin may contain the wildcard character `*`. These
+                                    wildcard characters behave as follows:
+                                    
+                                    * `*` is a greedy match to the _left_, including any number of
+                                      DNS labels to the left of its position. This also means that
+                                      `*` will include any number of period `.` characters to the
+                                      left of its position.
+                                    * A wildcard by itself matches all hosts.
+                                    
+                                    An origin value that includes _only_ the `*` character indicates requests
+                                    from all `Origin`s are allowed.
+                                    
+                                    When the `AllowOrigins` field is configured with multiple origins, it
+                                    means the server supports clients from multiple origins. If the request
+                                    `Origin` matches the configured allowed origins, the gateway must return
+                                    the given `Origin` and sets value of the header
+                                    `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                    client.
+                                    
+                                    The status code of a successful response to a "preflight" request is
+                                    always an OK status (i.e., 204 or 200).
+                                    
+                                    If the request `Origin` does not match the configured allowed origins,
+                                    the gateway returns 204/200 response but doesn't set the relevant
+                                    cross-origin response headers. Alternatively, the gateway responds with
+                                    403 status to the "preflight" request is denied, coupled with omitting
+                                    the CORS headers. The cross-origin request fails on the client side.
+                                    Therefore, the client doesn't attempt the actual cross-origin request.
+                                    
+                                    The `Access-Control-Allow-Origin` response header can only use `*`
+                                    wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    When the `AllowCredentials` field is true and `AllowOrigins` field
+                                    specified with the `*` wildcard, the gateway must return a single origin
+                                    in the value of the `Access-Control-Allow-Origin` response header,
+                                    instead of specifying the `*` wildcard. The value of the header
+                                    `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                    the client.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                      encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                      scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                      URIs that include an authority MUST include a fully qualified domain name or
+                                      IP address as the host.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                  x-kubernetes-validations:
+                                    - message: AllowOrigins cannot contain '*' alongside
+                                        other origins
+                                      rule: '!(''*'' in self && self.size() > 1)'
+                                exposeHeaders:
+                                  description: |-
+                                    ExposeHeaders indicates which HTTP response headers can be exposed
+                                    to client-side scripts in response to a cross-origin request.
+                                    
+                                    A CORS-safelisted response header is an HTTP header in a CORS response
+                                    that it is considered safe to expose to the client scripts.
+                                    The CORS-safelisted response headers include the following headers:
+                                    `Cache-Control`
+                                    `Content-Language`
+                                    `Content-Length`
+                                    `Content-Type`
+                                    `Expires`
+                                    `Last-Modified`
+                                    `Pragma`
+                                    (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                    The CORS-safelisted response headers are exposed to client by default.
+                                    
+                                    When an HTTP header name is specified using the `ExposeHeaders` field,
+                                    this additional header will be exposed as part of the response to the
+                                    client.
+                                    
+                                    Header names are not case sensitive.
+                                    
+                                    Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                    response header are separated by a comma (",").
+                                    
+                                    A wildcard indicates that the responses with all HTTP headers are exposed
+                                    to clients. The `Access-Control-Expose-Headers` response header can only
+                                    use `*` wildcard as value when the `AllowCredentials` field is false or omitted.
+                                    
+                                    Support: Extended
+                                  items:
+                                    description: |-
+                                      HTTPHeaderName is the name of an HTTP header.
+                                      
+                                      Valid values include:
+                                      
+                                      * "Authorization"
+                                      * "Set-Cookie"
+                                      
+                                      Invalid values include:
+                                      
+                                        - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                          headers are not currently supported by this type.
+                                        - "/invalid" - "/ " is an invalid character
+                                    maxLength: 256
+                                    minLength: 1
+                                    pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                    type: string
+                                  maxItems: 64
+                                  type: array
+                                  x-kubernetes-list-type: set
+                                maxAge:
+                                  default: 5
+                                  description: |-
+                                    MaxAge indicates the duration (in seconds) for the client to cache the
+                                    results of a "preflight" request.
+                                    
+                                    The information provided by the `Access-Control-Allow-Methods` and
+                                    `Access-Control-Allow-Headers` response headers can be cached by the
+                                    client until the time specified by `Access-Control-Max-Age` elapses.
+                                    
+                                    The default value of `Access-Control-Max-Age` response header is 5
+                                    (seconds).
+                                  format: int32
+                                  minimum: 1
+                                  type: integer
+                              type: object
                             extensionRef:
                               description: |-
                                 ExtensionRef is an optional, implementation-specific extension to the
@@ -10833,6 +13746,251 @@ spec:
                                 - kind
                                 - name
                               type: object
+                            externalAuth:
+                              description: |-
+                                ExternalAuth configures settings related to sending request details
+                                to an external auth service. The external service MUST authenticate
+                                the request, and MAY authorize the request as well.
+                                
+                                If there is any problem communicating with the external service,
+                                this filter MUST fail closed.
+                                
+                                Support: Extended
+                              properties:
+                                backendRef:
+                                  description: |-
+                                    BackendRef is a reference to a backend to send authorization
+                                    requests to.
+                                    
+                                    The backend must speak the selected protocol (GRPC or HTTP) on the
+                                    referenced port.
+                                    
+                                    If the backend service requires TLS, use BackendTLSPolicy to tell the
+                                    implementation to supply the TLS details to be used to connect to that
+                                    backend.
+                                  properties:
+                                    group:
+                                      default: ""
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When unspecified or empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Service
+                                      description: |-
+                                        Kind is the Kubernetes resource kind of the referent. For example
+                                        "Service".
+                                        
+                                        Defaults to "Service" when not specified.
+                                        
+                                        ExternalName services can refer to CNAME DNS records that may live
+                                        outside of the cluster and as such are difficult to reason about in
+                                        terms of conformance. They also may not be safe to forward to (see
+                                        CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                        support ExternalName Services.
+                                        
+                                        Support: Core (Services with a type other than ExternalName)
+                                        
+                                        Support: Implementation-specific (Services with type ExternalName)
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the backend. When unspecified, the local
+                                        namespace is inferred.
+                                        
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+                                        
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port specifies the destination port number to use for this resource.
+                                        Port is required when the referent is a Kubernetes Service. In this
+                                        case, the port number is the service port number, not the target port.
+                                        For other resources, destination port might be derived from the referent
+                                        resource or this field.
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                  required:
+                                    - name
+                                  type: object
+                                  x-kubernetes-validations:
+                                    - message: Must have port for Service reference
+                                      rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                                    ? has(self.port) : true'
+                                forwardBody:
+                                  description: |-
+                                    ForwardBody controls if requests to the authorization server should include
+                                    the body of the client request; and if so, how big that body is allowed
+                                    to be.
+                                    
+                                    It is expected that implementations will buffer the request body up to
+                                    `forwardBody.maxSize` bytes. Bodies over that size must be rejected with a
+                                    4xx series error (413 or 403 are common examples), and fail processing
+                                    of the filter.
+                                    
+                                    If unset, or `forwardBody.maxSize` is set to `0`, then the body will not
+                                    be forwarded.
+                                    
+                                    Feature Name: HTTPRouteExternalAuthForwardBody
+                                  properties:
+                                    maxSize:
+                                      description: |-
+                                        MaxSize specifies how large in bytes the largest body that will be buffered
+                                        and sent to the authorization server. If the body size is larger than
+                                        `maxSize`, then the body sent to the authorization server must be
+                                        truncated to `maxSize` bytes.
+                                        
+                                        Experimental note: This behavior needs to be checked against
+                                        various dataplanes; it may need to be changed.
+                                        See https://github.com/kubernetes-sigs/gateway-api/pull/4001#discussion_r2291405746
+                                        for more.
+                                        
+                                        If 0, the body will not be sent to the authorization server.
+                                      type: integer
+                                  type: object
+                                grpc:
+                                  description: |-
+                                    GRPCAuthConfig contains configuration for communication with ext_authz
+                                    protocol-speaking backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        If this list is empty, then all headers must be sent.
+                                        
+                                        If the list has entries, only those entries must be sent.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                  type: object
+                                http:
+                                  description: |-
+                                    HTTPAuthConfig contains configuration for communication with HTTP-speaking
+                                    backends.
+                                    
+                                    If unset, implementations must assume the default behavior for each
+                                    included field is intended.
+                                  properties:
+                                    allowedHeaders:
+                                      description: |-
+                                        AllowedRequestHeaders specifies what additional headers from the client request
+                                        will be sent to the authorization server.
+                                        
+                                        The following headers must always be sent to the authorization server,
+                                        regardless of this setting:
+                                        
+                                        * `Host`
+                                        * `Method`
+                                        * `Path`
+                                        * `Content-Length`
+                                        * `Authorization`
+                                        
+                                        If this list is empty, then only those headers must be sent.
+                                        
+                                        Note that `Content-Length` has a special behavior, in that the length
+                                        sent must be correct for the actual request to the external authorization
+                                        server - that is, it must reflect the actual number of bytes sent in the
+                                        body of the request to the authorization server.
+                                        
+                                        So if the `forwardBody` stanza is unset, or `forwardBody.maxSize` is set
+                                        to `0`, then `Content-Length` must be `0`. If `forwardBody.maxSize` is set
+                                        to anything other than `0`, then the `Content-Length` of the authorization
+                                        request must be set to the actual number of bytes forwarded.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowedResponseHeaders:
+                                      description: |-
+                                        AllowedResponseHeaders specifies what headers from the authorization response
+                                        will be copied into the request to the backend.
+                                        
+                                        If this list is empty, then all headers from the authorization server
+                                        except Authority or Host must be copied.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    path:
+                                      description: |-
+                                        Path sets the prefix that paths from the client request will have added
+                                        when forwarded to the authorization server.
+                                        
+                                        When empty or unspecified, no prefix is added.
+                                        
+                                        Valid values are the same as the "value" regex for path values in the `match`
+                                        stanza, and the validation regex will screen out invalid paths in the same way.
+                                        Even with the validation, implementations MUST sanitize this input before using it
+                                        directly.
+                                      maxLength: 1024
+                                      pattern: ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$
+                                      type: string
+                                  type: object
+                                protocol:
+                                  description: |-
+                                    ExternalAuthProtocol describes which protocol to use when communicating with an
+                                    ext_authz authorization server.
+                                    
+                                    When this is set to GRPC, each backend must use the Envoy ext_authz protocol
+                                    on the port specified in `backendRefs`. Requests and responses are defined
+                                    in the protobufs explained at:
+                                    https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+                                    
+                                    When this is set to HTTP, each backend must respond with a `200` status
+                                    code in on a successful authorization. Any other code is considered
+                                    an authorization failure.
+                                    
+                                    Feature Names:
+                                    GRPC Support - HTTPRouteExternalAuthGRPC
+                                    HTTP Support - HTTPRouteExternalAuthHTTP
+                                  enum:
+                                    - HTTP
+                                    - GRPC
+                                  type: string
+                              required:
+                                - backendRef
+                                - protocol
+                              type: object
+                              x-kubernetes-validations:
+                                - message: grpc must be specified when protocol is set
+                                    to 'GRPC'
+                                  rule: 'self.protocol == ''GRPC'' ? has(self.grpc) :
+                                true'
+                                - message: protocol must be 'GRPC' when grpc is set
+                                  rule: 'has(self.grpc) ? self.protocol == ''GRPC'' :
+                                true'
+                                - message: http must be specified when protocol is set
+                                    to 'HTTP'
+                                  rule: 'self.protocol == ''HTTP'' ? has(self.http) :
+                                true'
+                                - message: protocol must be 'HTTP' when http is set
+                                  rule: 'has(self.http) ? self.protocol == ''HTTP'' :
+                                true'
                             requestHeaderModifier:
                               description: |-
                                 RequestHeaderModifier defines a schema for a filter that modifies request
@@ -10865,7 +14023,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -10939,7 +14097,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -10967,7 +14125,7 @@ spec:
                                   x-kubernetes-list-type: map
                               type: object
                             requestMirror:
-                              description: |+
+                              description: |-
                                 RequestMirror defines a schema for a filter that mirrors requests.
                                 Requests are sent to the specified destination, but responses from
                                 that destination are ignored.
@@ -10977,7 +14135,6 @@ spec:
                                 backends.
                                 
                                 Support: Extended
-
                               properties:
                                 backendRef:
                                   description: |-
@@ -11073,13 +14230,12 @@ spec:
                                       rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
                                 fraction:
-                                  description: |+
+                                  description: |-
                                     Fraction represents the fraction of requests that should be
                                     mirrored to BackendRef.
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   properties:
                                     denominator:
                                       default: 100
@@ -11098,14 +14254,13 @@ spec:
                                         denominator
                                       rule: self.numerator <= self.denominator
                                 percent:
-                                  description: |+
+                                  description: |-
                                     Percent represents the percentage of requests that should be
                                     mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
                                     requests) and its maximum value is 100 (indicating 100% of requests).
                                     
                                     Only one of Fraction or Percent may be specified. If neither field
                                     is specified, 100% of requests will be mirrored.
-
                                   format: int32
                                   maximum: 100
                                   minimum: 0
@@ -11302,7 +14457,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -11376,7 +14531,7 @@ spec:
                                       name:
                                         description: |-
                                           Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                          case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                          case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                           
                                           If multiple entries specify equivalent header names, the first entry with
                                           an equivalent name MUST be considered for a match. Subsequent entries
@@ -11444,6 +14599,8 @@ spec:
                                 - RequestRedirect
                                 - URLRewrite
                                 - ExtensionRef
+                                - CORS
+                                - ExternalAuth
                               type: string
                             urlRewrite:
                               description: |-
@@ -11573,8 +14730,20 @@ spec:
                             - message: filter.extensionRef must be specified for ExtensionRef
                                 filter.type
                               rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                            - message: filter.cors must be nil if the filter.type is not
+                                CORS
+                              rule: '!(has(self.cors) && self.type != ''CORS'')'
+                            - message: filter.cors must be specified for CORS filter.type
+                              rule: '!(!has(self.cors) && self.type == ''CORS'')'
+                            - message: filter.externalAuth must be nil if the filter.type
+                                is not ExternalAuth
+                              rule: '!(has(self.externalAuth) && self.type != ''ExternalAuth'')'
+                            - message: filter.externalAuth must be specified for ExternalAuth
+                                filter.type
+                              rule: '!(!has(self.externalAuth) && self.type == ''ExternalAuth'')'
                         maxItems: 16
                         type: array
+                        x-kubernetes-list-type: atomic
                         x-kubernetes-validations:
                           - message: May specify either httpRouteFilterRequestRedirect
                               or httpRouteFilterRequestRewrite, but not both
@@ -11676,7 +14845,7 @@ spec:
                                   name:
                                     description: |-
                                       Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                      case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                      case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
                                       
                                       If multiple entries specify equivalent header names, only the first
                                       entry with an equivalent name MUST be considered for a match. Subsequent
@@ -11886,8 +15055,9 @@ spec:
                           type: object
                         maxItems: 64
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
-                        description: |
+                        description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
                           
                           Support: Extended
@@ -11896,15 +15066,14 @@ spec:
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       retry:
-                        description: |+
+                        description: |-
                           Retry defines the configuration for when to retry an HTTP request.
                           
                           Support: Extended
-
                         properties:
                           attempts:
                             description: |-
-                              Attempts specifies the maxmimum number of times an individual request
+                              Attempts specifies the maximum number of times an individual request
                               from the gateway to a backend should be retried.
                               
                               If the maximum number of retries has been attempted without a successful
@@ -11978,20 +15147,18 @@ spec:
                                 
                                 Implementations MAY support specifying discrete values in the 400-499 range,
                                 which are often inadvisable to retry.
-                                
-                                <gateway:experimental>
                               maximum: 599
                               minimum: 400
                               type: integer
                             type: array
+                            x-kubernetes-list-type: atomic
                         type: object
                       sessionPersistence:
-                        description: |+
+                        description: |-
                           SessionPersistence defines and configures session persistence
                           for the route rule.
                           
                           Support: Extended
-
                         properties:
                           absoluteTimeout:
                             description: |-
@@ -12026,6 +15193,8 @@ spec:
                                   absolute lifetime of the cookie tracked by the gateway and
                                   is optional.
                                   
+                                  Defaults to "Session".
+                                  
                                   Support: Core for "Session" type
                                   
                                   Support: Extended for "Permanent" type
@@ -12178,6 +15347,7 @@ spec:
                       != ''PathPrefix'') ? false : true) : true'
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: While 16 rules and 64 matches per rule are allowed, the
                         total number of matches across all rules in a route must be less
@@ -12196,6 +15366,24 @@ spec:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               type: object
             status:
               description: Status defines the current state of HTTPRoute.
@@ -12239,7 +15427,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -12460,11 +15648,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -12490,9 +15680,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -12611,6 +15800,7 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                 to:
                   description: |-
                     To describes the resources that may be referenced by the resources
@@ -12660,6 +15850,7 @@ spec:
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - from
                 - to
@@ -12683,9 +15874,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tcproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -12731,7 +15921,7 @@ spec:
               description: Spec defines the desired state of TCPRoute.
               properties:
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -12793,11 +15983,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -12947,6 +16132,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -12971,16 +16157,14 @@ spec:
                         || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
                         == p2.port))))
                 rules:
-                  description: |+
-                    Rules are a list of TCP matchers and actions.
-
+                  description: Rules are a list of TCP matchers and actions.
                   items:
                     description: TCPRouteRule is the configuration for a given rule.
                     properties:
                       backendRefs:
                         description: |-
                           BackendRefs defines the backend(s) where matching requests should be
-                          sent. If unspecified or invalid (refers to a non-existent resource or a
+                          sent. If unspecified or invalid (refers to a nonexistent resource or a
                           Service with no endpoints), the underlying implementation MUST actively
                           reject connection attempts to this backend. Connection rejections must
                           respect weight; if an invalid backend is requested to have 80% of
@@ -13003,7 +16187,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -13019,7 +16202,6 @@ spec:
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
                             
-                            </gateway:experimental:description>
                             
                             Note that when the BackendTLSPolicy object is enabled by the implementation,
                             there are some extra rules about validity to consider here. See the fields
@@ -13115,6 +16297,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -13124,14 +16307,35 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
                 - rules
               type: object
@@ -13177,7 +16381,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -13398,11 +16602,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -13428,9 +16634,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tlsroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -13535,8 +16740,9 @@ spec:
                     type: string
                   maxItems: 16
                   type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -13598,11 +16804,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -13752,6 +16953,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -13776,16 +16978,14 @@ spec:
                         || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
                         == p2.port))))
                 rules:
-                  description: |+
-                    Rules are a list of TLS matchers and actions.
-
+                  description: Rules are a list of TLS matchers and actions.
                   items:
                     description: TLSRouteRule is the configuration for a given rule.
                     properties:
                       backendRefs:
                         description: |-
                           BackendRefs defines the backend(s) where matching requests should be
-                          sent. If unspecified or invalid (refers to a non-existent resource or
+                          sent. If unspecified or invalid (refers to a nonexistent resource or
                           a Service with no endpoints), the rule performs no forwarding; if no
                           filters are specified that would result in a response being sent, the
                           underlying implementation must actively reject request attempts to this
@@ -13811,7 +17011,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -13827,7 +17026,6 @@ spec:
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
                             
-                            </gateway:experimental:description>
                             
                             Note that when the BackendTLSPolicy object is enabled by the implementation,
                             there are some extra rules about validity to consider here. See the fields
@@ -13923,6 +17121,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -13932,14 +17131,35 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
                   maxItems: 16
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
                 - rules
               type: object
@@ -13985,7 +17205,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -14206,11 +17426,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -14218,50 +17440,23 @@ spec:
             - spec
           type: object
       served: true
-      storage: true
+      storage: false
       subresources:
         status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: null
-  storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.2.1
-    gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
-  name: udproutes.gateway.networking.k8s.io
-spec:
-  group: gateway.networking.k8s.io
-  names:
-    categories:
-      - gateway-api
-    kind: UDPRoute
-    listKind: UDPRouteList
-    plural: udproutes
-    singular: udproute
-  scope: Namespaced
-  versions:
     - additionalPrinterColumns:
         - jsonPath: .metadata.creationTimestamp
           name: Age
           type: date
-      name: v1alpha2
+      name: v1alpha3
       schema:
         openAPIV3Schema:
           description: |-
-            UDPRoute provides a way to route UDP traffic. When combined with a Gateway
-            listener, it can be used to forward traffic on the port specified by the
-            listener to a set of backends specified by the UDPRoute.
+            The TLSRoute resource is similar to TCPRoute, but can be configured
+            to match against TLS-specific metadata. This allows more flexibility
+            in matching streams for a given TLS listener.
+            
+            If you need to forward traffic to a single target for a TLS listener, you
+            could choose to use a TCPRoute with a TLS listener.
           properties:
             apiVersion:
               description: |-
@@ -14281,10 +17476,69 @@ spec:
             metadata:
               type: object
             spec:
-              description: Spec defines the desired state of UDPRoute.
+              description: Spec defines the desired state of TLSRoute.
               properties:
+                hostnames:
+                  description: |-
+                    Hostnames defines a set of SNI hostnames that should match against the
+                    SNI attribute of TLS ClientHello message in TLS handshake. This matches
+                    the RFC 1123 definition of a hostname with 2 notable exceptions:
+                    
+                    1. IPs are not allowed in SNI hostnames per RFC 6066.
+                    2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
+                       label must appear by itself as the first label.
+                    
+                    If a hostname is specified by both the Listener and TLSRoute, there
+                    must be at least one intersecting hostname for the TLSRoute to be
+                    attached to the Listener. For example:
+                    
+                    * A Listener with `test.example.com` as the hostname matches TLSRoutes
+                      that have specified at least one of `test.example.com` or
+                      `*.example.com`.
+                    * A Listener with `*.example.com` as the hostname matches TLSRoutes
+                      that have specified at least one hostname that matches the Listener
+                      hostname. For example, `test.example.com` and `*.example.com` would both
+                      match. On the other hand, `example.com` and `test.example.net` would not
+                      match.
+                    
+                    If both the Listener and TLSRoute have specified hostnames, any
+                    TLSRoute hostnames that do not match the Listener hostname MUST be
+                    ignored. For example, if a Listener specified `*.example.com`, and the
+                    TLSRoute specified `test.example.com` and `test.example.net`,
+                    `test.example.net` must not be considered for a match.
+                    
+                    If both the Listener and TLSRoute have specified hostnames, and none
+                    match with the criteria above, then the TLSRoute is not accepted. The
+                    implementation must raise an 'Accepted' Condition with a status of
+                    `False` in the corresponding RouteParentStatus.
+                    
+                    Support: Core
+                  items:
+                    description: |-
+                      Hostname is the fully qualified domain name of a network host. This matches
+                      the RFC 1123 definition of a hostname with 2 notable exceptions:
+                      
+                       1. IPs are not allowed.
+                       2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
+                          label must appear by itself as the first label.
+                      
+                      Hostname can be "precise" which is a domain name without the terminating
+                      dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
+                      domain name prefixed with a single wildcard label (e.g. `*.example.com`).
+                      
+                      Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
+                      alphanumeric characters or '-', and must start and end with an alphanumeric
+                      character. No other punctuation is allowed.
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
                 parentRefs:
-                  description: |+
+                  description: |-
                     ParentRefs references the resources (usually Gateways) that a Route wants
                     to be attached to. Note that the referenced parent resource needs to
                     allow this for the attachment to be complete. For Gateways, that means
@@ -14346,11 +17600,6 @@ spec:
                     connections originating from the same namespace as the Route, for which
                     the intended destination of the connections are a Service targeted as a
                     ParentRef of the Route.
-                  
-                  
-                  
-                  
-
                   items:
                     description: |-
                       ParentReference identifies an API object (usually a Gateway) that can be considered
@@ -14500,6 +17749,7 @@ spec:
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: sectionName or port must be specified when parentRefs includes
                         2 or more references to the same parent
@@ -14524,20 +17774,21 @@ spec:
                         || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
                         == p2.port))))
                 rules:
-                  description: |+
-                    Rules are a list of UDP matchers and actions.
-
+                  description: Rules are a list of actions.
                   items:
-                    description: UDPRouteRule is the configuration for a given rule.
+                    description: TLSRouteRule is the configuration for a given rule.
                     properties:
                       backendRefs:
                         description: |-
                           BackendRefs defines the backend(s) where matching requests should be
-                          sent. If unspecified or invalid (refers to a non-existent resource or a
-                          Service with no endpoints), the underlying implementation MUST actively
-                          reject connection attempts to this backend. Packet drops must
-                          respect weight; if an invalid backend is requested to have 80% of
-                          the packets, then 80% of packets must be dropped instead.
+                          sent. If unspecified or invalid (refers to a nonexistent resource or
+                          a Service with no endpoints), the rule performs no forwarding; if no
+                          filters are specified that would result in a response being sent, the
+                          underlying implementation must actively reject request attempts to this
+                          backend, by rejecting the connection or returning a 500 status code.
+                          Request rejections must respect weight; if an invalid backend is
+                          requested to have 80% of requests, then 80% of requests must be rejected
+                          instead.
                           
                           Support: Core for Kubernetes Service
                           
@@ -14556,7 +17807,6 @@ spec:
                             namespace's owner to accept the reference. See the ReferenceGrant
                             documentation for details.
                             
-                            <gateway:experimental:description>
                             
                             When the BackendRef points to a Kubernetes Service, implementations SHOULD
                             honor the appProtocol field if it is set for the target Service Port.
@@ -14572,7 +17822,6 @@ spec:
                             protocol then the backend is considered invalid. Implementations MUST set the
                             "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
                             
-                            </gateway:experimental:description>
                             
                             Note that when the BackendTLSPolicy object is enabled by the implementation,
                             there are some extra rules about validity to consider here. See the fields
@@ -14668,6 +17917,7 @@ spec:
                         maxItems: 16
                         minItems: 1
                         type: array
+                        x-kubernetes-list-type: atomic
                       name:
                         description: |-
                           Name is the name of the route rule. This name MUST be unique within a Route if it is set.
@@ -14677,19 +17927,41 @@ spec:
                         minLength: 1
                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
+                    required:
+                      - backendRefs
                     type: object
-                  maxItems: 16
+                  maxItems: 1
                   minItems: 1
                   type: array
+                  x-kubernetes-list-type: atomic
                   x-kubernetes-validations:
                     - message: Rule name must be unique within the route
                       rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                         && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
               required:
+                - hostnames
                 - rules
               type: object
             status:
-              description: Status defines the current state of UDPRoute.
+              description: Status defines the current state of TLSRoute.
               properties:
                 parents:
                   description: |-
@@ -14730,7 +18002,7 @@ spec:
                           There are a number of cases where the "Accepted" condition may not be set
                           due to lack of controller visibility, that includes when:
                           
-                          * The Route refers to a non-existent parent.
+                          * The Route refers to a nonexistent parent.
                           * The Route is of a type that the controller does not support.
                           * The Route is in a namespace the controller does not have access to.
                         items:
@@ -14951,11 +18223,13 @@ spec:
                           - name
                         type: object
                     required:
+                      - conditions
                       - controllerName
                       - parentRef
                     type: object
                   maxItems: 32
                   type: array
+                  x-kubernetes-list-type: atomic
               required:
                 - parents
               type: object
@@ -14972,3 +18246,2416 @@ status:
     plural: ""
   conditions: null
   storedVersions: null
+---
+#
+# config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
+#
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  name: udproutes.gateway.networking.k8s.io
+spec:
+  group: gateway.networking.k8s.io
+  names:
+    categories:
+      - gateway-api
+    kind: UDPRoute
+    listKind: UDPRouteList
+    plural: udproutes
+    singular: udproute
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha2
+      schema:
+        openAPIV3Schema:
+          description: |-
+            UDPRoute provides a way to route UDP traffic. When combined with a Gateway
+            listener, it can be used to forward traffic on the port specified by the
+            listener to a set of backends specified by the UDPRoute.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of UDPRoute.
+              properties:
+                parentRefs:
+                  description: |-
+                    ParentRefs references the resources (usually Gateways) that a Route wants
+                    to be attached to. Note that the referenced parent resource needs to
+                    allow this for the attachment to be complete. For Gateways, that means
+                    the Gateway needs to allow attachment from Routes of this kind and
+                    namespace. For Services, that means the Service must either be in the same
+                    namespace for a "producer" route, or the mesh implementation must support
+                    and allow "consumer" routes for the referenced Service. ReferenceGrant is
+                    not applicable for governing ParentRefs to Services - it is not possible to
+                    create a "producer" route for a Service in a different namespace from the
+                    Route.
+                    
+                    There are two kinds of parent resources with "Core" support:
+                    
+                    * Gateway (Gateway conformance profile)
+                    * Service (Mesh conformance profile, ClusterIP Services only)
+                    
+                    This API may be extended in the future to support additional kinds of parent
+                    resources.
+                    
+                    ParentRefs must be _distinct_. This means either that:
+                    
+                    * They select different objects.  If this is the case, then parentRef
+                      entries are distinct. In terms of fields, this means that the
+                      multi-part key defined by `group`, `kind`, `namespace`, and `name` must
+                      be unique across all parentRef entries in the Route.
+                    * They do not select different objects, but for each optional field used,
+                      each ParentRef that selects the same object must set the same set of
+                      optional fields to different values. If one ParentRef sets a
+                      combination of optional fields, all must set the same combination.
+                    
+                    Some examples:
+                    
+                    * If one ParentRef sets `sectionName`, all ParentRefs referencing the
+                      same object must also set `sectionName`.
+                    * If one ParentRef sets `port`, all ParentRefs referencing the same
+                      object must also set `port`.
+                    * If one ParentRef sets `sectionName` and `port`, all ParentRefs
+                      referencing the same object must also set `sectionName` and `port`.
+                    
+                    It is possible to separately reference multiple distinct objects that may
+                    be collapsed by an implementation. For example, some implementations may
+                    choose to merge compatible Gateway Listeners together. If that is the
+                    case, the list of routes attached to those resources should also be
+                    merged.
+                    
+                    Note that for ParentRefs that cross namespace boundaries, there are specific
+                    rules. Cross-namespace references are only valid if they are explicitly
+                    allowed by something in the namespace they are referring to. For example,
+                    Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                    generic way to enable other kinds of cross-namespace reference.
+                    
+                    
+                    ParentRefs from a Route to a Service in the same namespace are "producer"
+                    routes, which apply default routing rules to inbound connections from
+                    any namespace to the Service.
+                    
+                    ParentRefs from a Route to a Service in a different namespace are
+                    "consumer" routes, and these routing rules are only applied to outbound
+                    connections originating from the same namespace as the Route, for which
+                    the intended destination of the connections are a Service targeted as a
+                    ParentRef of the Route.
+                  items:
+                    description: |-
+                      ParentReference identifies an API object (usually a Gateway) that can be considered
+                      a parent of this resource (usually a route). There are two kinds of parent resources
+                      with "Core" support:
+                      
+                      * Gateway (Gateway conformance profile)
+                      * Service (Mesh conformance profile, ClusterIP Services only)
+                      
+                      This API may be extended in the future to support additional kinds of parent
+                      resources.
+                      
+                      The API object must be valid in the cluster; the Group and Kind must
+                      be registered in the cluster for this reference to be valid.
+                    properties:
+                      group:
+                        default: gateway.networking.k8s.io
+                        description: |-
+                          Group is the group of the referent.
+                          When unspecified, "gateway.networking.k8s.io" is inferred.
+                          To set the core API group (such as for a "Service" kind referent),
+                          Group must be explicitly set to "" (empty string).
+                          
+                          Support: Core
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        default: Gateway
+                        description: |-
+                          Kind is kind of the referent.
+                          
+                          There are two kinds of parent resources with "Core" support:
+                          
+                          * Gateway (Gateway conformance profile)
+                          * Service (Mesh conformance profile, ClusterIP Services only)
+                          
+                          Support for other resources is Implementation-Specific.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: |-
+                          Name is the name of the referent.
+                          
+                          Support: Core
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      namespace:
+                        description: |-
+                          Namespace is the namespace of the referent. When unspecified, this refers
+                          to the local namespace of the Route.
+                          
+                          Note that there are specific rules for ParentRefs which cross namespace
+                          boundaries. Cross-namespace references are only valid if they are explicitly
+                          allowed by something in the namespace they are referring to. For example:
+                          Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                          generic way to enable any other kind of cross-namespace reference.
+                          
+                          
+                          ParentRefs from a Route to a Service in the same namespace are "producer"
+                          routes, which apply default routing rules to inbound connections from
+                          any namespace to the Service.
+                          
+                          ParentRefs from a Route to a Service in a different namespace are
+                          "consumer" routes, and these routing rules are only applied to outbound
+                          connections originating from the same namespace as the Route, for which
+                          the intended destination of the connections are a Service targeted as a
+                          ParentRef of the Route.
+                          
+                          
+                          Support: Core
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                        type: string
+                      port:
+                        description: |-
+                          Port is the network port this Route targets. It can be interpreted
+                          differently based on the type of parent resource.
+                          
+                          When the parent resource is a Gateway, this targets all listeners
+                          listening on the specified port that also support this kind of Route(and
+                          select this Route). It's not recommended to set `Port` unless the
+                          networking behaviors specified in a Route must apply to a specific port
+                          as opposed to a listener(s) whose port(s) may be changed. When both Port
+                          and SectionName are specified, the name and port of the selected listener
+                          must match both specified values.
+                          
+                          
+                          When the parent resource is a Service, this targets a specific port in the
+                          Service spec. When both Port (experimental) and SectionName are specified,
+                          the name and port of the selected port must match both specified values.
+                          
+                          
+                          Implementations MAY choose to support other parent resources.
+                          Implementations supporting other types of parent resources MUST clearly
+                          document how/if Port is interpreted.
+                          
+                          For the purpose of status, an attachment is considered successful as
+                          long as the parent resource accepts it partially. For example, Gateway
+                          listeners can restrict which Routes can attach to them by Route kind,
+                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                          from the referencing Route, the Route MUST be considered successfully
+                          attached. If no Gateway listeners accept attachment from this Route,
+                          the Route MUST be considered detached from the Gateway.
+                          
+                          Support: Extended
+                        format: int32
+                        maximum: 65535
+                        minimum: 1
+                        type: integer
+                      sectionName:
+                        description: |-
+                          SectionName is the name of a section within the target resource. In the
+                          following resources, SectionName is interpreted as the following:
+                          
+                          * Gateway: Listener name. When both Port (experimental) and SectionName
+                          are specified, the name and port of the selected listener must match
+                          both specified values.
+                          * Service: Port name. When both Port (experimental) and SectionName
+                          are specified, the name and port of the selected listener must match
+                          both specified values.
+                          
+                          Implementations MAY choose to support attaching Routes to other resources.
+                          If that is the case, they MUST clearly document how SectionName is
+                          interpreted.
+                          
+                          When unspecified (empty string), this will reference the entire resource.
+                          For the purpose of status, an attachment is considered successful if at
+                          least one section in the parent resource accepts it. For example, Gateway
+                          listeners can restrict which Routes can attach to them by Route kind,
+                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                          the referencing Route, the Route MUST be considered successfully
+                          attached. If no Gateway listeners accept attachment from this Route, the
+                          Route MUST be considered detached from the Gateway.
+                          
+                          Support: Core
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - name
+                    type: object
+                  maxItems: 32
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: sectionName or port must be specified when parentRefs includes
+                        2 or more references to the same parent
+                      rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
+                    || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
+                    == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
+                    p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
+                    || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
+                    == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
+                    || p2.port == 0)): true))'
+                    - message: sectionName or port must be unique when parentRefs includes
+                        2 or more references to the same parent
+                      rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                        == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
+                        || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
+                        == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
+                        p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
+                        || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                        == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                        == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
+                        || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
+                        == p2.port))))
+                rules:
+                  description: Rules are a list of UDP matchers and actions.
+                  items:
+                    description: UDPRouteRule is the configuration for a given rule.
+                    properties:
+                      backendRefs:
+                        description: |-
+                          BackendRefs defines the backend(s) where matching requests should be
+                          sent. If unspecified or invalid (refers to a nonexistent resource or a
+                          Service with no endpoints), the underlying implementation MUST actively
+                          reject connection attempts to this backend. Packet drops must
+                          respect weight; if an invalid backend is requested to have 80% of
+                          the packets, then 80% of packets must be dropped instead.
+                          
+                          Support: Core for Kubernetes Service
+                          
+                          Support: Extended for Kubernetes ServiceImport
+                          
+                          Support: Implementation-specific for any other resource
+                          
+                          Support for weight: Extended
+                        items:
+                          description: |-
+                            BackendRef defines how a Route should forward a request to a Kubernetes
+                            resource.
+                            
+                            Note that when a namespace different than the local namespace is specified, a
+                            ReferenceGrant object is required in the referent namespace to allow that
+                            namespace's owner to accept the reference. See the ReferenceGrant
+                            documentation for details.
+                            
+                            
+                            When the BackendRef points to a Kubernetes Service, implementations SHOULD
+                            honor the appProtocol field if it is set for the target Service Port.
+                            
+                            Implementations supporting appProtocol SHOULD recognize the Kubernetes
+                            Standard Application Protocols defined in KEP-3726.
+                            
+                            If a Service appProtocol isn't specified, an implementation MAY infer the
+                            backend protocol through its own means. Implementations MAY infer the
+                            protocol from the Route type referring to the backend Service.
+                            
+                            If a Route is not able to send traffic to the backend using the specified
+                            protocol then the backend is considered invalid. Implementations MUST set the
+                            "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
+                            
+                            
+                            Note that when the BackendTLSPolicy object is enabled by the implementation,
+                            there are some extra rules about validity to consider here. See the fields
+                            where this struct is used for more information about the exact behavior.
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+                                
+                                Defaults to "Service" when not specified.
+                                
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+                                
+                                Support: Core (Services with a type other than ExternalName)
+                                
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+                                
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+                                
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            weight:
+                              default: 1
+                              description: |-
+                                Weight specifies the proportion of requests forwarded to the referenced
+                                backend. This is computed as weight/(sum of all weights in this
+                                BackendRefs list). For non-zero values, there may be some epsilon from
+                                the exact proportion defined here depending on the precision an
+                                implementation supports. Weight is not a percentage and the sum of
+                                weights does not need to equal 100.
+                                
+                                If only one backend is specified and it has a weight greater than 0, 100%
+                                of the traffic is forwarded to that backend. If weight is set to 0, no
+                                traffic should be forwarded for this entry. If unspecified, weight
+                                defaults to 1.
+                                
+                                Support for this field varies based on the context where used.
+                              format: int32
+                              maximum: 1000000
+                              minimum: 0
+                              type: integer
+                          required:
+                            - name
+                          type: object
+                          x-kubernetes-validations:
+                            - message: Must have port for Service reference
+                              rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                            ? has(self.port) : true'
+                        maxItems: 16
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      name:
+                        description: |-
+                          Name is the name of the route rule. This name MUST be unique within a Route if it is set.
+                          
+                          Support: Extended
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                    required:
+                      - backendRefs
+                    type: object
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-type: atomic
+                  x-kubernetes-validations:
+                    - message: Rule name must be unique within the route
+                      rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
+                        && l1.name == l2.name))
+                useDefaultGateways:
+                  description: |-
+                    UseDefaultGateways indicates the default Gateway scope to use for this
+                    Route. If unset (the default) or set to None, the Route will not be
+                    attached to any default Gateway; if set, it will be attached to any
+                    default Gateway supporting the named scope, subject to the usual rules
+                    about which Routes a Gateway is allowed to claim.
+                    
+                    Think carefully before using this functionality! The set of default
+                    Gateways supporting the requested scope can change over time without
+                    any notice to the Route author, and in many situations it will not be
+                    appropriate to request a default Gateway for a given Route -- for
+                    example, a Route with specific security requirements should almost
+                    certainly not use a default Gateway.
+                  enum:
+                    - All
+                    - None
+                  type: string
+              required:
+                - rules
+              type: object
+            status:
+              description: Status defines the current state of UDPRoute.
+              properties:
+                parents:
+                  description: |-
+                    Parents is a list of parent resources (usually Gateways) that are
+                    associated with the route, and the status of the route with respect to
+                    each parent. When this route attaches to a parent, the controller that
+                    manages the parent must add an entry to this list when the controller
+                    first sees the route and should update the entry as appropriate when the
+                    route or gateway is modified.
+                    
+                    Note that parent references that cannot be resolved by an implementation
+                    of this API will not be added to this list. Implementations of this API
+                    can only populate Route status for the Gateways/parent resources they are
+                    responsible for.
+                    
+                    A maximum of 32 Gateways will be represented in this list. An empty list
+                    means the route has not been attached to any Gateway.
+                  items:
+                    description: |-
+                      RouteParentStatus describes the status of a route with respect to an
+                      associated Parent.
+                    properties:
+                      conditions:
+                        description: |-
+                          Conditions describes the status of the route with respect to the Gateway.
+                          Note that the route's availability is also subject to the Gateway's own
+                          status conditions and listener status.
+                          
+                          If the Route's ParentRef specifies an existing Gateway that supports
+                          Routes of this kind AND that Gateway's controller has sufficient access,
+                          then that Gateway's controller MUST set the "Accepted" condition on the
+                          Route, to indicate whether the route has been accepted or rejected by the
+                          Gateway, and why.
+                          
+                          A Route MUST be considered "Accepted" if at least one of the Route's
+                          rules is implemented by the Gateway.
+                          
+                          There are a number of cases where the "Accepted" condition may not be set
+                          due to lack of controller visibility, that includes when:
+                          
+                          * The Route refers to a nonexistent parent.
+                          * The Route is of a type that the controller does not support.
+                          * The Route is in a namespace the controller does not have access to.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      controllerName:
+                        description: |-
+                          ControllerName is a domain/path string that indicates the name of the
+                          controller that wrote this status. This corresponds with the
+                          controllerName field on GatewayClass.
+                          
+                          Example: "example.net/gateway-controller".
+                          
+                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                          valid Kubernetes names
+                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                          
+                          Controllers MUST populate this field when writing status. Controllers should ensure that
+                          entries to status populated with their ControllerName are cleaned up when they are no
+                          longer necessary.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                        type: string
+                      parentRef:
+                        description: |-
+                          ParentRef corresponds with a ParentRef in the spec that this
+                          RouteParentStatus struct describes the status of.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: |-
+                              Group is the group of the referent.
+                              When unspecified, "gateway.networking.k8s.io" is inferred.
+                              To set the core API group (such as for a "Service" kind referent),
+                              Group must be explicitly set to "" (empty string).
+                              
+                              Support: Core
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Gateway
+                            description: |-
+                              Kind is kind of the referent.
+                              
+                              There are two kinds of parent resources with "Core" support:
+                              
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+                              
+                              Support for other resources is Implementation-Specific.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: |-
+                              Name is the name of the referent.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the referent. When unspecified, this refers
+                              to the local namespace of the Route.
+                              
+                              Note that there are specific rules for ParentRefs which cross namespace
+                              boundaries. Cross-namespace references are only valid if they are explicitly
+                              allowed by something in the namespace they are referring to. For example:
+                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                              generic way to enable any other kind of cross-namespace reference.
+                              
+                              
+                              ParentRefs from a Route to a Service in the same namespace are "producer"
+                              routes, which apply default routing rules to inbound connections from
+                              any namespace to the Service.
+                              
+                              ParentRefs from a Route to a Service in a different namespace are
+                              "consumer" routes, and these routing rules are only applied to outbound
+                              connections originating from the same namespace as the Route, for which
+                              the intended destination of the connections are a Service targeted as a
+                              ParentRef of the Route.
+                              
+                              
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port is the network port this Route targets. It can be interpreted
+                              differently based on the type of parent resource.
+                              
+                              When the parent resource is a Gateway, this targets all listeners
+                              listening on the specified port that also support this kind of Route(and
+                              select this Route). It's not recommended to set `Port` unless the
+                              networking behaviors specified in a Route must apply to a specific port
+                              as opposed to a listener(s) whose port(s) may be changed. When both Port
+                              and SectionName are specified, the name and port of the selected listener
+                              must match both specified values.
+                              
+                              
+                              When the parent resource is a Service, this targets a specific port in the
+                              Service spec. When both Port (experimental) and SectionName are specified,
+                              the name and port of the selected port must match both specified values.
+                              
+                              
+                              Implementations MAY choose to support other parent resources.
+                              Implementations supporting other types of parent resources MUST clearly
+                              document how/if Port is interpreted.
+                              
+                              For the purpose of status, an attachment is considered successful as
+                              long as the parent resource accepts it partially. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                              from the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route,
+                              the Route MUST be considered detached from the Gateway.
+                              
+                              Support: Extended
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          sectionName:
+                            description: |-
+                              SectionName is the name of a section within the target resource. In the
+                              following resources, SectionName is interpreted as the following:
+                              
+                              * Gateway: Listener name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              * Service: Port name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              
+                              Implementations MAY choose to support attaching Routes to other resources.
+                              If that is the case, they MUST clearly document how SectionName is
+                              interpreted.
+                              
+                              When unspecified (empty string), this will reference the entire resource.
+                              For the purpose of status, an attachment is considered successful if at
+                              least one section in the parent resource accepts it. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                              the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route, the
+                              Route MUST be considered detached from the Gateway.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                        required:
+                          - name
+                        type: object
+                    required:
+                      - conditions
+                      - controllerName
+                      - parentRef
+                    type: object
+                  maxItems: 32
+                  type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - parents
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
+---
+#
+# config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
+#
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  labels:
+    gateway.networking.k8s.io/policy: Direct
+  name: xbackendtrafficpolicies.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+      - gateway-api
+    kind: XBackendTrafficPolicy
+    listKind: XBackendTrafficPolicyList
+    plural: xbackendtrafficpolicies
+    shortNames:
+      - xbtrafficpolicy
+    singular: xbackendtrafficpolicy
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            XBackendTrafficPolicy defines the configuration for how traffic to a
+            target backend should be handled.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of BackendTrafficPolicy.
+              properties:
+                retryConstraint:
+                  description: |-
+                    RetryConstraint defines the configuration for when to allow or prevent
+                    further retries to a target backend, by dynamically calculating a 'retry
+                    budget'. This budget is calculated based on the percentage of incoming
+                    traffic composed of retries over a given time interval. Once the budget
+                    is exceeded, additional retries will be rejected.
+                    
+                    For example, if the retry budget interval is 10 seconds, there have been
+                    1000 active requests in the past 10 seconds, and the allowed percentage
+                    of requests that can be retried is 20% (the default), then 200 of those
+                    requests may be composed of retries. Active requests will only be
+                    considered for the duration of the interval when calculating the retry
+                    budget. Retrying the same original request multiple times within the
+                    retry budget interval will lead to each retry being counted towards
+                    calculating the budget.
+                    
+                    Configuring a RetryConstraint in BackendTrafficPolicy is compatible with
+                    HTTPRoute Retry settings for each HTTPRouteRule that targets the same
+                    backend. While the HTTPRouteRule Retry stanza can specify whether a
+                    request will be retried, and the number of retry attempts each client
+                    may perform, RetryConstraint helps prevent cascading failures such as
+                    retry storms during periods of consistent failures.
+                    
+                    After the retry budget has been exceeded, additional retries to the
+                    backend MUST return a 503 response to the client.
+                    
+                    Additional configurations for defining a constraint on retries MAY be
+                    defined in the future.
+                    
+                    Support: Extended
+                  properties:
+                    budget:
+                      default:
+                        interval: 10s
+                        percent: 20
+                      description: Budget holds the details of the retry budget configuration.
+                      properties:
+                        interval:
+                          default: 10s
+                          description: |-
+                            Interval defines the duration in which requests will be considered
+                            for calculating the budget for retries.
+                            
+                            Support: Extended
+                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                          type: string
+                          x-kubernetes-validations:
+                            - message: interval can not be greater than one hour or less
+                                than one second
+                              rule: '!(duration(self) < duration(''1s'') || duration(self)
+                            > duration(''1h''))'
+                        percent:
+                          default: 20
+                          description: |-
+                            Percent defines the maximum percentage of active requests that may
+                            be made up of retries.
+                            
+                            Support: Extended
+                          maximum: 100
+                          minimum: 0
+                          type: integer
+                      type: object
+                    minRetryRate:
+                      default:
+                        count: 10
+                        interval: 1s
+                      description: |-
+                        MinRetryRate defines the minimum rate of retries that will be allowable
+                        over a specified duration of time.
+                        
+                        The effective overall minimum rate of retries targeting the backend
+                        service may be much higher, as there can be any number of clients which
+                        are applying this setting locally.
+                        
+                        This ensures that requests can still be retried during periods of low
+                        traffic, where the budget for retries may be calculated as a very low
+                        value.
+                        
+                        Support: Extended
+                      properties:
+                        count:
+                          description: |-
+                            Count specifies the number of requests per time interval.
+                            
+                            Support: Extended
+                          maximum: 1000000
+                          minimum: 1
+                          type: integer
+                        interval:
+                          description: |-
+                            Interval specifies the divisor of the rate of requests, the amount of
+                            time during which the given count of requests occur.
+                            
+                            Support: Extended
+                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                          type: string
+                          x-kubernetes-validations:
+                            - message: interval can not be greater than one hour
+                              rule: '!(duration(self) == duration(''0s'') || duration(self)
+                            > duration(''1h''))'
+                      type: object
+                  type: object
+                sessionPersistence:
+                  description: |-
+                    SessionPersistence defines and configures session persistence
+                    for the backend.
+                    
+                    Support: Extended
+                  properties:
+                    absoluteTimeout:
+                      description: |-
+                        AbsoluteTimeout defines the absolute timeout of the persistent
+                        session. Once the AbsoluteTimeout duration has elapsed, the
+                        session becomes invalid.
+                        
+                        Support: Extended
+                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                      type: string
+                    cookieConfig:
+                      description: |-
+                        CookieConfig provides configuration settings that are specific
+                        to cookie-based session persistence.
+                        
+                        Support: Core
+                      properties:
+                        lifetimeType:
+                          default: Session
+                          description: |-
+                            LifetimeType specifies whether the cookie has a permanent or
+                            session-based lifetime. A permanent cookie persists until its
+                            specified expiry time, defined by the Expires or Max-Age cookie
+                            attributes, while a session cookie is deleted when the current
+                            session ends.
+                            
+                            When set to "Permanent", AbsoluteTimeout indicates the
+                            cookie's lifetime via the Expires or Max-Age cookie attributes
+                            and is required.
+                            
+                            When set to "Session", AbsoluteTimeout indicates the
+                            absolute lifetime of the cookie tracked by the gateway and
+                            is optional.
+                            
+                            Defaults to "Session".
+                            
+                            Support: Core for "Session" type
+                            
+                            Support: Extended for "Permanent" type
+                          enum:
+                            - Permanent
+                            - Session
+                          type: string
+                      type: object
+                    idleTimeout:
+                      description: |-
+                        IdleTimeout defines the idle timeout of the persistent session.
+                        Once the session has been idle for more than the specified
+                        IdleTimeout duration, the session becomes invalid.
+                        
+                        Support: Extended
+                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                      type: string
+                    sessionName:
+                      description: |-
+                        SessionName defines the name of the persistent session token
+                        which may be reflected in the cookie or the header. Users
+                        should avoid reusing session names to prevent unintended
+                        consequences, such as rejection or unpredictable behavior.
+                        
+                        Support: Implementation-specific
+                      maxLength: 128
+                      type: string
+                    type:
+                      default: Cookie
+                      description: |-
+                        Type defines the type of session persistence such as through
+                        the use a header or cookie. Defaults to cookie based session
+                        persistence.
+                        
+                        Support: Core for "Cookie" type
+                        
+                        Support: Extended for "Header" type
+                      enum:
+                        - Cookie
+                        - Header
+                      type: string
+                  type: object
+                  x-kubernetes-validations:
+                    - message: AbsoluteTimeout must be specified when cookie lifetimeType
+                        is Permanent
+                      rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
+                    || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
+                targetRefs:
+                  description: |-
+                    TargetRefs identifies API object(s) to apply this policy to.
+                    Currently, Backends (A grouping of like endpoints such as Service,
+                    ServiceImport, or any implementation-specific backendRef) are the only
+                    valid API target references.
+                    
+                    Currently, a TargetRef can not be scoped to a specific port on a
+                    Service.
+                  items:
+                    description: |-
+                      LocalPolicyTargetReference identifies an API object to apply a direct or
+                      inherited policy to. This should be used as part of Policy resources
+                      that can target Gateway API resources. For more information on how this
+                      policy attachment model works, and a sample Policy resource, refer to
+                      the policy attachment documentation for Gateway API.
+                    properties:
+                      group:
+                        description: Group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        description: Kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: Name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                    required:
+                      - group
+                      - kind
+                      - name
+                    type: object
+                  maxItems: 16
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - group
+                    - kind
+                    - name
+                  x-kubernetes-list-type: map
+              required:
+                - targetRefs
+              type: object
+            status:
+              description: Status defines the current state of BackendTrafficPolicy.
+              properties:
+                ancestors:
+                  description: |-
+                    Ancestors is a list of ancestor resources (usually Gateways) that are
+                    associated with the policy, and the status of the policy with respect to
+                    each ancestor. When this policy attaches to a parent, the controller that
+                    manages the parent and the ancestors MUST add an entry to this list when
+                    the controller first sees the policy and SHOULD update the entry as
+                    appropriate when the relevant ancestor is modified.
+                    
+                    Note that choosing the relevant ancestor is left to the Policy designers;
+                    an important part of Policy design is designing the right object level at
+                    which to namespace this status.
+                    
+                    Note also that implementations MUST ONLY populate ancestor status for
+                    the Ancestor resources they are responsible for. Implementations MUST
+                    use the ControllerName field to uniquely identify the entries in this list
+                    that they are responsible for.
+                    
+                    Note that to achieve this, the list of PolicyAncestorStatus structs
+                    MUST be treated as a map with a composite key, made up of the AncestorRef
+                    and ControllerName fields combined.
+                    
+                    A maximum of 16 ancestors will be represented in this list. An empty list
+                    means the Policy is not relevant for any ancestors.
+                    
+                    If this slice is full, implementations MUST NOT add further entries.
+                    Instead they MUST consider the policy unimplementable and signal that
+                    on any related resources such as the ancestor that would be referenced
+                    here. For example, if this list was full on BackendTLSPolicy, no
+                    additional Gateways would be able to reference the Service targeted by
+                    the BackendTLSPolicy.
+                  items:
+                    description: |-
+                      PolicyAncestorStatus describes the status of a route with respect to an
+                      associated Ancestor.
+                      
+                      Ancestors refer to objects that are either the Target of a policy or above it
+                      in terms of object hierarchy. For example, if a policy targets a Service, the
+                      Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                      the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                      useful object to place Policy status on, so we recommend that implementations
+                      SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                      have a _very_ good reason otherwise.
+                      
+                      In the context of policy attachment, the Ancestor is used to distinguish which
+                      resource results in a distinct application of this policy. For example, if a policy
+                      targets a Service, it may have a distinct result per attached Gateway.
+                      
+                      Policies targeting the same resource may have different effects depending on the
+                      ancestors of those resources. For example, different Gateways targeting the same
+                      Service may have different capabilities, especially if they have different underlying
+                      implementations.
+                      
+                      For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                      used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                      In this case, the relevant object for status is the Gateway, and that is the
+                      ancestor object referred to in this status.
+                      
+                      Note that a parent is also an ancestor, so for objects where the parent is the
+                      relevant object for status, this struct SHOULD still be used.
+                      
+                      This struct is intended to be used in a slice that's effectively a map,
+                      with a composite key made up of the AncestorRef and the ControllerName.
+                    properties:
+                      ancestorRef:
+                        description: |-
+                          AncestorRef corresponds with a ParentRef in the spec that this
+                          PolicyAncestorStatus struct describes the status of.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: |-
+                              Group is the group of the referent.
+                              When unspecified, "gateway.networking.k8s.io" is inferred.
+                              To set the core API group (such as for a "Service" kind referent),
+                              Group must be explicitly set to "" (empty string).
+                              
+                              Support: Core
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Gateway
+                            description: |-
+                              Kind is kind of the referent.
+                              
+                              There are two kinds of parent resources with "Core" support:
+                              
+                              * Gateway (Gateway conformance profile)
+                              * Service (Mesh conformance profile, ClusterIP Services only)
+                              
+                              Support for other resources is Implementation-Specific.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: |-
+                              Name is the name of the referent.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the referent. When unspecified, this refers
+                              to the local namespace of the Route.
+                              
+                              Note that there are specific rules for ParentRefs which cross namespace
+                              boundaries. Cross-namespace references are only valid if they are explicitly
+                              allowed by something in the namespace they are referring to. For example:
+                              Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                              generic way to enable any other kind of cross-namespace reference.
+                              
+                              
+                              ParentRefs from a Route to a Service in the same namespace are "producer"
+                              routes, which apply default routing rules to inbound connections from
+                              any namespace to the Service.
+                              
+                              ParentRefs from a Route to a Service in a different namespace are
+                              "consumer" routes, and these routing rules are only applied to outbound
+                              connections originating from the same namespace as the Route, for which
+                              the intended destination of the connections are a Service targeted as a
+                              ParentRef of the Route.
+                              
+                              
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port is the network port this Route targets. It can be interpreted
+                              differently based on the type of parent resource.
+                              
+                              When the parent resource is a Gateway, this targets all listeners
+                              listening on the specified port that also support this kind of Route(and
+                              select this Route). It's not recommended to set `Port` unless the
+                              networking behaviors specified in a Route must apply to a specific port
+                              as opposed to a listener(s) whose port(s) may be changed. When both Port
+                              and SectionName are specified, the name and port of the selected listener
+                              must match both specified values.
+                              
+                              
+                              When the parent resource is a Service, this targets a specific port in the
+                              Service spec. When both Port (experimental) and SectionName are specified,
+                              the name and port of the selected port must match both specified values.
+                              
+                              
+                              Implementations MAY choose to support other parent resources.
+                              Implementations supporting other types of parent resources MUST clearly
+                              document how/if Port is interpreted.
+                              
+                              For the purpose of status, an attachment is considered successful as
+                              long as the parent resource accepts it partially. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                              from the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route,
+                              the Route MUST be considered detached from the Gateway.
+                              
+                              Support: Extended
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          sectionName:
+                            description: |-
+                              SectionName is the name of a section within the target resource. In the
+                              following resources, SectionName is interpreted as the following:
+                              
+                              * Gateway: Listener name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              * Service: Port name. When both Port (experimental) and SectionName
+                              are specified, the name and port of the selected listener must match
+                              both specified values.
+                              
+                              Implementations MAY choose to support attaching Routes to other resources.
+                              If that is the case, they MUST clearly document how SectionName is
+                              interpreted.
+                              
+                              When unspecified (empty string), this will reference the entire resource.
+                              For the purpose of status, an attachment is considered successful if at
+                              least one section in the parent resource accepts it. For example, Gateway
+                              listeners can restrict which Routes can attach to them by Route kind,
+                              namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                              the referencing Route, the Route MUST be considered successfully
+                              attached. If no Gateway listeners accept attachment from this Route, the
+                              Route MUST be considered detached from the Gateway.
+                              
+                              Support: Core
+                            maxLength: 253
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                        required:
+                          - name
+                        type: object
+                      conditions:
+                        description: Conditions describes the status of the Policy with
+                          respect to the given Ancestor.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        minItems: 1
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      controllerName:
+                        description: |-
+                          ControllerName is a domain/path string that indicates the name of the
+                          controller that wrote this status. This corresponds with the
+                          controllerName field on GatewayClass.
+                          
+                          Example: "example.net/gateway-controller".
+                          
+                          The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                          valid Kubernetes names
+                          (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                          
+                          Controllers MUST populate this field when writing status. Controllers should ensure that
+                          entries to status populated with their ControllerName are cleaned up when they are no
+                          longer necessary.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                        type: string
+                    required:
+                      - ancestorRef
+                      - conditions
+                      - controllerName
+                    type: object
+                  maxItems: 16
+                  type: array
+                  x-kubernetes-list-type: atomic
+              required:
+                - ancestors
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
+---
+#
+# config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
+#
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  name: xlistenersets.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+      - gateway-api
+    kind: XListenerSet
+    listKind: XListenerSetList
+    plural: xlistenersets
+    shortNames:
+      - lset
+    singular: xlistenerset
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type=="Accepted")].status
+          name: Accepted
+          type: string
+        - jsonPath: .status.conditions[?(@.type=="Programmed")].status
+          name: Programmed
+          type: string
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            XListenerSet defines a set of additional listeners to attach to an existing Gateway.
+            This resource provides a mechanism to merge multiple listeners into a single Gateway.
+            
+            The parent Gateway must explicitly allow ListenerSet attachment through its
+            AllowedListeners configuration. By default, Gateways do not allow ListenerSet
+            attachment.
+            
+            Routes can attach to a ListenerSet by specifying it as a parentRef, and can
+            optionally target specific listeners using the sectionName field.
+            
+            Policy Attachment:
+            - Policies that attach to a ListenerSet apply to all listeners defined in that resource
+            - Policies do not impact listeners in the parent Gateway
+            - Different ListenerSets attached to the same Gateway can have different policies
+            - If an implementation cannot apply a policy to specific listeners, it should reject the policy
+            
+            ReferenceGrant Semantics:
+            - ReferenceGrants applied to a Gateway are not inherited by child ListenerSets
+            - ReferenceGrants applied to a ListenerSet do not grant permission to the parent Gateway's listeners
+            - A ListenerSet can reference secrets/backends in its own namespace without a ReferenceGrant
+            
+            Gateway Integration:
+            - The parent Gateway's status will include an "AttachedListenerSets" condition
+            - This condition will be:
+              - True: when AllowedListeners is set and at least one child ListenerSet is attached
+              - False: when AllowedListeners is set but no valid listeners are attached, or when AllowedListeners is not set or false
+              - Unknown: when no AllowedListeners config is present
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of ListenerSet.
+              properties:
+                listeners:
+                  description: |-
+                    Listeners associated with this ListenerSet. Listeners define
+                    logical endpoints that are bound on this referenced parent Gateway's addresses.
+                    
+                    Listeners in a `Gateway` and their attached `ListenerSets` are concatenated
+                    as a list when programming the underlying infrastructure. Each listener
+                    name does not need to be unique across the Gateway and ListenerSets.
+                    See ListenerEntry.Name for more details.
+                    
+                    Implementations MUST treat the parent Gateway as having the merged
+                    list of all listeners from itself and attached ListenerSets using
+                    the following precedence:
+                    
+                    1. "parent" Gateway
+                    2. ListenerSet ordered by creation time (oldest first)
+                    3. ListenerSet ordered alphabetically by "{namespace}/{name}".
+                    
+                    An implementation MAY reject listeners by setting the ListenerEntryStatus
+                    `Accepted` condition to False with the Reason `TooManyListeners`
+                    
+                    If a listener has a conflict, this will be reported in the
+                    Status.ListenerEntryStatus setting the `Conflicted` condition to True.
+                    
+                    Implementations SHOULD be cautious about what information from the
+                    parent or siblings are reported to avoid accidentally leaking
+                    sensitive information that the child would not otherwise have access
+                    to. This can include contents of secrets etc.
+                  items:
+                    properties:
+                      allowedRoutes:
+                        default:
+                          namespaces:
+                            from: Same
+                        description: |-
+                          AllowedRoutes defines the types of routes that MAY be attached to a
+                          Listener and the trusted namespaces where those Route resources MAY be
+                          present.
+                          
+                          Although a client request may match multiple route rules, only one rule
+                          may ultimately receive the request. Matching precedence MUST be
+                          determined in order of the following criteria:
+                          
+                          * The most specific match as defined by the Route type.
+                          * The oldest Route based on creation timestamp. For example, a Route with
+                            a creation timestamp of "2020-09-08 01:02:03" is given precedence over
+                            a Route with a creation timestamp of "2020-09-08 01:02:04".
+                          * If everything else is equivalent, the Route appearing first in
+                            alphabetical order (namespace/name) should be given precedence. For
+                            example, foo/bar is given precedence over foo/baz.
+                          
+                          All valid rules within a Route attached to this Listener should be
+                          implemented. Invalid Route rules can be ignored (sometimes that will mean
+                          the full Route). If a Route rule transitions from valid to invalid,
+                          support for that Route rule should be dropped to ensure consistency. For
+                          example, even if a filter specified by a Route rule is invalid, the rest
+                          of the rules within that Route should still be supported.
+                        properties:
+                          kinds:
+                            description: |-
+                              Kinds specifies the groups and kinds of Routes that are allowed to bind
+                              to this Gateway Listener. When unspecified or empty, the kinds of Routes
+                              selected are determined using the Listener protocol.
+                              
+                              A RouteGroupKind MUST correspond to kinds of Routes that are compatible
+                              with the application protocol specified in the Listener's Protocol field.
+                              If an implementation does not support or recognize this resource type, it
+                              MUST set the "ResolvedRefs" condition to False for this Listener with the
+                              "InvalidRouteKinds" reason.
+                              
+                              Support: Core
+                            items:
+                              description: RouteGroupKind indicates the group and kind
+                                of a Route resource.
+                              properties:
+                                group:
+                                  default: gateway.networking.k8s.io
+                                  description: Group is the group of the Route.
+                                  maxLength: 253
+                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                                kind:
+                                  description: Kind is the kind of the Route.
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                  type: string
+                              required:
+                                - kind
+                              type: object
+                            maxItems: 8
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          namespaces:
+                            default:
+                              from: Same
+                            description: |-
+                              Namespaces indicates namespaces from which Routes may be attached to this
+                              Listener. This is restricted to the namespace of this Gateway by default.
+                              
+                              Support: Core
+                            properties:
+                              from:
+                                default: Same
+                                description: |-
+                                  From indicates where Routes will be selected for this Gateway. Possible
+                                  values are:
+                                  
+                                  * All: Routes in all namespaces may be used by this Gateway.
+                                  * Selector: Routes in namespaces selected by the selector may be used by
+                                    this Gateway.
+                                  * Same: Only Routes in the same namespace may be used by this Gateway.
+                                  
+                                  Support: Core
+                                enum:
+                                  - All
+                                  - Selector
+                                  - Same
+                                type: string
+                              selector:
+                                description: |-
+                                  Selector must be specified when From is set to "Selector". In that case,
+                                  only Routes in Namespaces matching this Selector will be selected by this
+                                  Gateway. This field is ignored for other values of "From".
+                                  
+                                  Support: Core
+                                properties:
+                                  matchExpressions:
+                                    description: matchExpressions is a list of label
+                                      selector requirements. The requirements are ANDed.
+                                    items:
+                                      description: |-
+                                        A label selector requirement is a selector that contains values, a key, and an operator that
+                                        relates the key and values.
+                                      properties:
+                                        key:
+                                          description: key is the label key that the
+                                            selector applies to.
+                                          type: string
+                                        operator:
+                                          description: |-
+                                            operator represents a key's relationship to a set of values.
+                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                          type: string
+                                        values:
+                                          description: |-
+                                            values is an array of string values. If the operator is In or NotIn,
+                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                            the values array must be empty. This array is replaced during a strategic
+                                            merge patch.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                        - key
+                                        - operator
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  matchLabels:
+                                    additionalProperties:
+                                      type: string
+                                    description: |-
+                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                    type: object
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                        type: object
+                      hostname:
+                        description: |-
+                          Hostname specifies the virtual hostname to match for protocol types that
+                          define this concept. When unspecified, all hostnames are matched. This
+                          field is ignored for protocols that don't require hostname based
+                          matching.
+                          
+                          Implementations MUST apply Hostname matching appropriately for each of
+                          the following protocols:
+                          
+                          * TLS: The Listener Hostname MUST match the SNI.
+                          * HTTP: The Listener Hostname MUST match the Host header of the request.
+                          * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
+                            protocol layers as described above. If an implementation does not
+                            ensure that both the SNI and Host header match the Listener hostname,
+                            it MUST clearly document that.
+                          
+                          For HTTPRoute and TLSRoute resources, there is an interaction with the
+                          `spec.hostnames` array. When both listener and route specify hostnames,
+                          there MUST be an intersection between the values for a Route to be
+                          accepted. For more information, refer to the Route specific Hostnames
+                          documentation.
+                          
+                          Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
+                          as a suffix match. That means that a match for `*.example.com` would match
+                          both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      name:
+                        description: |-
+                          Name is the name of the Listener. This name MUST be unique within a
+                          ListenerSet.
+                          
+                          Name is not required to be unique across a Gateway and ListenerSets.
+                          Routes can attach to a Listener by having a ListenerSet as a parentRef
+                          and setting the SectionName
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      port:
+                        default: 0
+                        description: |-
+                          Port is the network port. Multiple listeners may use the
+                          same port, subject to the Listener compatibility rules.
+                          
+                          If the port is not set or specified as zero, the implementation will assign
+                          a unique port. If the implementation does not support dynamic port
+                          assignment, it MUST set `Accepted` condition to `False` with the
+                          `UnsupportedPort` reason.
+                        format: int32
+                        maximum: 65535
+                        minimum: 0
+                        type: integer
+                      protocol:
+                        description: Protocol specifies the network protocol this listener
+                          expects to receive.
+                        maxLength: 255
+                        minLength: 1
+                        pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
+                        type: string
+                      tls:
+                        description: |-
+                          TLS is the TLS configuration for the Listener. This field is required if
+                          the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
+                          if the Protocol field is "HTTP", "TCP", or "UDP".
+                          
+                          The association of SNIs to Certificate defined in ListenerTLSConfig is
+                          defined based on the Hostname field for this listener.
+                          
+                          The GatewayClass MUST use the longest matching SNI out of all
+                          available certificates for any TLS handshake.
+                        properties:
+                          certificateRefs:
+                            description: |-
+                              CertificateRefs contains a series of references to Kubernetes objects that
+                              contains TLS certificates and private keys. These certificates are used to
+                              establish a TLS handshake for requests that match the hostname of the
+                              associated listener.
+                              
+                              A single CertificateRef to a Kubernetes Secret has "Core" support.
+                              Implementations MAY choose to support attaching multiple certificates to
+                              a Listener, but this behavior is implementation-specific.
+                              
+                              References to a resource in different namespace are invalid UNLESS there
+                              is a ReferenceGrant in the target namespace that allows the certificate
+                              to be attached. If a ReferenceGrant does not allow this reference, the
+                              "ResolvedRefs" condition MUST be set to False for this listener with the
+                              "RefNotPermitted" reason.
+                              
+                              This field is required to have at least one element when the mode is set
+                              to "Terminate" (default) and is optional otherwise.
+                              
+                              CertificateRefs can reference to standard Kubernetes resources, i.e.
+                              Secret, or implementation-specific custom resources.
+                              
+                              Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
+                              
+                              Support: Implementation-specific (More than one reference or other resource types)
+                            items:
+                              description: |-
+                                SecretObjectReference identifies an API object including its namespace,
+                                defaulting to Secret.
+                                
+                                The API object must be valid in the cluster; the Group and Kind must
+                                be registered in the cluster for this reference to be valid.
+                                
+                                References to objects with invalid Group and Kind are not valid, and must
+                                be rejected by the implementation, with appropriate Conditions set
+                                on the containing object.
+                              properties:
+                                group:
+                                  default: ""
+                                  description: |-
+                                    Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                    When unspecified or empty string, core API group is inferred.
+                                  maxLength: 253
+                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                  type: string
+                                kind:
+                                  default: Secret
+                                  description: Kind is kind of the referent. For example
+                                    "Secret".
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                  type: string
+                                name:
+                                  description: Name is the name of the referent.
+                                  maxLength: 253
+                                  minLength: 1
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace is the namespace of the referenced object. When unspecified, the local
+                                    namespace is inferred.
+                                    
+                                    Note that when a namespace different than the local namespace is specified,
+                                    a ReferenceGrant object is required in the referent namespace to allow that
+                                    namespace's owner to accept the reference. See the ReferenceGrant
+                                    documentation for details.
+                                    
+                                    Support: Core
+                                  maxLength: 63
+                                  minLength: 1
+                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            maxItems: 64
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          mode:
+                            default: Terminate
+                            description: |-
+                              Mode defines the TLS behavior for the TLS session initiated by the client.
+                              There are two possible modes:
+                              
+                              - Terminate: The TLS session between the downstream client and the
+                                Gateway is terminated at the Gateway. This mode requires certificates
+                                to be specified in some way, such as populating the certificateRefs
+                                field.
+                              - Passthrough: The TLS session is NOT terminated by the Gateway. This
+                                implies that the Gateway can't decipher the TLS stream except for
+                                the ClientHello message of the TLS protocol. The certificateRefs field
+                                is ignored in this mode.
+                              
+                              Support: Core
+                            enum:
+                              - Terminate
+                              - Passthrough
+                            type: string
+                          options:
+                            additionalProperties:
+                              description: |-
+                                AnnotationValue is the value of an annotation in Gateway API. This is used
+                                for validation of maps such as TLS options. This roughly matches Kubernetes
+                                annotation validation, although the length validation in that case is based
+                                on the entire size of the annotations struct.
+                              maxLength: 4096
+                              minLength: 0
+                              type: string
+                            description: |-
+                              Options are a list of key/value pairs to enable extended TLS
+                              configuration for each implementation. For example, configuring the
+                              minimum TLS version or supported cipher suites.
+                              
+                              A set of common keys MAY be defined by the API in the future. To avoid
+                              any ambiguity, implementation-specific definitions MUST use
+                              domain-prefixed names, such as `example.com/my-custom-option`.
+                              Un-prefixed names are reserved for key names defined by Gateway API.
+                              
+                              Support: Implementation-specific
+                            maxProperties: 16
+                            type: object
+                        type: object
+                        x-kubernetes-validations:
+                          - message: certificateRefs or options must be specified when
+                              mode is Terminate
+                            rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
+                          > 0 || size(self.options) > 0 : true'
+                    required:
+                      - name
+                      - protocol
+                    type: object
+                  maxItems: 64
+                  minItems: 1
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                  x-kubernetes-validations:
+                    - message: tls must not be specified for protocols ['HTTP', 'TCP',
+                        'UDP']
+                      rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
+                    !has(l.tls) : true)'
+                    - message: tls mode must be Terminate for protocol HTTPS
+                      rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
+                    == '''' || l.tls.mode == ''Terminate'') : true)'
+                    - message: hostname must not be specified for protocols ['TCP', 'UDP']
+                      rule: 'self.all(l, l.protocol in [''TCP'', ''UDP'']  ? (!has(l.hostname)
+                    || l.hostname == '''') : true)'
+                    - message: Listener name must be unique within the Gateway
+                      rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
+                    - message: Combination of port, protocol and hostname must be unique
+                        for each listener
+                      rule: 'self.all(l1, !has(l1.port) || self.exists_one(l2, has(l2.port)
+                    && l1.port == l2.port && l1.protocol == l2.protocol && (has(l1.hostname)
+                    && has(l2.hostname) ? l1.hostname == l2.hostname : !has(l1.hostname)
+                    && !has(l2.hostname))))'
+                parentRef:
+                  description: ParentRef references the Gateway that the listeners are
+                    attached to.
+                  properties:
+                    group:
+                      default: gateway.networking.k8s.io
+                      description: Group is the group of the referent.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      default: Gateway
+                      description: Kind is kind of the referent. For example "Gateway".
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the referent.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace is the namespace of the referent.  If not present,
+                        the namespace of the referent is assumed to be the same as
+                        the namespace of the referring object.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                      type: string
+                  required:
+                    - name
+                  type: object
+              required:
+                - listeners
+                - parentRef
+              type: object
+            status:
+              default:
+                conditions:
+                  - lastTransitionTime: "1970-01-01T00:00:00Z"
+                    message: Waiting for controller
+                    reason: Pending
+                    status: Unknown
+                    type: Accepted
+                  - lastTransitionTime: "1970-01-01T00:00:00Z"
+                    message: Waiting for controller
+                    reason: Pending
+                    status: Unknown
+                    type: Programmed
+              description: Status defines the current state of ListenerSet.
+              properties:
+                conditions:
+                  default:
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Accepted
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Programmed
+                  description: |-
+                    Conditions describe the current conditions of the ListenerSet.
+                    
+                    Implementations MUST express ListenerSet conditions using the
+                    `ListenerSetConditionType` and `ListenerSetConditionReason`
+                    constants so that operators and tools can converge on a common
+                    vocabulary to describe ListenerSet state.
+                    
+                    Known condition types are:
+                    
+                    * "Accepted"
+                    * "Programmed"
+                  items:
+                    description: Condition contains details for one aspect of the current
+                      state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  maxItems: 8
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                listeners:
+                  description: Listeners provide status for each unique listener port
+                    defined in the Spec.
+                  items:
+                    description: ListenerStatus is the status associated with a Listener.
+                    properties:
+                      attachedRoutes:
+                        description: |-
+                          AttachedRoutes represents the total number of Routes that have been
+                          successfully attached to this Listener.
+                          
+                          Successful attachment of a Route to a Listener is based solely on the
+                          combination of the AllowedRoutes field on the corresponding Listener
+                          and the Route's ParentRefs field. A Route is successfully attached to
+                          a Listener when it is selected by the Listener's AllowedRoutes field
+                          AND the Route has a valid ParentRef selecting the whole Gateway
+                          resource or a specific Listener as a parent resource (more detail on
+                          attachment semantics can be found in the documentation on the various
+                          Route kinds ParentRefs fields). Listener or Route status does not impact
+                          successful attachment, i.e. the AttachedRoutes field count MUST be set
+                          for Listeners with condition Accepted: false and MUST count successfully
+                          attached Routes that may themselves have Accepted: false conditions.
+                          
+                          Uses for this field include troubleshooting Route attachment and
+                          measuring blast radius/impact of changes to a Listener.
+                        format: int32
+                        type: integer
+                      conditions:
+                        description: Conditions describe the current condition of this
+                          listener.
+                        items:
+                          description: Condition contains details for one aspect of
+                            the current state of this API Resource.
+                          properties:
+                            lastTransitionTime:
+                              description: |-
+                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                              format: date-time
+                              type: string
+                            message:
+                              description: |-
+                                message is a human readable message indicating details about the transition.
+                                This may be an empty string.
+                              maxLength: 32768
+                              type: string
+                            observedGeneration:
+                              description: |-
+                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                with respect to the current state of the instance.
+                              format: int64
+                              minimum: 0
+                              type: integer
+                            reason:
+                              description: |-
+                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                Producers of specific condition types may define expected values and meanings for this field,
+                                and whether the values are considered a guaranteed API.
+                                The value should be a CamelCase string.
+                                This field may not be empty.
+                              maxLength: 1024
+                              minLength: 1
+                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                              type: string
+                            status:
+                              description: status of the condition, one of True, False,
+                                Unknown.
+                              enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                              type: string
+                            type:
+                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              maxLength: 316
+                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                              type: string
+                          required:
+                            - lastTransitionTime
+                            - message
+                            - reason
+                            - status
+                            - type
+                          type: object
+                        maxItems: 8
+                        type: array
+                        x-kubernetes-list-map-keys:
+                          - type
+                        x-kubernetes-list-type: map
+                      name:
+                        description: Name is the name of the Listener that this status
+                          corresponds to.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      port:
+                        description: Port is the network port the listener is configured
+                          to listen on.
+                        format: int32
+                        maximum: 65535
+                        minimum: 1
+                        type: integer
+                      supportedKinds:
+                        description: |-
+                          SupportedKinds is the list indicating the Kinds supported by this
+                          listener. This MUST represent the kinds an implementation supports for
+                          that Listener configuration.
+                          
+                          If kinds are specified in Spec that are not supported, they MUST NOT
+                          appear in this list and an implementation MUST set the "ResolvedRefs"
+                          condition to "False" with the "InvalidRouteKinds" reason. If both valid
+                          and invalid Route kinds are specified, the implementation MUST
+                          reference the valid Route kinds that have been specified.
+                        items:
+                          description: RouteGroupKind indicates the group and kind of
+                            a Route resource.
+                          properties:
+                            group:
+                              default: gateway.networking.k8s.io
+                              description: Group is the group of the Route.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              description: Kind is the kind of the Route.
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                          required:
+                            - kind
+                          type: object
+                        maxItems: 8
+                        type: array
+                        x-kubernetes-list-type: atomic
+                    required:
+                      - attachedRoutes
+                      - conditions
+                      - name
+                      - port
+                      - supportedKinds
+                    type: object
+                  maxItems: 64
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
+---
+#
+# config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml
+#
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  name: xmeshes.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+      - gateway-api
+    kind: XMesh
+    listKind: XMeshList
+    plural: xmeshes
+    shortNames:
+      - mesh
+    singular: xmesh
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .status.conditions[?(@.type=="Accepted")].status
+          name: Accepted
+          type: string
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: XMesh defines mesh-wide characteristics of a GAMMA-compliant
+            service mesh.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec defines the desired state of XMesh.
+              properties:
+                controllerName:
+                  description: |-
+                    ControllerName is the name of a controller that is managing Gateway API
+                    resources for mesh traffic management. The value of this field MUST be a
+                    domain prefixed path.
+                    
+                    Example: "example.com/awesome-mesh".
+                    
+                    This field is not mutable and cannot be empty.
+                    
+                    Support: Core
+                  maxLength: 253
+                  minLength: 1
+                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                  type: string
+                  x-kubernetes-validations:
+                    - message: Value is immutable
+                      rule: self == oldSelf
+                description:
+                  description: Description optionally provides a human-readable description
+                    of a Mesh.
+                  maxLength: 64
+                  type: string
+                parametersRef:
+                  description: |-
+                    ParametersRef is an optional reference to a resource that contains
+                    implementation-specific configuration for this Mesh. If no
+                    implementation-specific parameters are needed, this field MUST be
+                    omitted.
+                    
+                    ParametersRef can reference a standard Kubernetes resource, i.e.
+                    ConfigMap, or an implementation-specific custom resource. The resource
+                    can be cluster-scoped or namespace-scoped.
+                    
+                    If the referent cannot be found, refers to an unsupported kind, or when
+                    the data within that resource is malformed, the Mesh MUST be rejected
+                    with the "Accepted" status condition set to "False" and an
+                    "InvalidParameters" reason.
+                    
+                    Support: Implementation-specific
+                  properties:
+                    group:
+                      description: Group is the group of the referent.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the referent.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the referent.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace is the namespace of the referent.
+                        This field is required when referring to a Namespace-scoped resource and
+                        MUST be unset when referring to a Cluster-scoped resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                      type: string
+                  required:
+                    - group
+                    - kind
+                    - name
+                  type: object
+              required:
+                - controllerName
+              type: object
+            status:
+              default:
+                conditions:
+                  - lastTransitionTime: "1970-01-01T00:00:00Z"
+                    message: Waiting for controller
+                    reason: Pending
+                    status: Unknown
+                    type: Accepted
+              description: Status defines the current state of XMesh.
+              properties:
+                conditions:
+                  default:
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Accepted
+                    - lastTransitionTime: "1970-01-01T00:00:00Z"
+                      message: Waiting for controller
+                      reason: Pending
+                      status: Unknown
+                      type: Programmed
+                  description: |-
+                    Conditions is the current status from the controller for
+                    this Mesh.
+                    
+                    Controllers should prefer to publish conditions using values
+                    of MeshConditionType for the type of each Condition.
+                  items:
+                    description: Condition contains details for one aspect of the current
+                      state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  maxItems: 8
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                supportedFeatures:
+                  description: |-
+                    SupportedFeatures is the set of features the Mesh support.
+                    It MUST be sorted in ascending alphabetical order by the Name key.
+                  items:
+                    properties:
+                      name:
+                        description: |-
+                          FeatureName is used to describe distinct features that are covered by
+                          conformance tests.
+                        type: string
+                    required:
+                      - name
+                    type: object
+                  maxItems: 64
+                  type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+              type: object
+          required:
+            - spec
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/integration/fixtures/k8s/01-traefik-crd.yml b/integration/fixtures/k8s/01-traefik-crd.yml
index ea2618637..bbf30fb63 100644
--- a/integration/fixtures/k8s/01-traefik-crd.yml
+++ b/integration/fixtures/k8s/01-traefik-crd.yml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutes.traefik.io
 spec:
   group: traefik.io
@@ -43,11 +43,31 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
                 type: array
+              parentRefs:
+                description: |-
+                  ParentRefs defines references to parent IngressRoute resources for multi-layer routing.
+                  When set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.
+                  More info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs
+                items:
+                  description: IngressRouteRef is a reference to an IngressRoute resource.
+                  properties:
+                    name:
+                      description: Name defines the name of the referenced IngressRoute
+                        resource.
+                      type: string
+                    namespace:
+                      description: Namespace defines the namespace of the referenced
+                        IngressRoute resource.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
               routes:
                 description: Routes defines the list of routes.
                 items:
@@ -64,12 +84,12 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: |-
                         Middlewares defines the list of references to Middleware resources.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/middleware/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/
                       items:
                         description: MiddlewareRef is a reference to a Middleware
                           resource.
@@ -89,7 +109,7 @@ spec:
                     observability:
                       description: |-
                         Observability defines the observability configuration for a router.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/observability/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/
                       properties:
                         accessLogs:
                           description: AccessLogs enables access logs for this router.
@@ -112,7 +132,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -227,6 +247,25 @@ spec:
                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                               By default, passHostHeader is true.
                             type: boolean
+                          passiveHealthCheck:
+                            description: PassiveHealthCheck defines passive health
+                              checks for ExternalName services.
+                            properties:
+                              failureWindow:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: FailureWindow defines the time window
+                                  during which the failed attempts must occur for
+                                  the server to be marked as unhealthy. It also defines
+                                  for how long the server will be considered unhealthy.
+                                x-kubernetes-int-or-string: true
+                              maxFailedAttempts:
+                                description: MaxFailedAttempts is the number of consecutive
+                                  failed attempts allowed within the failure window
+                                  before marking the server as unhealthy.
+                                type: integer
+                            type: object
                           port:
                             anyOf:
                             - type: integer
@@ -263,7 +302,7 @@ spec:
                           sticky:
                             description: |-
                               Sticky defines the sticky sessions configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                             properties:
                               cookie:
                                 description: Cookie defines the sticky cookie configuration.
@@ -312,11 +351,13 @@ spec:
                           strategy:
                             description: |-
                               Strategy defines the load balancing strategy between the servers.
-                              Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                              Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                               RoundRobin value is deprecated and supported for backward compatibility.
                             enum:
                             - wrr
                             - p2c
+                            - hrw
+                            - leasttime
                             - RoundRobin
                             type: string
                           weight:
@@ -332,7 +373,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       type: string
                   required:
@@ -342,18 +383,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -372,17 +413,17 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-options/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/
                     properties:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSOption.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
                         type: string
                     required:
                     - name
@@ -399,12 +440,12 @@ spec:
                       name:
                         description: |-
                           Name defines the name of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                       namespace:
                         description: |-
                           Namespace defines the namespace of the referenced TLSStore.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
                         type: string
                     required:
                     - name
@@ -424,7 +465,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressroutetcps.traefik.io
 spec:
   group: traefik.io
@@ -464,7 +505,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
@@ -477,7 +518,7 @@ spec:
                     match:
                       description: |-
                         Match defines the router's rule.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/
                       type: string
                     middlewares:
                       description: Middlewares defines the list of references to MiddlewareTCP
@@ -501,7 +542,7 @@ spec:
                     priority:
                       description: |-
                         Priority defines the router's priority.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
                       maximum: 9223372036854775000
                       type: integer
                     services:
@@ -543,7 +584,7 @@ spec:
                           proxyProtocol:
                             description: |-
                               ProxyProtocol defines the PROXY protocol configuration.
-                              More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/service/#proxy-protocol
+                              More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol
                               Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
                             properties:
                               version:
@@ -585,7 +626,7 @@ spec:
                     syntax:
                       description: |-
                         Syntax defines the router's rule syntax.
-                        More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
+                        More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
                         Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
                       enum:
                       - v3
@@ -598,18 +639,18 @@ spec:
               tls:
                 description: |-
                   TLS defines the TLS configuration on a layer 4 / TCP Route.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/router/#tls
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls
                 properties:
                   certResolver:
                     description: |-
                       CertResolver defines the name of the certificate resolver to use.
                       Cert resolvers have to be configured in the static configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
                     type: string
                   domains:
                     description: |-
                       Domains defines the list of domains that will be used to issue certificates.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#domains
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains
                     items:
                       description: Domain holds a domain name with SANs.
                       properties:
@@ -628,7 +669,7 @@ spec:
                     description: |-
                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
                       If not defined, the `default` TLSOption is used.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#tls-options
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options
                     properties:
                       name:
                         description: Name defines the name of the referenced Traefik
@@ -680,7 +721,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: ingressrouteudps.traefik.io
 spec:
   group: traefik.io
@@ -720,7 +761,7 @@ spec:
                 description: |-
                   EntryPoints defines the list of entry point names to bind to.
                   Entry points have to be configured in the static configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
                   Default: all.
                 items:
                   type: string
@@ -792,7 +833,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewares.traefik.io
 spec:
   group: traefik.io
@@ -808,7 +849,7 @@ spec:
       openAPIV3Schema:
         description: |-
           Middleware is the CRD implementation of a Traefik Middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -834,7 +875,7 @@ spec:
                 description: |-
                   AddPrefix holds the add prefix middleware configuration.
                   This middleware updates the path of a request before forwarding it.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/addprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/
                 properties:
                   prefix:
                     description: |-
@@ -849,12 +890,12 @@ spec:
                 description: |-
                   BasicAuth holds the basic auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -875,7 +916,7 @@ spec:
                 description: |-
                   Buffering holds the buffering middleware configuration.
                   This middleware retries or limits the size of requests that can be forwarded to backends.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#maxrequestbodybytes
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes
                 properties:
                   maxRequestBodyBytes:
                     description: |-
@@ -907,14 +948,14 @@ spec:
                     description: |-
                       RetryExpression defines the retry conditions.
                       It is a logical combination of functions with operators AND (&&) and OR (||).
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#retryexpression
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression
                     type: string
                 type: object
               chain:
                 description: |-
                   Chain holds the configuration of the chain middleware.
                   This middleware enables to define reusable combinations of other pieces of middleware.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/chain/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/
                 properties:
                   middlewares:
                     description: Middlewares is the list of MiddlewareRef which composes
@@ -977,7 +1018,7 @@ spec:
                 description: |-
                   Compress holds the compress middleware configuration.
                   This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/compress/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/
                 properties:
                   defaultEncoding:
                     description: DefaultEncoding specifies the default encoding if
@@ -1027,12 +1068,12 @@ spec:
                 description: |-
                   DigestAuth holds the digest auth middleware configuration.
                   This middleware restricts access to your services to known users.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/
                 properties:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield
                     type: string
                   realm:
                     description: |-
@@ -1052,7 +1093,7 @@ spec:
                 description: |-
                   ErrorPage holds the custom error middleware configuration.
                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/
                 properties:
                   query:
                     description: |-
@@ -1064,7 +1105,7 @@ spec:
                   service:
                     description: |-
                       Service defines the reference to a Kubernetes Service that will serve the error page.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/#service
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service
                     properties:
                       healthCheck:
                         description: Healthcheck defines health checks for ExternalName
@@ -1170,6 +1211,25 @@ spec:
                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                           By default, passHostHeader is true.
                         type: boolean
+                      passiveHealthCheck:
+                        description: PassiveHealthCheck defines passive health checks
+                          for ExternalName services.
+                        properties:
+                          failureWindow:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            description: FailureWindow defines the time window during
+                              which the failed attempts must occur for the server
+                              to be marked as unhealthy. It also defines for how long
+                              the server will be considered unhealthy.
+                            x-kubernetes-int-or-string: true
+                          maxFailedAttempts:
+                            description: MaxFailedAttempts is the number of consecutive
+                              failed attempts allowed within the failure window before
+                              marking the server as unhealthy.
+                            type: integer
+                        type: object
                       port:
                         anyOf:
                         - type: integer
@@ -1206,7 +1266,7 @@ spec:
                       sticky:
                         description: |-
                           Sticky defines the sticky sessions configuration.
-                          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                         properties:
                           cookie:
                             description: Cookie defines the sticky cookie configuration.
@@ -1254,11 +1314,13 @@ spec:
                       strategy:
                         description: |-
                           Strategy defines the load balancing strategy between the servers.
-                          Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                          Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                           RoundRobin value is deprecated and supported for backward compatibility.
                         enum:
                         - wrr
                         - p2c
+                        - hrw
+                        - leasttime
                         - RoundRobin
                         type: string
                       weight:
@@ -1293,7 +1355,7 @@ spec:
                 description: |-
                   ForwardAuth holds the forward auth middleware configuration.
                   This middleware delegates the request authentication to a Service.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/
                 properties:
                   addAuthCookiesToResponse:
                     description: AddAuthCookiesToResponse defines the list of cookies
@@ -1321,7 +1383,7 @@ spec:
                   authResponseHeadersRegex:
                     description: |-
                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
                     type: string
                   forwardBody:
                     description: ForwardBody defines whether to send the request body
@@ -1330,7 +1392,7 @@ spec:
                   headerField:
                     description: |-
                       HeaderField defines a header field to store the authenticated user.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
                     type: string
                   maxBodySize:
                     description: MaxBodySize defines the maximum body size in bytes
@@ -1392,7 +1454,7 @@ spec:
                 description: |-
                   Headers holds the headers middleware configuration.
                   This middleware manages the requests and responses headers.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/headers/#customrequestheaders
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders
                 properties:
                   accessControlAllowCredentials:
                     description: AccessControlAllowCredentials defines whether the
@@ -1564,7 +1626,7 @@ spec:
                 description: |-
                   InFlightReq holds the in-flight request middleware configuration.
                   This middleware limits the number of requests being processed and served concurrently.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/
                 properties:
                   amount:
                     description: |-
@@ -1578,12 +1640,12 @@ spec:
                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
                       If several strategies are defined at the same time, an error will be raised.
                       If none are set, the default is to use the requestHost.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/#sourcecriterion
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion
                     properties:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -1619,12 +1681,12 @@ spec:
                 description: |-
                   IPAllowList holds the IP allowlist middleware configuration.
                   This middleware limits allowed requests based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/
                 properties:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -1662,7 +1724,7 @@ spec:
                   ipStrategy:
                     description: |-
                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                      More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                      More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                     properties:
                       depth:
                         description: Depth tells Traefik to use the X-Forwarded-For
@@ -1693,7 +1755,7 @@ spec:
                 description: |-
                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
                   This middleware adds the selected data from the passed client TLS certificate to a header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/passtlsclientcert/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/
                 properties:
                   info:
                     description: Info selects the specific client certificate details
@@ -1796,13 +1858,13 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 description: |-
                   Plugin defines the middleware plugin configuration.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/#community-middlewares
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares
                 type: object
               rateLimit:
                 description: |-
                   RateLimit holds the rate limit configuration.
                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/ratelimit/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/
                 properties:
                   average:
                     description: |-
@@ -1921,7 +1983,7 @@ spec:
                       ipStrategy:
                         description: |-
                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-                          More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+                          More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
                         properties:
                           depth:
                             description: Depth tells Traefik to use the X-Forwarded-For
@@ -1957,7 +2019,7 @@ spec:
                 description: |-
                   RedirectRegex holds the redirect regex middleware configuration.
                   This middleware redirects a request using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectregex/#regex
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex
                 properties:
                   permanent:
                     description: Permanent defines whether the redirection is permanent
@@ -1976,11 +2038,12 @@ spec:
                 description: |-
                   RedirectScheme holds the redirect scheme middleware configuration.
                   This middleware redirects requests from a scheme/port to another.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectscheme/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/
                 properties:
                   permanent:
-                    description: Permanent defines whether the redirection is permanent
-                      (308).
+                    description: |-
+                      Permanent defines whether the redirection is permanent.
+                      For HTTP GET requests a 301 is returned, otherwise a 308 is returned.
                     type: boolean
                   port:
                     description: Port defines the port of the new URL.
@@ -1993,7 +2056,7 @@ spec:
                 description: |-
                   ReplacePath holds the replace path middleware configuration.
                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepath/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/
                 properties:
                   path:
                     description: Path defines the path to use as replacement in the
@@ -2004,7 +2067,7 @@ spec:
                 description: |-
                   ReplacePathRegex holds the replace path regex middleware configuration.
                   This middleware replaces the path of a URL using regex matching and replacement.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepathregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression used to match
@@ -2020,7 +2083,7 @@ spec:
                   Retry holds the retry middleware configuration.
                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/retry/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/
                 properties:
                   attempts:
                     description: Attempts defines how many times the request should
@@ -2044,7 +2107,7 @@ spec:
                 description: |-
                   StripPrefix holds the strip prefix middleware configuration.
                   This middleware removes the specified prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefix/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/
                 properties:
                   forceSlash:
                     description: |-
@@ -2063,7 +2126,7 @@ spec:
                 description: |-
                   StripPrefixRegex holds the strip prefix regex middleware configuration.
                   This middleware removes the matching prefixes from the URL path.
-                  More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefixregex/
+                  More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/
                 properties:
                   regex:
                     description: Regex defines the regular expression to match the
@@ -2084,7 +2147,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: middlewaretcps.traefik.io
 spec:
   group: traefik.io
@@ -2100,7 +2163,7 @@ spec:
       openAPIV3Schema:
         description: |-
           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/overview/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/
         properties:
           apiVersion:
             description: |-
@@ -2137,7 +2200,7 @@ spec:
                 description: |-
                   IPAllowList defines the IPAllowList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipallowlist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
@@ -2151,7 +2214,7 @@ spec:
                   IPWhiteList defines the IPWhiteList middleware configuration.
                   This middleware accepts/refuses connections based on the client IP.
                   Deprecated: please use IPAllowList instead.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipwhitelist/
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/
                 properties:
                   sourceRange:
                     description: SourceRange defines the allowed IPs (or ranges of
@@ -2172,7 +2235,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransports.traefik.io
 spec:
   group: traefik.io
@@ -2190,7 +2253,7 @@ spec:
           ServersTransport is the CRD implementation of a ServersTransport.
           If no serversTransport is specified, the default@internal will be used.
           The default@internal serversTransport is created from the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/
         properties:
           apiVersion:
             description: |-
@@ -2341,7 +2404,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: serverstransporttcps.traefik.io
 spec:
   group: traefik.io
@@ -2359,7 +2422,7 @@ spec:
           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
           If no tcpServersTransport is specified, a default one named default@internal will be used.
           The default@internal tcpServersTransport can be configured in the static configuration.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/serverstransport/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/
         properties:
           apiVersion:
             description: |-
@@ -2497,7 +2560,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsoptions.traefik.io
 spec:
   group: traefik.io
@@ -2513,7 +2576,7 @@ spec:
       openAPIV3Schema:
         description: |-
           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
         properties:
           apiVersion:
             description: |-
@@ -2538,14 +2601,14 @@ spec:
               alpnProtocols:
                 description: |-
                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
                 items:
                   type: string
                 type: array
               cipherSuites:
                 description: |-
                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
                 items:
                   type: string
                 type: array
@@ -2573,7 +2636,7 @@ spec:
               curvePreferences:
                 description: |-
                   CurvePreferences defines the preferred elliptic curves.
-                  More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
+                  More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
                 items:
                   type: string
                 type: array
@@ -2615,7 +2678,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: tlsstores.traefik.io
 spec:
   group: traefik.io
@@ -2633,7 +2696,7 @@ spec:
           TLSStore is the CRD implementation of a Traefik TLS Store.
           For the time being, only the TLSStore named default is supported.
           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
         properties:
           apiVersion:
             description: |-
@@ -2712,7 +2775,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: traefikservices.traefik.io
 spec:
   group: traefik.io
@@ -2731,7 +2794,7 @@ spec:
           TraefikService object allows to:
           - Apply weight to Services on load-balancing
           - Mirror traffic on services
-          More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/
+          More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/
         properties:
           apiVersion:
             description: |-
@@ -2753,6 +2816,244 @@ spec:
           spec:
             description: TraefikServiceSpec defines the desired state of a TraefikService.
             properties:
+              highestRandomWeight:
+                description: HighestRandomWeight defines the highest random weight
+                  service configuration.
+                properties:
+                  services:
+                    description: Services defines the list of Kubernetes Service and/or
+                      TraefikService to load-balance, with weight.
+                    items:
+                      description: Service defines an upstream HTTP service to proxy
+                        traffic to.
+                      properties:
+                        healthCheck:
+                          description: Healthcheck defines health checks for ExternalName
+                            services.
+                          properties:
+                            followRedirects:
+                              description: |-
+                                FollowRedirects defines whether redirects should be followed during the health check calls.
+                                Default: true
+                              type: boolean
+                            headers:
+                              additionalProperties:
+                                type: string
+                              description: Headers defines custom headers to be sent
+                                to the health check endpoint.
+                              type: object
+                            hostname:
+                              description: Hostname defines the value of hostname
+                                in the Host header of the health check request.
+                              type: string
+                            interval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Interval defines the frequency of the health check calls for healthy targets.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                            method:
+                              description: Method defines the healthcheck method.
+                              type: string
+                            mode:
+                              description: |-
+                                Mode defines the health check mode.
+                                If defined to grpc, will use the gRPC health check protocol to probe the server.
+                                Default: http
+                              type: string
+                            path:
+                              description: Path defines the server URL path for the
+                                health check endpoint.
+                              type: string
+                            port:
+                              description: Port defines the server URL port for the
+                                health check endpoint.
+                              type: integer
+                            scheme:
+                              description: Scheme replaces the server URL scheme for
+                                the health check endpoint.
+                              type: string
+                            status:
+                              description: Status defines the expected HTTP status
+                                code of the response to the health check request.
+                              type: integer
+                            timeout:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
+                                Default: 5s
+                              x-kubernetes-int-or-string: true
+                            unhealthyInterval:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: |-
+                                UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+                                When UnhealthyInterval is not defined, it defaults to the Interval value.
+                                Default: 30s
+                              x-kubernetes-int-or-string: true
+                          type: object
+                        kind:
+                          description: Kind defines the kind of the Service.
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: |-
+                            Name defines the name of the referenced Kubernetes Service or TraefikService.
+                            The differentiation between the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          description: Namespace defines the namespace of the referenced
+                            Kubernetes Service or TraefikService.
+                          type: string
+                        nativeLB:
+                          description: |-
+                            NativeLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
+                            The Kubernetes Service itself does load-balance to the pods.
+                            By default, NativeLB is false.
+                          type: boolean
+                        nodePortLB:
+                          description: |-
+                            NodePortLB controls, when creating the load-balancer,
+                            whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
+                            It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
+                            By default, NodePortLB is false.
+                          type: boolean
+                        passHostHeader:
+                          description: |-
+                            PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
+                            By default, passHostHeader is true.
+                          type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          description: |-
+                            Port defines the port of a Kubernetes Service.
+                            This can be a reference to a named port.
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding defines how Traefik forwards
+                            the response from the upstream Kubernetes Service to the
+                            client.
+                          properties:
+                            flushInterval:
+                              description: |-
+                                FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
+                                A negative value means to flush immediately after each write to the client.
+                                This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
+                                for such responses, writes are flushed to the client immediately.
+                                Default: 100ms
+                              type: string
+                          type: object
+                        scheme:
+                          description: |-
+                            Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
+                            It defaults to https when Kubernetes Service port is 443, http otherwise.
+                          type: string
+                        serversTransport:
+                          description: |-
+                            ServersTransport defines the name of ServersTransport resource to use.
+                            It allows to configure the transport between Traefik and your servers.
+                            Can only be used on a Kubernetes Service.
+                          type: string
+                        sticky:
+                          description: |-
+                            Sticky defines the sticky sessions configuration.
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                          properties:
+                            cookie:
+                              description: Cookie defines the sticky cookie configuration.
+                              properties:
+                                domain:
+                                  description: |-
+                                    Domain defines the host to which the cookie will be sent.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
+                                  type: string
+                                httpOnly:
+                                  description: HTTPOnly defines whether the cookie
+                                    can be accessed by client-side APIs, such as JavaScript.
+                                  type: boolean
+                                maxAge:
+                                  description: |-
+                                    MaxAge defines the number of seconds until the cookie expires.
+                                    When set to a negative number, the cookie expires immediately.
+                                    When set to zero, the cookie never expires.
+                                  type: integer
+                                name:
+                                  description: Name defines the Cookie name.
+                                  type: string
+                                path:
+                                  description: |-
+                                    Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
+                                    When not provided the cookie will be sent on every request to the domain.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
+                                  type: string
+                                sameSite:
+                                  description: |-
+                                    SameSite defines the same site policy.
+                                    More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+                                  enum:
+                                  - none
+                                  - lax
+                                  - strict
+                                  type: string
+                                secure:
+                                  description: Secure defines whether the cookie can
+                                    only be transmitted over an encrypted connection
+                                    (i.e. HTTPS).
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          description: |-
+                            Strategy defines the load balancing strategy between the servers.
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
+                            RoundRobin value is deprecated and supported for backward compatibility.
+                          enum:
+                          - wrr
+                          - p2c
+                          - hrw
+                          - leasttime
+                          - RoundRobin
+                          type: string
+                        weight:
+                          description: |-
+                            Weight defines the weight and should only be specified when Name references a TraefikService object
+                            (and to be precise, one that embeds a Weighted Round Robin).
+                          minimum: 0
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
               mirroring:
                 description: Mirroring defines the Mirroring service configuration.
                 properties:
@@ -2954,6 +3255,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         percent:
                           description: |-
                             Percent defines the part of the traffic to mirror.
@@ -2995,7 +3315,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -3043,11 +3363,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -3088,6 +3410,25 @@ spec:
                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                       By default, passHostHeader is true.
                     type: boolean
+                  passiveHealthCheck:
+                    description: PassiveHealthCheck defines passive health checks
+                      for ExternalName services.
+                    properties:
+                      failureWindow:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: FailureWindow defines the time window during
+                          which the failed attempts must occur for the server to be
+                          marked as unhealthy. It also defines for how long the server
+                          will be considered unhealthy.
+                        x-kubernetes-int-or-string: true
+                      maxFailedAttempts:
+                        description: MaxFailedAttempts is the number of consecutive
+                          failed attempts allowed within the failure window before
+                          marking the server as unhealthy.
+                        type: integer
+                    type: object
                   port:
                     anyOf:
                     - type: integer
@@ -3123,7 +3464,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines the sticky sessions configuration.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
@@ -3170,11 +3511,13 @@ spec:
                   strategy:
                     description: |-
                       Strategy defines the load balancing strategy between the servers.
-                      Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                      Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                       RoundRobin value is deprecated and supported for backward compatibility.
                     enum:
                     - wrr
                     - p2c
+                    - hrw
+                    - leasttime
                     - RoundRobin
                     type: string
                   weight:
@@ -3300,6 +3643,25 @@ spec:
                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
                             By default, passHostHeader is true.
                           type: boolean
+                        passiveHealthCheck:
+                          description: PassiveHealthCheck defines passive health checks
+                            for ExternalName services.
+                          properties:
+                            failureWindow:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              description: FailureWindow defines the time window during
+                                which the failed attempts must occur for the server
+                                to be marked as unhealthy. It also defines for how
+                                long the server will be considered unhealthy.
+                              x-kubernetes-int-or-string: true
+                            maxFailedAttempts:
+                              description: MaxFailedAttempts is the number of consecutive
+                                failed attempts allowed within the failure window
+                                before marking the server as unhealthy.
+                              type: integer
+                          type: object
                         port:
                           anyOf:
                           - type: integer
@@ -3336,7 +3698,7 @@ spec:
                         sticky:
                           description: |-
                             Sticky defines the sticky sessions configuration.
-                            More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+                            More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
                           properties:
                             cookie:
                               description: Cookie defines the sticky cookie configuration.
@@ -3384,11 +3746,13 @@ spec:
                         strategy:
                           description: |-
                             Strategy defines the load balancing strategy between the servers.
-                            Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+                            Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
                             RoundRobin value is deprecated and supported for backward compatibility.
                           enum:
                           - wrr
                           - p2c
+                          - hrw
+                          - leasttime
                           - RoundRobin
                           type: string
                         weight:
@@ -3404,7 +3768,7 @@ spec:
                   sticky:
                     description: |-
                       Sticky defines whether sticky sessions are enabled.
-                      More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
+                      More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
                     properties:
                       cookie:
                         description: Cookie defines the sticky cookie configuration.
diff --git a/integration/fixtures/k8s/06-ingressroute-traefikservices.yml b/integration/fixtures/k8s/06-ingressroute-traefikservices.yml
index d979bc425..b1ce5660b 100644
--- a/integration/fixtures/k8s/06-ingressroute-traefikservices.yml
+++ b/integration/fixtures/k8s/06-ingressroute-traefikservices.yml
@@ -28,6 +28,23 @@ spec:
       - name: whoami
         port: 80
 
+---
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: hrw1
+  namespace: default
+
+spec:
+  highestRandomWeight:
+    services:
+      - name: whoami
+        port: 80
+        weight: 10
+      - name: whoami
+        port: 80
+        weight: 20
+
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -47,6 +64,22 @@ spec:
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
+metadata:
+  name: test4.route
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`foo.com`) && PathPrefix(`/hrw1`)
+      kind: Rule
+      services:
+        - name: hrw1
+          kind: TraefikService
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
   name: api.route
   namespace: default
diff --git a/integration/fixtures/k8s_gateway_conformance.toml b/integration/fixtures/k8s_gateway_conformance.toml
deleted file mode 100644
index 5114f2dfb..000000000
--- a/integration/fixtures/k8s_gateway_conformance.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-[global]
-  checkNewVersion = false
-  sendAnonymousUsage = false
-
-[log]
-  level = "DEBUG"
-  noColor = true
-
-[api]
-  insecure = true
-
-[experimental]
-  kubernetesGateway = true
-
-[entryPoints]
-  [entryPoints.web]
-    address = ":80"
-  [entryPoints.websecure]
-    address = ":443"
-
-[providers.kubernetesGateway]
diff --git a/integration/fixtures/knative/00-knative-crd-v1.19.0.yml b/integration/fixtures/knative/00-knative-crd-v1.19.0.yml
new file mode 100644
index 000000000..82a700136
--- /dev/null
+++ b/integration/fixtures/knative/00-knative-crd-v1.19.0.yml
@@ -0,0 +1,6692 @@
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Certificate is responsible for provisioning a SSL certificate for the
+            given hosts. It is a Knative abstraction for various SSL certificate
+            provisioning solutions (such as cert-manager or self-signed SSL certificate).
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the Certificate.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - dnsNames
+                - secretName
+              properties:
+                dnsNames:
+                  description: |-
+                    DNSNames is a list of DNS names the Certificate could support.
+                    The wildcard format of DNSNames (e.g. *.default.example.com) is supported.
+                  type: array
+                  items:
+                    type: string
+                domain:
+                  description: Domain is the top level domain of the values for DNSNames.
+                  type: string
+                secretName:
+                  description: SecretName is the name of the secret resource to store the SSL certificate in.
+                  type: string
+            status:
+              description: |-
+                Status is the current state of the Certificate.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                http01Challenges:
+                  description: |-
+                    HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled
+                    in order to get the TLS certificate..
+                  type: array
+                  items:
+                    description: |-
+                      HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs
+                      to fulfill.
+                    type: object
+                    properties:
+                      serviceName:
+                        description: ServiceName is the name of the service to serve HTTP01 challenge requests.
+                        type: string
+                      serviceNamespace:
+                        description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests.
+                        type: string
+                      servicePort:
+                        description: ServicePort is the port of the service to serve HTTP01 challenge requests.
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        x-kubernetes-int-or-string: true
+                      url:
+                        description: URL is the URL that the HTTP01 challenge is expected to serve on.
+                        type: string
+                notAfter:
+                  description: |-
+                    The expiration time of the TLS certificate stored in the secret named
+                    by this resource in spec.secretName.
+                  type: string
+                  format: date-time
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+  names:
+    kind: Certificate
+    plural: certificates
+    singular: certificate
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - kcert
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: configurations.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/podspecable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Configuration
+    plural: configurations
+    singular: configuration
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - config
+      - cfg
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: LatestCreated
+          type: string
+          jsonPath: .status.latestCreatedRevisionName
+        - name: LatestReady
+          type: string
+          jsonPath: .status.latestReadyRevisionName
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Configuration represents the "floating HEAD" of a linear history of Revisions.
+            Users create new Revisions by updating the Configuration's spec.
+            The "latest created" revision's name is available under status, as is the
+            "latest ready" revision's name.
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ConfigurationSpec holds the desired state of the Configuration (from the client).
+              type: object
+              properties:
+                template:
+                  description: Template holds the latest specification for the Revision to be stamped out.
+                  type: object
+                  properties:
+                    metadata:
+                      type: object
+                      properties:
+                        annotations:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        finalizers:
+                          type: array
+                          items:
+                            type: string
+                        labels:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      description: RevisionSpec holds the desired state of the Revision (from the client).
+                      type: object
+                      required:
+                        - containers
+                      properties:
+                        affinity:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        automountServiceAccountToken:
+                          description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                          type: boolean
+                        containerConcurrency:
+                          description: |-
+                            ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                            requests per container of the Revision.  Defaults to `0` which means
+                            concurrency to the application is not limited, and the system decides the
+                            target concurrency for the autoscaler.
+                          type: integer
+                          format: int64
+                        containers:
+                          description: |-
+                            List of containers belonging to the pod.
+                            Containers cannot currently be added or removed.
+                            There must be at least one container in a Pod.
+                            Cannot be updated.
+                          type: array
+                          items:
+                            description: A single application container that you want to run within a pod.
+                            type: object
+                            properties:
+                              args:
+                                description: |-
+                                  Arguments to the entrypoint.
+                                  The container image's CMD is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              command:
+                                description: |-
+                                  Entrypoint array. Not executed within a shell.
+                                  The container image's ENTRYPOINT is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              env:
+                                description: |-
+                                  List of environment variables to set in the container.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvVar represents an environment variable present in a Container.
+                                  type: object
+                                  required:
+                                    - name
+                                  properties:
+                                    name:
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    value:
+                                      description: |-
+                                        Variable references $(VAR_NAME) are expanded
+                                        using the previously defined environment variables in the container and
+                                        any service environment variables. If a variable cannot be resolved,
+                                        the reference in the input string will be unchanged. Double $$ are reduced
+                                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                        Escaped references will never be expanded, regardless of whether the variable
+                                        exists or not.
+                                        Defaults to "".
+                                      type: string
+                                    valueFrom:
+                                      description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                      type: object
+                                      properties:
+                                        configMapKeyRef:
+                                          description: Selects a key of a ConfigMap.
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key to select.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the ConfigMap or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        fieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        resourceFieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        secretKeyRef:
+                                          description: Selects a key of a secret in the pod's namespace
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key of the secret to select from.  Must be a valid secret key.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              envFrom:
+                                description: |-
+                                  List of sources to populate environment variables in the container.
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  sources, the value associated with the last source will take precedence.
+                                  Values defined by an Env with a duplicate key will take precedence.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  type: object
+                                  properties:
+                                    configMapRef:
+                                      description: The ConfigMap to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the ConfigMap must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                    prefix:
+                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    secretRef:
+                                      description: The Secret to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the Secret must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                x-kubernetes-list-type: atomic
+                              image:
+                                description: |-
+                                  Container image name.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images
+                                  This field is optional to allow higher level config management to default or override
+                                  container images in workload controllers like Deployments and StatefulSets.
+                                type: string
+                              imagePullPolicy:
+                                description: |-
+                                  Image pull policy.
+                                  One of Always, Never, IfNotPresent.
+                                  Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                                type: string
+                              livenessProbe:
+                                description: |-
+                                  Periodic probe of container liveness.
+                                  Container will be restarted if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              name:
+                                description: |-
+                                  Name of the container specified as a DNS_LABEL.
+                                  Each container in a pod must have a unique name (DNS_LABEL).
+                                  Cannot be updated.
+                                type: string
+                              ports:
+                                description: |-
+                                  List of ports to expose from the container. Not specifying a port here
+                                  DOES NOT prevent that port from being exposed. Any port which is
+                                  listening on the default "0.0.0.0" address inside a container will be
+                                  accessible from the network.
+                                  Modifying this array with strategic merge patch may corrupt the data.
+                                  For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: ContainerPort represents a network port in a single container.
+                                  type: object
+                                  properties:
+                                    containerPort:
+                                      description: |-
+                                        Number of port to expose on the pod's IP address.
+                                        This must be a valid port number, 0 < x < 65536.
+                                      type: integer
+                                      format: int32
+                                    name:
+                                      description: |-
+                                        If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                        named port in a pod must have a unique name. Name for the port that can be
+                                        referred to by services.
+                                      type: string
+                                    protocol:
+                                      description: |-
+                                        Protocol for port. Must be UDP, TCP, or SCTP.
+                                        Defaults to "TCP".
+                                      type: string
+                                      default: TCP
+                              readinessProbe:
+                                description: |-
+                                  Periodic probe of container service readiness.
+                                  Container will be removed from service endpoints if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              resources:
+                                description: |-
+                                  Compute Resources required by this container.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                                properties:
+                                  limits:
+                                    description: |-
+                                      Limits describes the maximum amount of compute resources allowed.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                                  requests:
+                                    description: |-
+                                      Requests describes the minimum amount of compute resources required.
+                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                              securityContext:
+                                description: |-
+                                  SecurityContext defines the security options the container should be run with.
+                                  If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                  More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                                type: object
+                                properties:
+                                  allowPrivilegeEscalation:
+                                    description: |-
+                                      AllowPrivilegeEscalation controls whether a process can gain more
+                                      privileges than its parent process. This bool directly controls if
+                                      the no_new_privs flag will be set on the container process.
+                                      AllowPrivilegeEscalation is true always when the container is:
+                                      1) run as Privileged
+                                      2) has CAP_SYS_ADMIN
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  capabilities:
+                                    description: |-
+                                      The capabilities to add/drop when running containers.
+                                      Defaults to the default set of capabilities granted by the container runtime.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    properties:
+                                      add:
+                                        description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      drop:
+                                        description: Removed capabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  privileged:
+                                    description: |-
+                                      Run container in privileged mode. This can only be set to explicitly to 'false'
+                                    type: boolean
+                                  readOnlyRootFilesystem:
+                                    description: |-
+                                      Whether this container has a read-only root filesystem.
+                                      Default is false.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  runAsGroup:
+                                    description: |-
+                                      The GID to run the entrypoint of the container process.
+                                      Uses runtime default if unset.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  runAsNonRoot:
+                                    description: |-
+                                      Indicates that the container must run as a non-root user.
+                                      If true, the Kubelet will validate the image at runtime to ensure that it
+                                      does not run as UID 0 (root) and fail to start the container if it does.
+                                      If unset or false, no such validation will be performed.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    type: boolean
+                                  runAsUser:
+                                    description: |-
+                                      The UID to run the entrypoint of the container process.
+                                      Defaults to user specified in image metadata if unspecified.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  seccompProfile:
+                                    description: |-
+                                      The seccomp options to use by this container. If seccomp options are
+                                      provided at both the pod & container level, the container options
+                                      override the pod options.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    required:
+                                      - type
+                                    properties:
+                                      localhostProfile:
+                                        description: |-
+                                          localhostProfile indicates a profile defined in a file on the node should be used.
+                                          The profile must be preconfigured on the node to work.
+                                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                                        type: string
+                                      type:
+                                        description: |-
+                                          type indicates which kind of seccomp profile will be applied.
+                                          Valid options are:
+
+                                          Localhost - a profile defined in a file on the node should be used.
+                                          RuntimeDefault - the container runtime default profile should be used.
+                                          Unconfined - no profile should be applied.
+                                        type: string
+                              startupProbe:
+                                description: |-
+                                  StartupProbe indicates that the Pod has successfully initialized.
+                                  If specified, no other probes are executed until this completes successfully.
+                                  If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                  This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                  when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                  This cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              terminationMessagePath:
+                                description: |-
+                                  Optional: Path at which the file to which the container's termination message
+                                  will be written is mounted into the container's filesystem.
+                                  Message written is intended to be brief final status, such as an assertion failure message.
+                                  Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                  all containers will be limited to 12kb.
+                                  Defaults to /dev/termination-log.
+                                  Cannot be updated.
+                                type: string
+                              terminationMessagePolicy:
+                                description: |-
+                                  Indicate how the termination message should be populated. File will use the contents of
+                                  terminationMessagePath to populate the container status message on both success and failure.
+                                  FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                  message file is empty and the container exited with an error.
+                                  The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                  Defaults to File.
+                                  Cannot be updated.
+                                type: string
+                              volumeMounts:
+                                description: |-
+                                  Pod volumes to mount into the container's filesystem.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: VolumeMount describes a mounting of a Volume within a container.
+                                  type: object
+                                  required:
+                                    - mountPath
+                                    - name
+                                  properties:
+                                    mountPath:
+                                      description: |-
+                                        Path within the container at which the volume should be mounted.  Must
+                                        not contain ':'.
+                                      type: string
+                                    mountPropagation:
+                                      description: |-
+                                        This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                                      type: string
+                                    name:
+                                      description: This must match the Name of a Volume.
+                                      type: string
+                                    readOnly:
+                                      description: |-
+                                        Mounted read-only if true, read-write otherwise (false or unspecified).
+                                        Defaults to false.
+                                      type: boolean
+                                    subPath:
+                                      description: |-
+                                        Path within the volume from which the container's volume should be mounted.
+                                        Defaults to "" (volume's root).
+                                      type: string
+                                x-kubernetes-list-map-keys:
+                                  - mountPath
+                                x-kubernetes-list-type: map
+                              workingDir:
+                                description: |-
+                                  Container's working directory.
+                                  If not specified, the container runtime's default will be used, which
+                                  might be configured in the container image.
+                                  Cannot be updated.
+                                type: string
+                        dnsConfig:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        dnsPolicy:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                          type: string
+                        enableServiceLinks:
+                          description: |-
+                            EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                          type: boolean
+                        hostAliases:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        hostIPC:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                          type: boolean
+                        hostNetwork:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                          type: boolean
+                        hostPID:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                          type: boolean
+                        idleTimeoutSeconds:
+                          description: |-
+                            IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                            to stay open while not receiving any bytes from the user's application. If
+                            unspecified, a system default will be provided.
+                          type: integer
+                          format: int64
+                        imagePullSecrets:
+                          description: |-
+                            ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                            If specified, these secrets will be passed to individual puller implementations for them to use.
+                            More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                          type: array
+                          items:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            type: object
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                                default: ""
+                            x-kubernetes-map-type: atomic
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                        initContainers:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        nodeSelector:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                          type: object
+                          additionalProperties:
+                            type: string
+                          x-kubernetes-map-type: atomic
+                        priorityClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                          type: string
+                        responseStartTimeoutSeconds:
+                          description: |-
+                            ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                            routing layer will wait for a request delivered to a container to begin
+                            sending any network traffic.
+                          type: integer
+                          format: int64
+                        runtimeClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                          type: string
+                        schedulerName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                          type: string
+                        securityContext:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        serviceAccountName:
+                          description: |-
+                            ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                            More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                          type: string
+                        shareProcessNamespace:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                          type: boolean
+                        timeoutSeconds:
+                          description: |-
+                            TimeoutSeconds is the maximum duration in seconds that the request instance
+                            is allowed to respond to a request. If unspecified, a system default will
+                            be provided.
+                          type: integer
+                          format: int64
+                        tolerations:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        topologySpreadConstraints:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        volumes:
+                          description: |-
+                            List of volumes that can be mounted by containers belonging to the pod.
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes
+                          type: array
+                          items:
+                            description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                            type: object
+                            required:
+                              - name
+                            properties:
+                              configMap:
+                                description: configMap represents a configMap that should populate this volume
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items if unspecified, each key-value pair in the Data field of the referenced
+                                      ConfigMap will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the ConfigMap,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  name:
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                    default: ""
+                                  optional:
+                                    description: optional specify whether the ConfigMap or its keys must be defined
+                                    type: boolean
+                                x-kubernetes-map-type: atomic
+                              csi:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              emptyDir:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              image:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              name:
+                                description: |-
+                                  name of the volume.
+                                  Must be a DNS_LABEL and unique within the pod.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                              persistentVolumeClaim:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              projected:
+                                description: projected items for all in one resources secrets, configmaps, and downward API
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode are the mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  sources:
+                                    description: |-
+                                      sources is the list of volume projections. Each entry in this list
+                                      handles one source.
+                                    type: array
+                                    items:
+                                      description: |-
+                                        Projection that may be projected along with other supported volume types.
+                                        Exactly one of these fields must be set.
+                                      type: object
+                                      properties:
+                                        configMap:
+                                          description: configMap information about the configMap data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                ConfigMap will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the ConfigMap,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional specify whether the ConfigMap or its keys must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        downwardAPI:
+                                          description: downwardAPI information about the downwardAPI data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: Items is a list of DownwardAPIVolume file
+                                              type: array
+                                              items:
+                                                description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                                type: object
+                                                required:
+                                                  - path
+                                                properties:
+                                                  fieldRef:
+                                                    description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                                    type: object
+                                                    required:
+                                                      - fieldPath
+                                                    properties:
+                                                      apiVersion:
+                                                        description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                        type: string
+                                                      fieldPath:
+                                                        description: Path of the field to select in the specified API version.
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                                  mode:
+                                                    description: |-
+                                                      Optional: mode bits used to set permissions on this file, must be an octal value
+                                                      between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                                    type: string
+                                                  resourceFieldRef:
+                                                    description: |-
+                                                      Selects a resource of the container: only resources limits and requests
+                                                      (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                    type: object
+                                                    required:
+                                                      - resource
+                                                    properties:
+                                                      containerName:
+                                                        description: 'Container name: required for volumes, optional for env vars'
+                                                        type: string
+                                                      divisor:
+                                                        description: Specifies the output format of the exposed resources, defaults to "1"
+                                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                        anyOf:
+                                                          - type: integer
+                                                          - type: string
+                                                        x-kubernetes-int-or-string: true
+                                                      resource:
+                                                        description: 'Required: resource to select'
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                              x-kubernetes-list-type: atomic
+                                        secret:
+                                          description: secret information about the secret data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                Secret will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the Secret,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional field specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        serviceAccountToken:
+                                          description: serviceAccountToken is information about the serviceAccountToken data to project
+                                          type: object
+                                          required:
+                                            - path
+                                          properties:
+                                            audience:
+                                              description: |-
+                                                audience is the intended audience of the token. A recipient of a token
+                                                must identify itself with an identifier specified in the audience of the
+                                                token, and otherwise should reject the token. The audience defaults to the
+                                                identifier of the apiserver.
+                                              type: string
+                                            expirationSeconds:
+                                              description: |-
+                                                expirationSeconds is the requested duration of validity of the service
+                                                account token. As the token approaches expiration, the kubelet volume
+                                                plugin will proactively rotate the service account token. The kubelet will
+                                                start trying to rotate the token if the token is older than 80 percent of
+                                                its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                                and must be at least 10 minutes.
+                                              type: integer
+                                              format: int64
+                                            path:
+                                              description: |-
+                                                path is the path relative to the mount point of the file to project the
+                                                token into.
+                                              type: string
+                                    x-kubernetes-list-type: atomic
+                              secret:
+                                description: |-
+                                  secret represents a secret that should populate this volume.
+                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values
+                                      for mode bits. Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items If unspecified, each key-value pair in the Data field of the referenced
+                                      Secret will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the Secret,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  optional:
+                                    description: optional field specify whether the Secret or its keys must be defined
+                                    type: boolean
+                                  secretName:
+                                    description: |-
+                                      secretName is the name of the secret in the pod's namespace to use.
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                    type: string
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+            status:
+              description: ConfigurationStatus communicates the observed state of the Configuration (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                latestCreatedRevisionName:
+                  description: |-
+                    LatestCreatedRevisionName is the last revision that was created from this
+                    Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
+                  type: string
+                latestReadyRevisionName:
+                  description: |-
+                    LatestReadyRevisionName holds the name of the latest Revision stamped out
+                    from this Configuration that has had its "Ready" condition become "True".
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterdomainclaims.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the ClusterDomainClaim.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - namespace
+              properties:
+                namespace:
+                  description: |-
+                    Namespace is the namespace which is allowed to create a DomainMapping
+                    using this ClusterDomainClaim's name.
+                  type: string
+  names:
+    kind: ClusterDomainClaim
+    plural: clusterdomainclaims
+    singular: clusterdomainclaim
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - cdc
+  scope: Cluster
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: domainmappings.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: serving.knative.dev
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      "schema":
+        "openAPIV3Schema":
+          description: DomainMapping is a mapping from a custom hostname to an Addressable.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the DomainMapping.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - ref
+              properties:
+                ref:
+                  description: |-
+                    Ref specifies the target of the Domain Mapping.
+
+                    The object identified by the Ref must be an Addressable with a URL of the
+                    form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain,
+                    and `{name}` and `{namespace}` are the name and namespace of a Kubernetes
+                    Service.
+
+                    This contract is satisfied by Knative types such as Knative Services and
+                    Knative Routes, and by Kubernetes Services.
+                  type: object
+                  required:
+                    - kind
+                    - name
+                  properties:
+                    address:
+                      description: Address points to a specific Address Name.
+                      type: string
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    group:
+                      description: |-
+                        Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup.
+                        Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+                        This is optional field, it gets defaulted to the object holding it if left out.
+                      type: string
+                tls:
+                  description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret.
+                  type: object
+                  required:
+                    - secretName
+                  properties:
+                    secretName:
+                      description: SecretName is the name of the existing secret used to terminate TLS traffic.
+                      type: string
+            status:
+              description: |-
+                Status is the current state of the DomainMapping.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a DomainMapping to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                url:
+                  description: URL is the URL of this DomainMapping.
+                  type: string
+  names:
+    kind: DomainMapping
+    plural: domainmappings
+    singular: domainmapping
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - dm
+  scope: Namespaced
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ingresses.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Ingress is a collection of rules that allow inbound connections to reach the endpoints defined
+            by a backend. An Ingress can be configured to give services externally-reachable URLs, load
+            balance traffic, offer name based virtual hosting, etc.
+
+            This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress
+            which some highlighted modifications.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the Ingress.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                httpOption:
+                  description: |-
+                    HTTPOption is the option of HTTP. It has the following two values:
+                    `HTTPOptionEnabled`, `HTTPOptionRedirected`
+                  type: string
+                rules:
+                  description: A list of host rules used to configure the Ingress.
+                  type: array
+                  items:
+                    description: |-
+                      IngressRule represents the rules mapping the paths under a specified host to
+                      the related backend services. Incoming requests are first evaluated for a host
+                      match, then routed to the backend associated with the matching IngressRuleValue.
+                    type: object
+                    properties:
+                      hosts:
+                        description: |-
+                          Host is the fully qualified domain name of a network host, as defined
+                          by RFC 3986. Note the following deviations from the "host" part of the
+                          URI as defined in the RFC:
+                          1. IPs are not allowed. Currently a rule value can only apply to the
+                          	  IP in the Spec of the parent .
+                          2. The `:` delimiter is not respected because ports are not allowed.
+                          	  Currently the port of an Ingress is implicitly :80 for http and
+                          	  :443 for https.
+                          Both these may change in the future.
+                          If the host is unspecified, the Ingress routes all traffic based on the
+                          specified IngressRuleValue.
+                          If multiple matching Hosts were provided, the first rule will take precedent.
+                        type: array
+                        items:
+                          type: string
+                      http:
+                        description: |-
+                          HTTP represents a rule to apply against incoming requests. If the
+                          rule is satisfied, the request is routed to the specified backend.
+                        type: object
+                        required:
+                          - paths
+                        properties:
+                          paths:
+                            description: |-
+                              A collection of paths that map requests to backends.
+
+                              If they are multiple matching paths, the first match takes precedence.
+                            type: array
+                            items:
+                              description: |-
+                                HTTPIngressPath associates a path regex with a backend. Incoming URLs matching
+                                the path are forwarded to the backend.
+                              type: object
+                              required:
+                                - splits
+                              properties:
+                                appendHeaders:
+                                  description: |-
+                                    AppendHeaders allow specifying additional HTTP headers to add
+                                    before forwarding a request to the destination service.
+
+                                    NOTE: This differs from K8s Ingress which doesn't allow header appending.
+                                  type: object
+                                  additionalProperties:
+                                    type: string
+                                headers:
+                                  description: |-
+                                    Headers defines header matching rules which is a map from a header name
+                                    to HeaderMatch which specify a matching condition.
+                                    When a request matched with all the header matching rules,
+                                    the request is routed by the corresponding ingress rule.
+                                    If it is empty, the headers are not used for matching
+                                  type: object
+                                  additionalProperties:
+                                    description: |-
+                                      HeaderMatch represents a matching value of Headers in HTTPIngressPath.
+                                      Currently, only the exact matching is supported.
+                                    type: object
+                                    required:
+                                      - exact
+                                    properties:
+                                      exact:
+                                        type: string
+                                path:
+                                  description: |-
+                                    Path represents a literal prefix to which this rule should apply.
+                                    Currently it can contain characters disallowed from the conventional
+                                    "path" part of a URL as defined by RFC 3986. Paths must begin with
+                                    a '/'. If unspecified, the path defaults to a catch all sending
+                                    traffic to the backend.
+                                  type: string
+                                rewriteHost:
+                                  description: |-
+                                    RewriteHost rewrites the incoming request's host header.
+
+                                    This field is currently experimental and not supported by all Ingress
+                                    implementations.
+                                  type: string
+                                splits:
+                                  description: |-
+                                    Splits defines the referenced service endpoints to which the traffic
+                                    will be forwarded to.
+                                  type: array
+                                  items:
+                                    description: IngressBackendSplit describes all endpoints for a given service and port.
+                                    type: object
+                                    required:
+                                      - serviceName
+                                      - serviceNamespace
+                                      - servicePort
+                                    properties:
+                                      appendHeaders:
+                                        description: |-
+                                          AppendHeaders allow specifying additional HTTP headers to add
+                                          before forwarding a request to the destination service.
+
+                                          NOTE: This differs from K8s Ingress which doesn't allow header appending.
+                                        type: object
+                                        additionalProperties:
+                                          type: string
+                                      percent:
+                                        description: |-
+                                          Specifies the split percentage, a number between 0 and 100.  If
+                                          only one split is specified, we default to 100.
+
+                                          NOTE: This differs from K8s Ingress to allow percentage split.
+                                        type: integer
+                                      serviceName:
+                                        description: Specifies the name of the referenced service.
+                                        type: string
+                                      serviceNamespace:
+                                        description: |-
+                                          Specifies the namespace of the referenced service.
+
+                                          NOTE: This differs from K8s Ingress to allow routing to different namespaces.
+                                        type: string
+                                      servicePort:
+                                        description: Specifies the port of the referenced service.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                      visibility:
+                        description: |-
+                          Visibility signifies whether this rule should `ClusterLocal`. If it's not
+                          specified then it defaults to `ExternalIP`.
+                        type: string
+                tls:
+                  description: |-
+                    TLS configuration. Currently Ingress only supports a single TLS
+                    port: 443. If multiple members of this list specify different hosts, they
+                    will be multiplexed on the same port according to the hostname specified
+                    through the SNI TLS extension, if the ingress controller fulfilling the
+                    ingress supports SNI.
+                  type: array
+                  items:
+                    description: IngressTLS describes the transport layer security associated with an Ingress.
+                    type: object
+                    properties:
+                      hosts:
+                        description: |-
+                          Hosts is a list of hosts included in the TLS certificate. The values in
+                          this list must match the name/s used in the tlsSecret. Defaults to the
+                          wildcard host setting for the loadbalancer controller fulfilling this
+                          Ingress, if left unspecified.
+                        type: array
+                        items:
+                          type: string
+                      secretName:
+                        description: SecretName is the name of the secret used to terminate SSL traffic.
+                        type: string
+                      secretNamespace:
+                        description: |-
+                          SecretNamespace is the namespace of the secret used to terminate SSL traffic.
+                          If not set the namespace should be assumed to be the same as the Ingress.
+                          If set the secret should have the same namespace as the Ingress otherwise
+                          the behaviour is undefined and not supported.
+                        type: string
+            status:
+              description: |-
+                Status is the current state of the Ingress.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateLoadBalancer:
+                  description: PrivateLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: |-
+                        Ingress is a list containing ingress points for the load-balancer.
+                        Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: |-
+                          LoadBalancerIngressStatus represents the status of a load-balancer ingress point:
+                          traffic intended for the service should be sent to an ingress point.
+                        type: object
+                        properties:
+                          domain:
+                            description: |-
+                              Domain is set for load-balancer ingress points that are DNS based
+                              (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: |-
+                              DomainInternal is set if there is a cluster-local DNS name to access the Ingress.
+
+                              NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local
+                                    DNS name to allow routing in case of not having a mesh.
+                            type: string
+                          ip:
+                            description: |-
+                              IP is set for load-balancer ingress points that are IP based
+                              (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+                publicLoadBalancer:
+                  description: PublicLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: |-
+                        Ingress is a list containing ingress points for the load-balancer.
+                        Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: |-
+                          LoadBalancerIngressStatus represents the status of a load-balancer ingress point:
+                          traffic intended for the service should be sent to an ingress point.
+                        type: object
+                        properties:
+                          domain:
+                            description: |-
+                              Domain is set for load-balancer ingress points that are DNS based
+                              (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: |-
+                              DomainInternal is set if there is a cluster-local DNS name to access the Ingress.
+
+                              NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local
+                                    DNS name to allow routing in case of not having a mesh.
+                            type: string
+                          ip:
+                            description: |-
+                              IP is set for load-balancer ingress points that are IP based
+                              (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+  names:
+    kind: Ingress
+    plural: ingresses
+    singular: ingress
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - kingress
+      - king
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: metrics.autoscaling.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: autoscaling.internal.knative.dev
+  names:
+    kind: Metric
+    plural: metrics
+    singular: metric
+    categories:
+      - knative-internal
+      - autoscaling
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: Metric represents a resource to configure the metric collector with.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Metric (from the client).
+              type: object
+              required:
+                - panicWindow
+                - scrapeTarget
+                - stableWindow
+              properties:
+                panicWindow:
+                  description: PanicWindow is the aggregation window for metrics where quick reactions are needed.
+                  type: integer
+                  format: int64
+                scrapeTarget:
+                  description: ScrapeTarget is the K8s service that publishes the metric endpoint.
+                  type: string
+                stableWindow:
+                  description: StableWindow is the aggregation window for metrics in a stable state.
+                  type: integer
+                  format: int64
+            status:
+              description: Status communicates the observed state of the Metric (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: podautoscalers.autoscaling.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: autoscaling.internal.knative.dev
+  names:
+    kind: PodAutoscaler
+    plural: podautoscalers
+    singular: podautoscaler
+    categories:
+      - knative-internal
+      - autoscaling
+    shortNames:
+      - kpa
+      - pa
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: DesiredScale
+          type: integer
+          jsonPath: ".status.desiredScale"
+        - name: ActualScale
+          type: integer
+          jsonPath: ".status.actualScale"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative
+            components instantiate autoscalers.  This definition is an abstraction that may be backed
+            by multiple definitions.  For more information, see the Knative Pluggability presentation:
+            https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the PodAutoscaler (from the client).
+              type: object
+              required:
+                - protocolType
+                - scaleTargetRef
+              properties:
+                containerConcurrency:
+                  description: |-
+                    ContainerConcurrency specifies the maximum allowed
+                    in-flight (concurrent) requests per container of the Revision.
+                    Defaults to `0` which means unlimited concurrency.
+                  type: integer
+                  format: int64
+                protocolType:
+                  description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec.
+                  type: string
+                reachability:
+                  description: |-
+                    Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route).
+                    Defaults to `ReachabilityUnknown`
+                  type: string
+                scaleTargetRef:
+                  description: |-
+                    ScaleTargetRef defines the /scale-able resource that this PodAutoscaler
+                    is responsible for quickly right-sizing.
+                  type: object
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                  x-kubernetes-map-type: atomic
+            status:
+              description: Status communicates the observed state of the PodAutoscaler (from the controller).
+              type: object
+              required:
+                - metricsServiceName
+                - serviceName
+              properties:
+                actualScale:
+                  description: ActualScale shows the actual number of replicas for the revision.
+                  type: integer
+                  format: int32
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                desiredScale:
+                  description: DesiredScale shows the current desired number of replicas for the revision.
+                  type: integer
+                  format: int32
+                metricsServiceName:
+                  description: |-
+                    MetricsServiceName is the K8s Service name that provides revision metrics.
+                    The service is managed by the PA object.
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                serviceName:
+                  description: |-
+                    ServiceName is the K8s Service name that serves the revision, scaled by this PA.
+                    The service is created and owned by the ServerlessService object owned by this PA.
+                  type: string
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: revisions.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Revision
+    plural: revisions
+    singular: revision
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - rev
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Config Name
+          type: string
+          jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']"
+        - name: Generation
+          type: string # int in string form :(
+          jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+        - name: Actual Replicas
+          type: integer
+          jsonPath: ".status.actualReplicas"
+        - name: Desired Replicas
+          type: integer
+          jsonPath: ".status.desiredReplicas"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Revision is an immutable snapshot of code and configuration.  A revision
+            references a container image. Revisions are created by updates to a
+            Configuration.
+
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: RevisionSpec holds the desired state of the Revision (from the client).
+              type: object
+              required:
+                - containers
+              properties:
+                affinity:
+                  description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                automountServiceAccountToken:
+                  description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                  type: boolean
+                containerConcurrency:
+                  description: |-
+                    ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                    requests per container of the Revision.  Defaults to `0` which means
+                    concurrency to the application is not limited, and the system decides the
+                    target concurrency for the autoscaler.
+                  type: integer
+                  format: int64
+                containers:
+                  description: |-
+                    List of containers belonging to the pod.
+                    Containers cannot currently be added or removed.
+                    There must be at least one container in a Pod.
+                    Cannot be updated.
+                  type: array
+                  items:
+                    description: A single application container that you want to run within a pod.
+                    type: object
+                    properties:
+                      args:
+                        description: |-
+                          Arguments to the entrypoint.
+                          The container image's CMD is used if this is not provided.
+                          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                          of whether the variable exists or not. Cannot be updated.
+                          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                        type: array
+                        items:
+                          type: string
+                        x-kubernetes-list-type: atomic
+                      command:
+                        description: |-
+                          Entrypoint array. Not executed within a shell.
+                          The container image's ENTRYPOINT is used if this is not provided.
+                          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                          of whether the variable exists or not. Cannot be updated.
+                          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                        type: array
+                        items:
+                          type: string
+                        x-kubernetes-list-type: atomic
+                      env:
+                        description: |-
+                          List of environment variables to set in the container.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: EnvVar represents an environment variable present in a Container.
+                          type: object
+                          required:
+                            - name
+                          properties:
+                            name:
+                              description: Name of the environment variable. Must be a C_IDENTIFIER.
+                              type: string
+                            value:
+                              description: |-
+                                Variable references $(VAR_NAME) are expanded
+                                using the previously defined environment variables in the container and
+                                any service environment variables. If a variable cannot be resolved,
+                                the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                Escaped references will never be expanded, regardless of whether the variable
+                                exists or not.
+                                Defaults to "".
+                              type: string
+                            valueFrom:
+                              description: Source for the environment variable's value. Cannot be used if value is not empty.
+                              type: object
+                              properties:
+                                configMapKeyRef:
+                                  description: Selects a key of a ConfigMap.
+                                  type: object
+                                  required:
+                                    - key
+                                  properties:
+                                    key:
+                                      description: The key to select.
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: Specify whether the ConfigMap or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                fieldRef:
+                                  description: |-
+                                    This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                  x-kubernetes-preserve-unknown-fields: true
+                                resourceFieldRef:
+                                  description: |-
+                                    This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                  x-kubernetes-preserve-unknown-fields: true
+                                secretKeyRef:
+                                  description: Selects a key of a secret in the pod's namespace
+                                  type: object
+                                  required:
+                                    - key
+                                  properties:
+                                    key:
+                                      description: The key of the secret to select from.  Must be a valid secret key.
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: Specify whether the Secret or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                        x-kubernetes-list-map-keys:
+                          - name
+                        x-kubernetes-list-type: map
+                      envFrom:
+                        description: |-
+                          List of sources to populate environment variables in the container.
+                          The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                          will be reported as an event when the container is starting. When a key exists in multiple
+                          sources, the value associated with the last source will take precedence.
+                          Values defined by an Env with a duplicate key will take precedence.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                          type: object
+                          properties:
+                            configMapRef:
+                              description: The ConfigMap to select from
+                              type: object
+                              properties:
+                                name:
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                  default: ""
+                                optional:
+                                  description: Specify whether the ConfigMap must be defined
+                                  type: boolean
+                              x-kubernetes-map-type: atomic
+                            prefix:
+                              description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                              type: string
+                            secretRef:
+                              description: The Secret to select from
+                              type: object
+                              properties:
+                                name:
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                  default: ""
+                                optional:
+                                  description: Specify whether the Secret must be defined
+                                  type: boolean
+                              x-kubernetes-map-type: atomic
+                        x-kubernetes-list-type: atomic
+                      image:
+                        description: |-
+                          Container image name.
+                          More info: https://kubernetes.io/docs/concepts/containers/images
+                          This field is optional to allow higher level config management to default or override
+                          container images in workload controllers like Deployments and StatefulSets.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Image pull policy.
+                          One of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        type: string
+                      livenessProbe:
+                        description: |-
+                          Periodic probe of container liveness.
+                          Container will be restarted if the probe fails.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      name:
+                        description: |-
+                          Name of the container specified as a DNS_LABEL.
+                          Each container in a pod must have a unique name (DNS_LABEL).
+                          Cannot be updated.
+                        type: string
+                      ports:
+                        description: |-
+                          List of ports to expose from the container. Not specifying a port here
+                          DOES NOT prevent that port from being exposed. Any port which is
+                          listening on the default "0.0.0.0" address inside a container will be
+                          accessible from the network.
+                          Modifying this array with strategic merge patch may corrupt the data.
+                          For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: ContainerPort represents a network port in a single container.
+                          type: object
+                          properties:
+                            containerPort:
+                              description: |-
+                                Number of port to expose on the pod's IP address.
+                                This must be a valid port number, 0 < x < 65536.
+                              type: integer
+                              format: int32
+                            name:
+                              description: |-
+                                If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                named port in a pod must have a unique name. Name for the port that can be
+                                referred to by services.
+                              type: string
+                            protocol:
+                              description: |-
+                                Protocol for port. Must be UDP, TCP, or SCTP.
+                                Defaults to "TCP".
+                              type: string
+                              default: TCP
+                      readinessProbe:
+                        description: |-
+                          Periodic probe of container service readiness.
+                          Container will be removed from service endpoints if the probe fails.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      resources:
+                        description: |-
+                          Compute Resources required by this container.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                        properties:
+                          limits:
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                            additionalProperties:
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              anyOf:
+                                - type: integer
+                                - type: string
+                              x-kubernetes-int-or-string: true
+                          requests:
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                            additionalProperties:
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              anyOf:
+                                - type: integer
+                                - type: string
+                              x-kubernetes-int-or-string: true
+                      securityContext:
+                        description: |-
+                          SecurityContext defines the security options the container should be run with.
+                          If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                          More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                        type: object
+                        properties:
+                          allowPrivilegeEscalation:
+                            description: |-
+                              AllowPrivilegeEscalation controls whether a process can gain more
+                              privileges than its parent process. This bool directly controls if
+                              the no_new_privs flag will be set on the container process.
+                              AllowPrivilegeEscalation is true always when the container is:
+                              1) run as Privileged
+                              2) has CAP_SYS_ADMIN
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: boolean
+                          capabilities:
+                            description: |-
+                              The capabilities to add/drop when running containers.
+                              Defaults to the default set of capabilities granted by the container runtime.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: object
+                            properties:
+                              add:
+                                description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                type: array
+                                items:
+                                  description: Capability represent POSIX capabilities type
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              drop:
+                                description: Removed capabilities
+                                type: array
+                                items:
+                                  description: Capability represent POSIX capabilities type
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          privileged:
+                            description: |-
+                              Run container in privileged mode. This can only be set to explicitly to 'false'
+                            type: boolean
+                          readOnlyRootFilesystem:
+                            description: |-
+                              Whether this container has a read-only root filesystem.
+                              Default is false.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: boolean
+                          runAsGroup:
+                            description: |-
+                              The GID to run the entrypoint of the container process.
+                              Uses runtime default if unset.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: integer
+                            format: int64
+                          runAsNonRoot:
+                            description: |-
+                              Indicates that the container must run as a non-root user.
+                              If true, the Kubelet will validate the image at runtime to ensure that it
+                              does not run as UID 0 (root) and fail to start the container if it does.
+                              If unset or false, no such validation will be performed.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: boolean
+                          runAsUser:
+                            description: |-
+                              The UID to run the entrypoint of the container process.
+                              Defaults to user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: integer
+                            format: int64
+                          seccompProfile:
+                            description: |-
+                              The seccomp options to use by this container. If seccomp options are
+                              provided at both the pod & container level, the container options
+                              override the pod options.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: object
+                            required:
+                              - type
+                            properties:
+                              localhostProfile:
+                                description: |-
+                                  localhostProfile indicates a profile defined in a file on the node should be used.
+                                  The profile must be preconfigured on the node to work.
+                                  Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                  Must be set if type is "Localhost". Must NOT be set for any other type.
+                                type: string
+                              type:
+                                description: |-
+                                  type indicates which kind of seccomp profile will be applied.
+                                  Valid options are:
+
+                                  Localhost - a profile defined in a file on the node should be used.
+                                  RuntimeDefault - the container runtime default profile should be used.
+                                  Unconfined - no profile should be applied.
+                                type: string
+                      startupProbe:
+                        description: |-
+                          StartupProbe indicates that the Pod has successfully initialized.
+                          If specified, no other probes are executed until this completes successfully.
+                          If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                          This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                          when it might take a long time to load data or warm a cache, than during steady-state operation.
+                          This cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      terminationMessagePath:
+                        description: |-
+                          Optional: Path at which the file to which the container's termination message
+                          will be written is mounted into the container's filesystem.
+                          Message written is intended to be brief final status, such as an assertion failure message.
+                          Will be truncated by the node if greater than 4096 bytes. The total message length across
+                          all containers will be limited to 12kb.
+                          Defaults to /dev/termination-log.
+                          Cannot be updated.
+                        type: string
+                      terminationMessagePolicy:
+                        description: |-
+                          Indicate how the termination message should be populated. File will use the contents of
+                          terminationMessagePath to populate the container status message on both success and failure.
+                          FallbackToLogsOnError will use the last chunk of container log output if the termination
+                          message file is empty and the container exited with an error.
+                          The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                          Defaults to File.
+                          Cannot be updated.
+                        type: string
+                      volumeMounts:
+                        description: |-
+                          Pod volumes to mount into the container's filesystem.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: VolumeMount describes a mounting of a Volume within a container.
+                          type: object
+                          required:
+                            - mountPath
+                            - name
+                          properties:
+                            mountPath:
+                              description: |-
+                                Path within the container at which the volume should be mounted.  Must
+                                not contain ':'.
+                              type: string
+                            mountPropagation:
+                              description: |-
+                                This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                              type: string
+                            name:
+                              description: This must match the Name of a Volume.
+                              type: string
+                            readOnly:
+                              description: |-
+                                Mounted read-only if true, read-write otherwise (false or unspecified).
+                                Defaults to false.
+                              type: boolean
+                            subPath:
+                              description: |-
+                                Path within the volume from which the container's volume should be mounted.
+                                Defaults to "" (volume's root).
+                              type: string
+                        x-kubernetes-list-map-keys:
+                          - mountPath
+                        x-kubernetes-list-type: map
+                      workingDir:
+                        description: |-
+                          Container's working directory.
+                          If not specified, the container runtime's default will be used, which
+                          might be configured in the container image.
+                          Cannot be updated.
+                        type: string
+                dnsConfig:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                dnsPolicy:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                  type: string
+                enableServiceLinks:
+                  description: |-
+                    EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                  type: boolean
+                hostAliases:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                  type: array
+                  items:
+                    description: |-
+                      This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                hostIPC:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                  type: boolean
+                hostNetwork:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                  type: boolean
+                hostPID:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                  type: boolean
+                idleTimeoutSeconds:
+                  description: |-
+                    IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                    to stay open while not receiving any bytes from the user's application. If
+                    unspecified, a system default will be provided.
+                  type: integer
+                  format: int64
+                imagePullSecrets:
+                  description: |-
+                    ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                    If specified, these secrets will be passed to individual puller implementations for them to use.
+                    More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                  type: array
+                  items:
+                    description: |-
+                      LocalObjectReference contains enough information to let you locate the
+                      referenced object inside the same namespace.
+                    type: object
+                    properties:
+                      name:
+                        description: |-
+                          Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                        default: ""
+                    x-kubernetes-map-type: atomic
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                initContainers:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                  type: array
+                  items:
+                    description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                nodeSelector:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                  type: object
+                  additionalProperties:
+                    type: string
+                  x-kubernetes-map-type: atomic
+                priorityClassName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                  type: string
+                responseStartTimeoutSeconds:
+                  description: |-
+                    ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                    routing layer will wait for a request delivered to a container to begin
+                    sending any network traffic.
+                  type: integer
+                  format: int64
+                runtimeClassName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                  type: string
+                schedulerName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                  type: string
+                securityContext:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                serviceAccountName:
+                  description: |-
+                    ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                    More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                  type: string
+                shareProcessNamespace:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                  type: boolean
+                timeoutSeconds:
+                  description: |-
+                    TimeoutSeconds is the maximum duration in seconds that the request instance
+                    is allowed to respond to a request. If unspecified, a system default will
+                    be provided.
+                  type: integer
+                  format: int64
+                tolerations:
+                  description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                  type: array
+                  items:
+                    description: |-
+                      This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                topologySpreadConstraints:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                  type: array
+                  items:
+                    description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                volumes:
+                  description: |-
+                    List of volumes that can be mounted by containers belonging to the pod.
+                    More info: https://kubernetes.io/docs/concepts/storage/volumes
+                  type: array
+                  items:
+                    description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                    type: object
+                    required:
+                      - name
+                    properties:
+                      configMap:
+                        description: configMap represents a configMap that should populate this volume
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode is optional: mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                              Defaults to 0644.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          items:
+                            description: |-
+                              items if unspecified, each key-value pair in the Data field of the referenced
+                              ConfigMap will be projected into the volume as a file whose name is the
+                              key and content is the value. If specified, the listed keys will be
+                              projected into the specified paths, and unlisted keys will not be
+                              present. If a key is specified which is not present in the ConfigMap,
+                              the volume setup will error unless it is marked optional. Paths must be
+                              relative and may not contain the '..' path or start with '..'.
+                            type: array
+                            items:
+                              description: Maps a string key to a path within a volume.
+                              type: object
+                              required:
+                                - key
+                                - path
+                              properties:
+                                key:
+                                  description: key is the key to project.
+                                  type: string
+                                mode:
+                                  description: |-
+                                    mode is Optional: mode bits used to set permissions on this file.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    If not specified, the volume defaultMode will be used.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  type: integer
+                                  format: int32
+                                path:
+                                  description: |-
+                                    path is the relative path of the file to map the key to.
+                                    May not be an absolute path.
+                                    May not contain the path element '..'.
+                                    May not start with the string '..'.
+                                  type: string
+                            x-kubernetes-list-type: atomic
+                          name:
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                            default: ""
+                          optional:
+                            description: optional specify whether the ConfigMap or its keys must be defined
+                            type: boolean
+                        x-kubernetes-map-type: atomic
+                      csi:
+                        description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      emptyDir:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      hostPath:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      image:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      name:
+                        description: |-
+                          name of the volume.
+                          Must be a DNS_LABEL and unique within the pod.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                      persistentVolumeClaim:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      projected:
+                        description: projected items for all in one resources secrets, configmaps, and downward API
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode are the mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          sources:
+                            description: |-
+                              sources is the list of volume projections. Each entry in this list
+                              handles one source.
+                            type: array
+                            items:
+                              description: |-
+                                Projection that may be projected along with other supported volume types.
+                                Exactly one of these fields must be set.
+                              type: object
+                              properties:
+                                configMap:
+                                  description: configMap information about the configMap data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: |-
+                                        items if unspecified, each key-value pair in the Data field of the referenced
+                                        ConfigMap will be projected into the volume as a file whose name is the
+                                        key and content is the value. If specified, the listed keys will be
+                                        projected into the specified paths, and unlisted keys will not be
+                                        present. If a key is specified which is not present in the ConfigMap,
+                                        the volume setup will error unless it is marked optional. Paths must be
+                                        relative and may not contain the '..' path or start with '..'.
+                                      type: array
+                                      items:
+                                        description: Maps a string key to a path within a volume.
+                                        type: object
+                                        required:
+                                          - key
+                                          - path
+                                        properties:
+                                          key:
+                                            description: key is the key to project.
+                                            type: string
+                                          mode:
+                                            description: |-
+                                              mode is Optional: mode bits used to set permissions on this file.
+                                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: |-
+                                              path is the relative path of the file to map the key to.
+                                              May not be an absolute path.
+                                              May not contain the path element '..'.
+                                              May not start with the string '..'.
+                                            type: string
+                                      x-kubernetes-list-type: atomic
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: optional specify whether the ConfigMap or its keys must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                downwardAPI:
+                                  description: downwardAPI information about the downwardAPI data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: Items is a list of DownwardAPIVolume file
+                                      type: array
+                                      items:
+                                        description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                        type: object
+                                        required:
+                                          - path
+                                        properties:
+                                          fieldRef:
+                                            description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                            type: object
+                                            required:
+                                              - fieldPath
+                                            properties:
+                                              apiVersion:
+                                                description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                type: string
+                                              fieldPath:
+                                                description: Path of the field to select in the specified API version.
+                                                type: string
+                                            x-kubernetes-map-type: atomic
+                                          mode:
+                                            description: |-
+                                              Optional: mode bits used to set permissions on this file, must be an octal value
+                                              between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                            type: string
+                                          resourceFieldRef:
+                                            description: |-
+                                              Selects a resource of the container: only resources limits and requests
+                                              (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                            type: object
+                                            required:
+                                              - resource
+                                            properties:
+                                              containerName:
+                                                description: 'Container name: required for volumes, optional for env vars'
+                                                type: string
+                                              divisor:
+                                                description: Specifies the output format of the exposed resources, defaults to "1"
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                x-kubernetes-int-or-string: true
+                                              resource:
+                                                description: 'Required: resource to select'
+                                                type: string
+                                            x-kubernetes-map-type: atomic
+                                      x-kubernetes-list-type: atomic
+                                secret:
+                                  description: secret information about the secret data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: |-
+                                        items if unspecified, each key-value pair in the Data field of the referenced
+                                        Secret will be projected into the volume as a file whose name is the
+                                        key and content is the value. If specified, the listed keys will be
+                                        projected into the specified paths, and unlisted keys will not be
+                                        present. If a key is specified which is not present in the Secret,
+                                        the volume setup will error unless it is marked optional. Paths must be
+                                        relative and may not contain the '..' path or start with '..'.
+                                      type: array
+                                      items:
+                                        description: Maps a string key to a path within a volume.
+                                        type: object
+                                        required:
+                                          - key
+                                          - path
+                                        properties:
+                                          key:
+                                            description: key is the key to project.
+                                            type: string
+                                          mode:
+                                            description: |-
+                                              mode is Optional: mode bits used to set permissions on this file.
+                                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: |-
+                                              path is the relative path of the file to map the key to.
+                                              May not be an absolute path.
+                                              May not contain the path element '..'.
+                                              May not start with the string '..'.
+                                            type: string
+                                      x-kubernetes-list-type: atomic
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: optional field specify whether the Secret or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                serviceAccountToken:
+                                  description: serviceAccountToken is information about the serviceAccountToken data to project
+                                  type: object
+                                  required:
+                                    - path
+                                  properties:
+                                    audience:
+                                      description: |-
+                                        audience is the intended audience of the token. A recipient of a token
+                                        must identify itself with an identifier specified in the audience of the
+                                        token, and otherwise should reject the token. The audience defaults to the
+                                        identifier of the apiserver.
+                                      type: string
+                                    expirationSeconds:
+                                      description: |-
+                                        expirationSeconds is the requested duration of validity of the service
+                                        account token. As the token approaches expiration, the kubelet volume
+                                        plugin will proactively rotate the service account token. The kubelet will
+                                        start trying to rotate the token if the token is older than 80 percent of
+                                        its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                        and must be at least 10 minutes.
+                                      type: integer
+                                      format: int64
+                                    path:
+                                      description: |-
+                                        path is the path relative to the mount point of the file to project the
+                                        token into.
+                                      type: string
+                            x-kubernetes-list-type: atomic
+                      secret:
+                        description: |-
+                          secret represents a secret that should populate this volume.
+                          More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode is Optional: mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values
+                              for mode bits. Defaults to 0644.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          items:
+                            description: |-
+                              items If unspecified, each key-value pair in the Data field of the referenced
+                              Secret will be projected into the volume as a file whose name is the
+                              key and content is the value. If specified, the listed keys will be
+                              projected into the specified paths, and unlisted keys will not be
+                              present. If a key is specified which is not present in the Secret,
+                              the volume setup will error unless it is marked optional. Paths must be
+                              relative and may not contain the '..' path or start with '..'.
+                            type: array
+                            items:
+                              description: Maps a string key to a path within a volume.
+                              type: object
+                              required:
+                                - key
+                                - path
+                              properties:
+                                key:
+                                  description: key is the key to project.
+                                  type: string
+                                mode:
+                                  description: |-
+                                    mode is Optional: mode bits used to set permissions on this file.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    If not specified, the volume defaultMode will be used.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  type: integer
+                                  format: int32
+                                path:
+                                  description: |-
+                                    path is the relative path of the file to map the key to.
+                                    May not be an absolute path.
+                                    May not contain the path element '..'.
+                                    May not start with the string '..'.
+                                  type: string
+                            x-kubernetes-list-type: atomic
+                          optional:
+                            description: optional field specify whether the Secret or its keys must be defined
+                            type: boolean
+                          secretName:
+                            description: |-
+                              secretName is the name of the secret in the pod's namespace to use.
+                              More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                            type: string
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+            status:
+              description: RevisionStatus communicates the observed state of the Revision (from the controller).
+              type: object
+              properties:
+                actualReplicas:
+                  description: ActualReplicas reflects the amount of ready pods running this revision.
+                  type: integer
+                  format: int32
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                containerStatuses:
+                  description: |-
+                    ContainerStatuses is a slice of images present in .Spec.Container[*].Image
+                    to their respective digests and their container name.
+                    The digests are resolved during the creation of Revision.
+                    ContainerStatuses holds the container name and image digests
+                    for both serving and non serving containers.
+                    ref: http://bit.ly/image-digests
+                  type: array
+                  items:
+                    description: ContainerStatus holds the information of container name and image digest value
+                    type: object
+                    properties:
+                      imageDigest:
+                        type: string
+                      name:
+                        type: string
+                desiredReplicas:
+                  description: DesiredReplicas reflects the desired amount of pods running this revision.
+                  type: integer
+                  format: int32
+                initContainerStatuses:
+                  description: |-
+                    InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image
+                    to their respective digests and their container name.
+                    The digests are resolved during the creation of Revision.
+                    ContainerStatuses holds the container name and image digests
+                    for both serving and non serving containers.
+                    ref: http://bit.ly/image-digests
+                  type: array
+                  items:
+                    description: ContainerStatus holds the information of container name and image digest value
+                    type: object
+                    properties:
+                      imageDigest:
+                        type: string
+                      name:
+                        type: string
+                logUrl:
+                  description: |-
+                    LogURL specifies the generated logging url for this particular revision
+                    based on the revision url template specified in the controller's config.
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: routes.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/addressable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Route
+    plural: routes
+    singular: route
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - rt
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Route is responsible for configuring ingress over a collection of Revisions.
+            Some of the Revisions a Route distributes traffic over may be specified by
+            referencing the Configuration responsible for creating them; in these cases
+            the Route is additionally responsible for monitoring the Configuration for
+            "latest ready revision" changes, and smoothly rolling out latest revisions.
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Route (from the client).
+              type: object
+              properties:
+                traffic:
+                  description: |-
+                    Traffic specifies how to distribute traffic over a collection of
+                    revisions and configurations.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+            status:
+              description: Status communicates the observed state of the Route (from the controller).
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a Route to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                traffic:
+                  description: |-
+                    Traffic holds the configured traffic distribution.
+                    These entries will always contain RevisionName references.
+                    When ConfigurationName appears in the spec, this will hold the
+                    LatestReadyRevisionName that we last observed.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+                url:
+                  description: |-
+                    URL holds the url that will distribute traffic over the provided traffic targets.
+                    It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}
+                  type: string
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serverlessservices.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            ServerlessService is a proxy for the K8s service objects containing the
+            endpoints for the revision, whether those are endpoints of the activator or
+            revision pods.
+            See: https://knative.page.link/naxz for details.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the ServerlessService.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - objectRef
+                - protocolType
+              properties:
+                mode:
+                  description: Mode describes the mode of operation of the ServerlessService.
+                  type: string
+                numActivators:
+                  description: |-
+                    NumActivators contains number of Activators that this revision should be
+                    assigned.
+                    O means — assign all.
+                  type: integer
+                  format: int32
+                objectRef:
+                  description: |-
+                    ObjectRef defines the resource that this ServerlessService
+                    is responsible for making "serverless".
+                  type: object
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    fieldPath:
+                      description: |-
+                        If referring to a piece of an object instead of an entire object, this string
+                        should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+                        For example, if the object reference is to a container within a pod, this would take on a value like:
+                        "spec.containers{name}" (where "name" refers to the name of the container that triggered
+                        the event) or if no container name is specified "spec.containers[2]" (container with
+                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
+                        referencing a part of an object.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+                      type: string
+                    resourceVersion:
+                      description: |-
+                        Specific resourceVersion to which this reference is made, if any.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+                      type: string
+                    uid:
+                      description: |-
+                        UID of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+                      type: string
+                  x-kubernetes-map-type: atomic
+                protocolType:
+                  description: |-
+                    The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision.
+                    serving imports networking, so just use string.
+                  type: string
+            status:
+              description: |-
+                Status is the current state of the ServerlessService.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateServiceName:
+                  description: |-
+                    PrivateServiceName holds the name of a core K8s Service resource that
+                    load balances over the user service pods backing this Revision.
+                  type: string
+                serviceName:
+                  description: |-
+                    ServiceName holds the name of a core K8s Service resource that
+                    load balances over the pods backing this Revision (activator or revision).
+                  type: string
+      additionalPrinterColumns:
+        - name: Mode
+          type: string
+          jsonPath: ".spec.mode"
+        - name: Activators
+          type: integer
+          jsonPath: ".spec.numActivators"
+        - name: ServiceName
+          type: string
+          jsonPath: ".status.serviceName"
+        - name: PrivateServiceName
+          type: string
+          jsonPath: ".status.privateServiceName"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+  names:
+    kind: ServerlessService
+    plural: serverlessservices
+    singular: serverlessservice
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - sks
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: services.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/addressable: "true"
+    duck.knative.dev/podspecable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Service
+    plural: services
+    singular: service
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - kservice
+      - ksvc
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: LatestCreated
+          type: string
+          jsonPath: .status.latestCreatedRevisionName
+        - name: LatestReady
+          type: string
+          jsonPath: .status.latestReadyRevisionName
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Service acts as a top-level container that manages a Route and Configuration
+            which implement a network service. Service exists to provide a singular
+            abstraction which can be access controlled, reasoned about, and which
+            encapsulates software lifecycle decisions such as rollout policy and
+            team resource ownership. Service acts only as an orchestrator of the
+            underlying Routes and Configurations (much as a kubernetes Deployment
+            orchestrates ReplicaSets), and its usage is optional but recommended.
+
+            The Service's controller will track the statuses of its owned Configuration
+            and Route, reflecting their statuses and conditions as its own.
+
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                ServiceSpec represents the configuration for the Service object.
+                A Service's specification is the union of the specifications for a Route
+                and Configuration.  The Service restricts what can be expressed in these
+                fields, e.g. the Route must reference the provided Configuration;
+                however, these limitations also enable friendlier defaulting,
+                e.g. Route never needs a Configuration name, and may be defaulted to
+                the appropriate "run latest" spec.
+              type: object
+              properties:
+                template:
+                  description: Template holds the latest specification for the Revision to be stamped out.
+                  type: object
+                  properties:
+                    metadata:
+                      type: object
+                      properties:
+                        annotations:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        finalizers:
+                          type: array
+                          items:
+                            type: string
+                        labels:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      description: RevisionSpec holds the desired state of the Revision (from the client).
+                      type: object
+                      required:
+                        - containers
+                      properties:
+                        affinity:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        automountServiceAccountToken:
+                          description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                          type: boolean
+                        containerConcurrency:
+                          description: |-
+                            ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                            requests per container of the Revision.  Defaults to `0` which means
+                            concurrency to the application is not limited, and the system decides the
+                            target concurrency for the autoscaler.
+                          type: integer
+                          format: int64
+                        containers:
+                          description: |-
+                            List of containers belonging to the pod.
+                            Containers cannot currently be added or removed.
+                            There must be at least one container in a Pod.
+                            Cannot be updated.
+                          type: array
+                          items:
+                            description: A single application container that you want to run within a pod.
+                            type: object
+                            properties:
+                              args:
+                                description: |-
+                                  Arguments to the entrypoint.
+                                  The container image's CMD is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              command:
+                                description: |-
+                                  Entrypoint array. Not executed within a shell.
+                                  The container image's ENTRYPOINT is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              env:
+                                description: |-
+                                  List of environment variables to set in the container.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvVar represents an environment variable present in a Container.
+                                  type: object
+                                  required:
+                                    - name
+                                  properties:
+                                    name:
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    value:
+                                      description: |-
+                                        Variable references $(VAR_NAME) are expanded
+                                        using the previously defined environment variables in the container and
+                                        any service environment variables. If a variable cannot be resolved,
+                                        the reference in the input string will be unchanged. Double $$ are reduced
+                                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                        Escaped references will never be expanded, regardless of whether the variable
+                                        exists or not.
+                                        Defaults to "".
+                                      type: string
+                                    valueFrom:
+                                      description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                      type: object
+                                      properties:
+                                        configMapKeyRef:
+                                          description: Selects a key of a ConfigMap.
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key to select.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the ConfigMap or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        fieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        resourceFieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        secretKeyRef:
+                                          description: Selects a key of a secret in the pod's namespace
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key of the secret to select from.  Must be a valid secret key.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              envFrom:
+                                description: |-
+                                  List of sources to populate environment variables in the container.
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  sources, the value associated with the last source will take precedence.
+                                  Values defined by an Env with a duplicate key will take precedence.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  type: object
+                                  properties:
+                                    configMapRef:
+                                      description: The ConfigMap to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the ConfigMap must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                    prefix:
+                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    secretRef:
+                                      description: The Secret to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the Secret must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                x-kubernetes-list-type: atomic
+                              image:
+                                description: |-
+                                  Container image name.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images
+                                  This field is optional to allow higher level config management to default or override
+                                  container images in workload controllers like Deployments and StatefulSets.
+                                type: string
+                              imagePullPolicy:
+                                description: |-
+                                  Image pull policy.
+                                  One of Always, Never, IfNotPresent.
+                                  Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                                type: string
+                              livenessProbe:
+                                description: |-
+                                  Periodic probe of container liveness.
+                                  Container will be restarted if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              name:
+                                description: |-
+                                  Name of the container specified as a DNS_LABEL.
+                                  Each container in a pod must have a unique name (DNS_LABEL).
+                                  Cannot be updated.
+                                type: string
+                              ports:
+                                description: |-
+                                  List of ports to expose from the container. Not specifying a port here
+                                  DOES NOT prevent that port from being exposed. Any port which is
+                                  listening on the default "0.0.0.0" address inside a container will be
+                                  accessible from the network.
+                                  Modifying this array with strategic merge patch may corrupt the data.
+                                  For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: ContainerPort represents a network port in a single container.
+                                  type: object
+                                  properties:
+                                    containerPort:
+                                      description: |-
+                                        Number of port to expose on the pod's IP address.
+                                        This must be a valid port number, 0 < x < 65536.
+                                      type: integer
+                                      format: int32
+                                    name:
+                                      description: |-
+                                        If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                        named port in a pod must have a unique name. Name for the port that can be
+                                        referred to by services.
+                                      type: string
+                                    protocol:
+                                      description: |-
+                                        Protocol for port. Must be UDP, TCP, or SCTP.
+                                        Defaults to "TCP".
+                                      type: string
+                                      default: TCP
+                              readinessProbe:
+                                description: |-
+                                  Periodic probe of container service readiness.
+                                  Container will be removed from service endpoints if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              resources:
+                                description: |-
+                                  Compute Resources required by this container.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                                properties:
+                                  limits:
+                                    description: |-
+                                      Limits describes the maximum amount of compute resources allowed.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                                  requests:
+                                    description: |-
+                                      Requests describes the minimum amount of compute resources required.
+                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                              securityContext:
+                                description: |-
+                                  SecurityContext defines the security options the container should be run with.
+                                  If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                  More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                                type: object
+                                properties:
+                                  allowPrivilegeEscalation:
+                                    description: |-
+                                      AllowPrivilegeEscalation controls whether a process can gain more
+                                      privileges than its parent process. This bool directly controls if
+                                      the no_new_privs flag will be set on the container process.
+                                      AllowPrivilegeEscalation is true always when the container is:
+                                      1) run as Privileged
+                                      2) has CAP_SYS_ADMIN
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  capabilities:
+                                    description: |-
+                                      The capabilities to add/drop when running containers.
+                                      Defaults to the default set of capabilities granted by the container runtime.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    properties:
+                                      add:
+                                        description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      drop:
+                                        description: Removed capabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  privileged:
+                                    description: |-
+                                      Run container in privileged mode. This can only be set to explicitly to 'false'
+                                    type: boolean
+                                  readOnlyRootFilesystem:
+                                    description: |-
+                                      Whether this container has a read-only root filesystem.
+                                      Default is false.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  runAsGroup:
+                                    description: |-
+                                      The GID to run the entrypoint of the container process.
+                                      Uses runtime default if unset.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  runAsNonRoot:
+                                    description: |-
+                                      Indicates that the container must run as a non-root user.
+                                      If true, the Kubelet will validate the image at runtime to ensure that it
+                                      does not run as UID 0 (root) and fail to start the container if it does.
+                                      If unset or false, no such validation will be performed.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    type: boolean
+                                  runAsUser:
+                                    description: |-
+                                      The UID to run the entrypoint of the container process.
+                                      Defaults to user specified in image metadata if unspecified.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  seccompProfile:
+                                    description: |-
+                                      The seccomp options to use by this container. If seccomp options are
+                                      provided at both the pod & container level, the container options
+                                      override the pod options.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    required:
+                                      - type
+                                    properties:
+                                      localhostProfile:
+                                        description: |-
+                                          localhostProfile indicates a profile defined in a file on the node should be used.
+                                          The profile must be preconfigured on the node to work.
+                                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                                        type: string
+                                      type:
+                                        description: |-
+                                          type indicates which kind of seccomp profile will be applied.
+                                          Valid options are:
+
+                                          Localhost - a profile defined in a file on the node should be used.
+                                          RuntimeDefault - the container runtime default profile should be used.
+                                          Unconfined - no profile should be applied.
+                                        type: string
+                              startupProbe:
+                                description: |-
+                                  StartupProbe indicates that the Pod has successfully initialized.
+                                  If specified, no other probes are executed until this completes successfully.
+                                  If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                  This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                  when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                  This cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              terminationMessagePath:
+                                description: |-
+                                  Optional: Path at which the file to which the container's termination message
+                                  will be written is mounted into the container's filesystem.
+                                  Message written is intended to be brief final status, such as an assertion failure message.
+                                  Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                  all containers will be limited to 12kb.
+                                  Defaults to /dev/termination-log.
+                                  Cannot be updated.
+                                type: string
+                              terminationMessagePolicy:
+                                description: |-
+                                  Indicate how the termination message should be populated. File will use the contents of
+                                  terminationMessagePath to populate the container status message on both success and failure.
+                                  FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                  message file is empty and the container exited with an error.
+                                  The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                  Defaults to File.
+                                  Cannot be updated.
+                                type: string
+                              volumeMounts:
+                                description: |-
+                                  Pod volumes to mount into the container's filesystem.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: VolumeMount describes a mounting of a Volume within a container.
+                                  type: object
+                                  required:
+                                    - mountPath
+                                    - name
+                                  properties:
+                                    mountPath:
+                                      description: |-
+                                        Path within the container at which the volume should be mounted.  Must
+                                        not contain ':'.
+                                      type: string
+                                    mountPropagation:
+                                      description: |-
+                                        This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                                      type: string
+                                    name:
+                                      description: This must match the Name of a Volume.
+                                      type: string
+                                    readOnly:
+                                      description: |-
+                                        Mounted read-only if true, read-write otherwise (false or unspecified).
+                                        Defaults to false.
+                                      type: boolean
+                                    subPath:
+                                      description: |-
+                                        Path within the volume from which the container's volume should be mounted.
+                                        Defaults to "" (volume's root).
+                                      type: string
+                                x-kubernetes-list-map-keys:
+                                  - mountPath
+                                x-kubernetes-list-type: map
+                              workingDir:
+                                description: |-
+                                  Container's working directory.
+                                  If not specified, the container runtime's default will be used, which
+                                  might be configured in the container image.
+                                  Cannot be updated.
+                                type: string
+                        dnsConfig:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        dnsPolicy:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                          type: string
+                        enableServiceLinks:
+                          description: |-
+                            EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                          type: boolean
+                        hostAliases:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        hostIPC:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                          type: boolean
+                        hostNetwork:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                          type: boolean
+                        hostPID:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                          type: boolean
+                        idleTimeoutSeconds:
+                          description: |-
+                            IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                            to stay open while not receiving any bytes from the user's application. If
+                            unspecified, a system default will be provided.
+                          type: integer
+                          format: int64
+                        imagePullSecrets:
+                          description: |-
+                            ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                            If specified, these secrets will be passed to individual puller implementations for them to use.
+                            More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                          type: array
+                          items:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            type: object
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                                default: ""
+                            x-kubernetes-map-type: atomic
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                        initContainers:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        nodeSelector:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                          type: object
+                          additionalProperties:
+                            type: string
+                          x-kubernetes-map-type: atomic
+                        priorityClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                          type: string
+                        responseStartTimeoutSeconds:
+                          description: |-
+                            ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                            routing layer will wait for a request delivered to a container to begin
+                            sending any network traffic.
+                          type: integer
+                          format: int64
+                        runtimeClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                          type: string
+                        schedulerName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                          type: string
+                        securityContext:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        serviceAccountName:
+                          description: |-
+                            ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                            More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                          type: string
+                        shareProcessNamespace:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                          type: boolean
+                        timeoutSeconds:
+                          description: |-
+                            TimeoutSeconds is the maximum duration in seconds that the request instance
+                            is allowed to respond to a request. If unspecified, a system default will
+                            be provided.
+                          type: integer
+                          format: int64
+                        tolerations:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        topologySpreadConstraints:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        volumes:
+                          description: |-
+                            List of volumes that can be mounted by containers belonging to the pod.
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes
+                          type: array
+                          items:
+                            description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                            type: object
+                            required:
+                              - name
+                            properties:
+                              configMap:
+                                description: configMap represents a configMap that should populate this volume
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items if unspecified, each key-value pair in the Data field of the referenced
+                                      ConfigMap will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the ConfigMap,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  name:
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                    default: ""
+                                  optional:
+                                    description: optional specify whether the ConfigMap or its keys must be defined
+                                    type: boolean
+                                x-kubernetes-map-type: atomic
+                              csi:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              emptyDir:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              image:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              name:
+                                description: |-
+                                  name of the volume.
+                                  Must be a DNS_LABEL and unique within the pod.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                              persistentVolumeClaim:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              projected:
+                                description: projected items for all in one resources secrets, configmaps, and downward API
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode are the mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  sources:
+                                    description: |-
+                                      sources is the list of volume projections. Each entry in this list
+                                      handles one source.
+                                    type: array
+                                    items:
+                                      description: |-
+                                        Projection that may be projected along with other supported volume types.
+                                        Exactly one of these fields must be set.
+                                      type: object
+                                      properties:
+                                        configMap:
+                                          description: configMap information about the configMap data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                ConfigMap will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the ConfigMap,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional specify whether the ConfigMap or its keys must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        downwardAPI:
+                                          description: downwardAPI information about the downwardAPI data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: Items is a list of DownwardAPIVolume file
+                                              type: array
+                                              items:
+                                                description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                                type: object
+                                                required:
+                                                  - path
+                                                properties:
+                                                  fieldRef:
+                                                    description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                                    type: object
+                                                    required:
+                                                      - fieldPath
+                                                    properties:
+                                                      apiVersion:
+                                                        description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                        type: string
+                                                      fieldPath:
+                                                        description: Path of the field to select in the specified API version.
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                                  mode:
+                                                    description: |-
+                                                      Optional: mode bits used to set permissions on this file, must be an octal value
+                                                      between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                                    type: string
+                                                  resourceFieldRef:
+                                                    description: |-
+                                                      Selects a resource of the container: only resources limits and requests
+                                                      (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                    type: object
+                                                    required:
+                                                      - resource
+                                                    properties:
+                                                      containerName:
+                                                        description: 'Container name: required for volumes, optional for env vars'
+                                                        type: string
+                                                      divisor:
+                                                        description: Specifies the output format of the exposed resources, defaults to "1"
+                                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                        anyOf:
+                                                          - type: integer
+                                                          - type: string
+                                                        x-kubernetes-int-or-string: true
+                                                      resource:
+                                                        description: 'Required: resource to select'
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                              x-kubernetes-list-type: atomic
+                                        secret:
+                                          description: secret information about the secret data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                Secret will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the Secret,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional field specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        serviceAccountToken:
+                                          description: serviceAccountToken is information about the serviceAccountToken data to project
+                                          type: object
+                                          required:
+                                            - path
+                                          properties:
+                                            audience:
+                                              description: |-
+                                                audience is the intended audience of the token. A recipient of a token
+                                                must identify itself with an identifier specified in the audience of the
+                                                token, and otherwise should reject the token. The audience defaults to the
+                                                identifier of the apiserver.
+                                              type: string
+                                            expirationSeconds:
+                                              description: |-
+                                                expirationSeconds is the requested duration of validity of the service
+                                                account token. As the token approaches expiration, the kubelet volume
+                                                plugin will proactively rotate the service account token. The kubelet will
+                                                start trying to rotate the token if the token is older than 80 percent of
+                                                its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                                and must be at least 10 minutes.
+                                              type: integer
+                                              format: int64
+                                            path:
+                                              description: |-
+                                                path is the path relative to the mount point of the file to project the
+                                                token into.
+                                              type: string
+                                    x-kubernetes-list-type: atomic
+                              secret:
+                                description: |-
+                                  secret represents a secret that should populate this volume.
+                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values
+                                      for mode bits. Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items If unspecified, each key-value pair in the Data field of the referenced
+                                      Secret will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the Secret,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  optional:
+                                    description: optional field specify whether the Secret or its keys must be defined
+                                    type: boolean
+                                  secretName:
+                                    description: |-
+                                      secretName is the name of the secret in the pod's namespace to use.
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                    type: string
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                traffic:
+                  description: |-
+                    Traffic specifies how to distribute traffic over a collection of
+                    revisions and configurations.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+            status:
+              description: ServiceStatus represents the Status stanza of the Service resource.
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a Route to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                latestCreatedRevisionName:
+                  description: |-
+                    LatestCreatedRevisionName is the last revision that was created from this
+                    Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
+                  type: string
+                latestReadyRevisionName:
+                  description: |-
+                    LatestReadyRevisionName holds the name of the latest Revision stamped out
+                    from this Configuration that has had its "Ready" condition become "True".
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                traffic:
+                  description: |-
+                    Traffic holds the configured traffic distribution.
+                    These entries will always contain RevisionName references.
+                    When ConfigurationName appears in the spec, this will hold the
+                    LatestReadyRevisionName that we last observed.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+                url:
+                  description: |-
+                    URL holds the url that will distribute traffic over the provided traffic targets.
+                    It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}
+                  type: string
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: images.caching.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: caching.internal.knative.dev
+  names:
+    kind: Image
+    plural: images
+    singular: image
+    categories:
+      - knative-internal
+      - caching
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Image is a Knative abstraction that encapsulates the interface by which Knative
+            components express a desire to have a particular image cached.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Image (from the client).
+              type: object
+              required:
+                - image
+              properties:
+                image:
+                  description: Image is the name of the container image url to cache across the cluster.
+                  type: string
+                imagePullSecrets:
+                  description: |-
+                    ImagePullSecrets contains the names of the Kubernetes Secrets containing login
+                    information used by the Pods which will run this container.
+                  type: array
+                  items:
+                    description: |-
+                      LocalObjectReference contains enough information to let you locate the
+                      referenced object inside the same namespace.
+                    type: object
+                    properties:
+                      name:
+                        description: |-
+                          Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                        default: ""
+                    x-kubernetes-map-type: atomic
+                serviceAccountName:
+                  description: |-
+                    ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods
+                    will run this container.  This is potentially used to authenticate the image pull
+                    if the service account has attached pull secrets.  For more information:
+                    https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
+                  type: string
+            status:
+              description: Status communicates the observed state of the Image (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Image
+          type: string
+          jsonPath: .spec.image
+
+---
diff --git a/integration/fixtures/knative/01-rbac.yml b/integration/fixtures/knative/01-rbac.yml
new file mode 100644
index 000000000..af29709e9
--- /dev/null
+++ b/integration/fixtures/knative/01-rbac.yml
@@ -0,0 +1,50 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: knative-networking-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.internal.knative.dev
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.internal.knative.dev
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: knative-networking-role
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik
diff --git a/integration/fixtures/knative/02-traefik.yml b/integration/fixtures/knative/02-traefik.yml
new file mode 100644
index 000000000..15588a4a6
--- /dev/null
+++ b/integration/fixtures/knative/02-traefik.yml
@@ -0,0 +1,102 @@
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: traefik
+
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: traefik
+  namespace: traefik
+
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik/traefik:latest
+          imagePullPolicy: Never
+          args:
+            - --api.insecure
+            - --log.level=debug
+            - --entrypoints.pweb.address=:80
+            - --entrypoints.pwebsecure.address=:443
+            - --entrypoints.privweb.address=:8080
+            - --entrypoints.privwebsecure.address=:4443
+            - --entrypoints.traefik.address=:9000
+            - --experimental.knative
+            - --providers.knative.publicEntrypoints=pweb,pwebsecure
+            - --providers.knative.publicService.namespace=traefik
+            - --providers.knative.publicService.name=traefik
+            - --providers.knative.privateEntrypoints=privweb,privwebsecure
+            - --providers.knative.privateService.namespace=traefik
+            - --providers.knative.privateService.name=privtraefik
+            - --providers.knative.throttleduration=2s
+
+          ports:
+            - name: pweb
+              containerPort: 80
+            - name: pwebsecure
+              containerPort: 443
+            - name: privweb
+              containerPort: 8080
+            - name: privwebsecure
+              containerPort: 4443
+            - name: traefik
+              containerPort: 9000
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - port: 80
+      name: web
+      targetPort: pweb
+    - port: 443
+      name: websecure
+      targetPort: pwebsecure
+    - port: 9000
+      name: traefik
+      targetPort: traefik
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: privtraefik
+  namespace: traefik
+spec:
+  selector:
+    app: traefik
+  ports:
+    - port: 80
+      name: web
+      targetPort: privweb
+    - port: 443
+      name: websecure
+      targetPort: privwebsecure
diff --git a/integration/fixtures/knative/03-knative-serving-v1.19.0.yaml b/integration/fixtures/knative/03-knative-serving-v1.19.0.yaml
new file mode 100644
index 000000000..98a89d394
--- /dev/null
+++ b/integration/fixtures/knative/03-knative-serving-v1.19.0.yaml
@@ -0,0 +1,9513 @@
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+
+---
+# Copyright 2023 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-activator
+  namespace: knative-serving
+  labels:
+    serving.knative.dev/controller: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+    resourceNames: ["routing-serving-certs", "knative-serving-certs"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-activator-cluster
+  labels:
+    serving.knative.dev/controller: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["serving.knative.dev"]
+    resources: ["revisions"]
+    verbs: ["get", "list", "watch"]
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Use this aggregated ClusterRole when you need readonly access to "Addressables"
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  # Named like this to avoid clashing with eventing's existing `addressable-resolver` role
+  # (which should be identical, but isn't guaranteed to be installed alongside serving).
+  name: knative-serving-aggregated-addressable-resolver
+  labels:
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        duck.knative.dev/addressable: "true"
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-addressable-resolver
+  labels:
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+    # Labeled to facilitate aggregated cluster roles that act on Addressables.
+    duck.knative.dev/addressable: "true"
+# Do not use this role directly. These rules will be added to the "addressable-resolver" role.
+rules:
+  - apiGroups:
+      - serving.knative.dev
+    resources:
+      - routes
+      - routes/status
+      - services
+      - services/status
+    verbs:
+      - get
+      - list
+      - watch
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-namespaced-admin
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: ["serving.knative.dev"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-namespaced-edit
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: ["serving.knative.dev"]
+    resources: ["*"]
+    verbs: ["create", "update", "patch", "delete"]
+  - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-namespaced-view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-core
+  labels:
+    serving.knative.dev/controller: "true"
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: [""]
+    resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook
+    verbs: ["update"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions", "customresourcedefinitions/status"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"]
+    resources: ["*", "*/status", "*/finalizers"]
+    verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"]
+  - apiGroups: ["caching.internal.knative.dev"]
+    resources: ["images"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["acme.cert-manager.io"]
+    resources: ["challenges"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["clusterroles"]
+    verbs: ["delete"]
+    resourceNames: ["knative-serving-certmanager"]
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-podspecable-binding
+  labels:
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+    # Labeled to facilitate aggregated cluster roles that act on PodSpecables.
+    duck.knative.dev/podspecable: "true"
+# Do not use this role directly. These rules will be added to the "podspecable-binder" role.
+rules:
+  - apiGroups:
+      - serving.knative.dev
+    resources:
+      - configurations
+      - services
+    verbs:
+      - list
+      - watch
+      - patch
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: controller
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-admin
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        serving.knative.dev/controller: "true"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: knative-serving-controller-admin
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+subjects:
+  - kind: ServiceAccount
+    name: controller
+    namespace: knative-serving
+roleRef:
+  kind: ClusterRole
+  name: knative-serving-admin
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: knative-serving-controller-addressable-resolver
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+subjects:
+  - kind: ServiceAccount
+    name: controller
+    namespace: knative-serving
+roleRef:
+  kind: ClusterRole
+  name: knative-serving-aggregated-addressable-resolver
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: activator
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: knative-serving-activator
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+subjects:
+  - kind: ServiceAccount
+    name: activator
+    namespace: knative-serving
+roleRef:
+  kind: Role
+  name: knative-serving-activator
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: knative-serving-activator-cluster
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+subjects:
+  - kind: ServiceAccount
+    name: activator
+    namespace: knative-serving
+roleRef:
+  kind: ClusterRole
+  name: knative-serving-activator-cluster
+  apiGroup: rbac.authorization.k8s.io
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: images.caching.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: caching.internal.knative.dev
+  names:
+    kind: Image
+    plural: images
+    singular: image
+    categories:
+      - knative-internal
+      - caching
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Image is a Knative abstraction that encapsulates the interface by which Knative
+            components express a desire to have a particular image cached.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Image (from the client).
+              type: object
+              required:
+                - image
+              properties:
+                image:
+                  description: Image is the name of the container image url to cache across the cluster.
+                  type: string
+                imagePullSecrets:
+                  description: |-
+                    ImagePullSecrets contains the names of the Kubernetes Secrets containing login
+                    information used by the Pods which will run this container.
+                  type: array
+                  items:
+                    description: |-
+                      LocalObjectReference contains enough information to let you locate the
+                      referenced object inside the same namespace.
+                    type: object
+                    properties:
+                      name:
+                        description: |-
+                          Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                        default: ""
+                    x-kubernetes-map-type: atomic
+                serviceAccountName:
+                  description: |-
+                    ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods
+                    will run this container.  This is potentially used to authenticate the image pull
+                    if the service account has attached pull secrets.  For more information:
+                    https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
+                  type: string
+            status:
+              description: Status communicates the observed state of the Image (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Image
+          type: string
+          jsonPath: .spec.image
+
+---
+apiVersion: networking.internal.knative.dev/v1alpha1
+kind: Certificate
+metadata:
+  annotations:
+    networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev
+  labels:
+    networking.knative.dev/certificate-type: system-internal
+  name: routing-serving-certs
+  namespace: knative-serving
+spec:
+  dnsNames:
+    - kn-routing
+    - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs
+  secretName: routing-serving-certs
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Certificate is responsible for provisioning a SSL certificate for the
+            given hosts. It is a Knative abstraction for various SSL certificate
+            provisioning solutions (such as cert-manager or self-signed SSL certificate).
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the Certificate.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - dnsNames
+                - secretName
+              properties:
+                dnsNames:
+                  description: |-
+                    DNSNames is a list of DNS names the Certificate could support.
+                    The wildcard format of DNSNames (e.g. *.default.example.com) is supported.
+                  type: array
+                  items:
+                    type: string
+                domain:
+                  description: Domain is the top level domain of the values for DNSNames.
+                  type: string
+                secretName:
+                  description: SecretName is the name of the secret resource to store the SSL certificate in.
+                  type: string
+            status:
+              description: |-
+                Status is the current state of the Certificate.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                http01Challenges:
+                  description: |-
+                    HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled
+                    in order to get the TLS certificate..
+                  type: array
+                  items:
+                    description: |-
+                      HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs
+                      to fulfill.
+                    type: object
+                    properties:
+                      serviceName:
+                        description: ServiceName is the name of the service to serve HTTP01 challenge requests.
+                        type: string
+                      serviceNamespace:
+                        description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests.
+                        type: string
+                      servicePort:
+                        description: ServicePort is the port of the service to serve HTTP01 challenge requests.
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        x-kubernetes-int-or-string: true
+                      url:
+                        description: URL is the URL that the HTTP01 challenge is expected to serve on.
+                        type: string
+                notAfter:
+                  description: |-
+                    The expiration time of the TLS certificate stored in the secret named
+                    by this resource in spec.secretName.
+                  type: string
+                  format: date-time
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+  names:
+    kind: Certificate
+    plural: certificates
+    singular: certificate
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - kcert
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: configurations.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/podspecable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Configuration
+    plural: configurations
+    singular: configuration
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - config
+      - cfg
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: LatestCreated
+          type: string
+          jsonPath: .status.latestCreatedRevisionName
+        - name: LatestReady
+          type: string
+          jsonPath: .status.latestReadyRevisionName
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Configuration represents the "floating HEAD" of a linear history of Revisions.
+            Users create new Revisions by updating the Configuration's spec.
+            The "latest created" revision's name is available under status, as is the
+            "latest ready" revision's name.
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ConfigurationSpec holds the desired state of the Configuration (from the client).
+              type: object
+              properties:
+                template:
+                  description: Template holds the latest specification for the Revision to be stamped out.
+                  type: object
+                  properties:
+                    metadata:
+                      type: object
+                      properties:
+                        annotations:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        finalizers:
+                          type: array
+                          items:
+                            type: string
+                        labels:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      description: RevisionSpec holds the desired state of the Revision (from the client).
+                      type: object
+                      required:
+                        - containers
+                      properties:
+                        affinity:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        automountServiceAccountToken:
+                          description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                          type: boolean
+                        containerConcurrency:
+                          description: |-
+                            ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                            requests per container of the Revision.  Defaults to `0` which means
+                            concurrency to the application is not limited, and the system decides the
+                            target concurrency for the autoscaler.
+                          type: integer
+                          format: int64
+                        containers:
+                          description: |-
+                            List of containers belonging to the pod.
+                            Containers cannot currently be added or removed.
+                            There must be at least one container in a Pod.
+                            Cannot be updated.
+                          type: array
+                          items:
+                            description: A single application container that you want to run within a pod.
+                            type: object
+                            properties:
+                              args:
+                                description: |-
+                                  Arguments to the entrypoint.
+                                  The container image's CMD is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              command:
+                                description: |-
+                                  Entrypoint array. Not executed within a shell.
+                                  The container image's ENTRYPOINT is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              env:
+                                description: |-
+                                  List of environment variables to set in the container.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvVar represents an environment variable present in a Container.
+                                  type: object
+                                  required:
+                                    - name
+                                  properties:
+                                    name:
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    value:
+                                      description: |-
+                                        Variable references $(VAR_NAME) are expanded
+                                        using the previously defined environment variables in the container and
+                                        any service environment variables. If a variable cannot be resolved,
+                                        the reference in the input string will be unchanged. Double $$ are reduced
+                                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                        Escaped references will never be expanded, regardless of whether the variable
+                                        exists or not.
+                                        Defaults to "".
+                                      type: string
+                                    valueFrom:
+                                      description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                      type: object
+                                      properties:
+                                        configMapKeyRef:
+                                          description: Selects a key of a ConfigMap.
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key to select.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the ConfigMap or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        fieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        resourceFieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        secretKeyRef:
+                                          description: Selects a key of a secret in the pod's namespace
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key of the secret to select from.  Must be a valid secret key.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              envFrom:
+                                description: |-
+                                  List of sources to populate environment variables in the container.
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  sources, the value associated with the last source will take precedence.
+                                  Values defined by an Env with a duplicate key will take precedence.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  type: object
+                                  properties:
+                                    configMapRef:
+                                      description: The ConfigMap to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the ConfigMap must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                    prefix:
+                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    secretRef:
+                                      description: The Secret to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the Secret must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                x-kubernetes-list-type: atomic
+                              image:
+                                description: |-
+                                  Container image name.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images
+                                  This field is optional to allow higher level config management to default or override
+                                  container images in workload controllers like Deployments and StatefulSets.
+                                type: string
+                              imagePullPolicy:
+                                description: |-
+                                  Image pull policy.
+                                  One of Always, Never, IfNotPresent.
+                                  Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                                type: string
+                              livenessProbe:
+                                description: |-
+                                  Periodic probe of container liveness.
+                                  Container will be restarted if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              name:
+                                description: |-
+                                  Name of the container specified as a DNS_LABEL.
+                                  Each container in a pod must have a unique name (DNS_LABEL).
+                                  Cannot be updated.
+                                type: string
+                              ports:
+                                description: |-
+                                  List of ports to expose from the container. Not specifying a port here
+                                  DOES NOT prevent that port from being exposed. Any port which is
+                                  listening on the default "0.0.0.0" address inside a container will be
+                                  accessible from the network.
+                                  Modifying this array with strategic merge patch may corrupt the data.
+                                  For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: ContainerPort represents a network port in a single container.
+                                  type: object
+                                  properties:
+                                    containerPort:
+                                      description: |-
+                                        Number of port to expose on the pod's IP address.
+                                        This must be a valid port number, 0 < x < 65536.
+                                      type: integer
+                                      format: int32
+                                    name:
+                                      description: |-
+                                        If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                        named port in a pod must have a unique name. Name for the port that can be
+                                        referred to by services.
+                                      type: string
+                                    protocol:
+                                      description: |-
+                                        Protocol for port. Must be UDP, TCP, or SCTP.
+                                        Defaults to "TCP".
+                                      type: string
+                                      default: TCP
+                              readinessProbe:
+                                description: |-
+                                  Periodic probe of container service readiness.
+                                  Container will be removed from service endpoints if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              resources:
+                                description: |-
+                                  Compute Resources required by this container.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                                properties:
+                                  limits:
+                                    description: |-
+                                      Limits describes the maximum amount of compute resources allowed.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                                  requests:
+                                    description: |-
+                                      Requests describes the minimum amount of compute resources required.
+                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                              securityContext:
+                                description: |-
+                                  SecurityContext defines the security options the container should be run with.
+                                  If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                  More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                                type: object
+                                properties:
+                                  allowPrivilegeEscalation:
+                                    description: |-
+                                      AllowPrivilegeEscalation controls whether a process can gain more
+                                      privileges than its parent process. This bool directly controls if
+                                      the no_new_privs flag will be set on the container process.
+                                      AllowPrivilegeEscalation is true always when the container is:
+                                      1) run as Privileged
+                                      2) has CAP_SYS_ADMIN
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  capabilities:
+                                    description: |-
+                                      The capabilities to add/drop when running containers.
+                                      Defaults to the default set of capabilities granted by the container runtime.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    properties:
+                                      add:
+                                        description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      drop:
+                                        description: Removed capabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  privileged:
+                                    description: |-
+                                      Run container in privileged mode. This can only be set to explicitly to 'false'
+                                    type: boolean
+                                  readOnlyRootFilesystem:
+                                    description: |-
+                                      Whether this container has a read-only root filesystem.
+                                      Default is false.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  runAsGroup:
+                                    description: |-
+                                      The GID to run the entrypoint of the container process.
+                                      Uses runtime default if unset.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  runAsNonRoot:
+                                    description: |-
+                                      Indicates that the container must run as a non-root user.
+                                      If true, the Kubelet will validate the image at runtime to ensure that it
+                                      does not run as UID 0 (root) and fail to start the container if it does.
+                                      If unset or false, no such validation will be performed.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    type: boolean
+                                  runAsUser:
+                                    description: |-
+                                      The UID to run the entrypoint of the container process.
+                                      Defaults to user specified in image metadata if unspecified.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  seccompProfile:
+                                    description: |-
+                                      The seccomp options to use by this container. If seccomp options are
+                                      provided at both the pod & container level, the container options
+                                      override the pod options.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    required:
+                                      - type
+                                    properties:
+                                      localhostProfile:
+                                        description: |-
+                                          localhostProfile indicates a profile defined in a file on the node should be used.
+                                          The profile must be preconfigured on the node to work.
+                                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                                        type: string
+                                      type:
+                                        description: |-
+                                          type indicates which kind of seccomp profile will be applied.
+                                          Valid options are:
+
+                                          Localhost - a profile defined in a file on the node should be used.
+                                          RuntimeDefault - the container runtime default profile should be used.
+                                          Unconfined - no profile should be applied.
+                                        type: string
+                              startupProbe:
+                                description: |-
+                                  StartupProbe indicates that the Pod has successfully initialized.
+                                  If specified, no other probes are executed until this completes successfully.
+                                  If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                  This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                  when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                  This cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              terminationMessagePath:
+                                description: |-
+                                  Optional: Path at which the file to which the container's termination message
+                                  will be written is mounted into the container's filesystem.
+                                  Message written is intended to be brief final status, such as an assertion failure message.
+                                  Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                  all containers will be limited to 12kb.
+                                  Defaults to /dev/termination-log.
+                                  Cannot be updated.
+                                type: string
+                              terminationMessagePolicy:
+                                description: |-
+                                  Indicate how the termination message should be populated. File will use the contents of
+                                  terminationMessagePath to populate the container status message on both success and failure.
+                                  FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                  message file is empty and the container exited with an error.
+                                  The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                  Defaults to File.
+                                  Cannot be updated.
+                                type: string
+                              volumeMounts:
+                                description: |-
+                                  Pod volumes to mount into the container's filesystem.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: VolumeMount describes a mounting of a Volume within a container.
+                                  type: object
+                                  required:
+                                    - mountPath
+                                    - name
+                                  properties:
+                                    mountPath:
+                                      description: |-
+                                        Path within the container at which the volume should be mounted.  Must
+                                        not contain ':'.
+                                      type: string
+                                    mountPropagation:
+                                      description: |-
+                                        This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                                      type: string
+                                    name:
+                                      description: This must match the Name of a Volume.
+                                      type: string
+                                    readOnly:
+                                      description: |-
+                                        Mounted read-only if true, read-write otherwise (false or unspecified).
+                                        Defaults to false.
+                                      type: boolean
+                                    subPath:
+                                      description: |-
+                                        Path within the volume from which the container's volume should be mounted.
+                                        Defaults to "" (volume's root).
+                                      type: string
+                                x-kubernetes-list-map-keys:
+                                  - mountPath
+                                x-kubernetes-list-type: map
+                              workingDir:
+                                description: |-
+                                  Container's working directory.
+                                  If not specified, the container runtime's default will be used, which
+                                  might be configured in the container image.
+                                  Cannot be updated.
+                                type: string
+                        dnsConfig:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        dnsPolicy:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                          type: string
+                        enableServiceLinks:
+                          description: |-
+                            EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                          type: boolean
+                        hostAliases:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        hostIPC:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                          type: boolean
+                        hostNetwork:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                          type: boolean
+                        hostPID:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                          type: boolean
+                        idleTimeoutSeconds:
+                          description: |-
+                            IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                            to stay open while not receiving any bytes from the user's application. If
+                            unspecified, a system default will be provided.
+                          type: integer
+                          format: int64
+                        imagePullSecrets:
+                          description: |-
+                            ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                            If specified, these secrets will be passed to individual puller implementations for them to use.
+                            More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                          type: array
+                          items:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            type: object
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                                default: ""
+                            x-kubernetes-map-type: atomic
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                        initContainers:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        nodeSelector:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                          type: object
+                          additionalProperties:
+                            type: string
+                          x-kubernetes-map-type: atomic
+                        priorityClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                          type: string
+                        responseStartTimeoutSeconds:
+                          description: |-
+                            ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                            routing layer will wait for a request delivered to a container to begin
+                            sending any network traffic.
+                          type: integer
+                          format: int64
+                        runtimeClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                          type: string
+                        schedulerName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                          type: string
+                        securityContext:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        serviceAccountName:
+                          description: |-
+                            ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                            More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                          type: string
+                        shareProcessNamespace:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                          type: boolean
+                        timeoutSeconds:
+                          description: |-
+                            TimeoutSeconds is the maximum duration in seconds that the request instance
+                            is allowed to respond to a request. If unspecified, a system default will
+                            be provided.
+                          type: integer
+                          format: int64
+                        tolerations:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        topologySpreadConstraints:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        volumes:
+                          description: |-
+                            List of volumes that can be mounted by containers belonging to the pod.
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes
+                          type: array
+                          items:
+                            description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                            type: object
+                            required:
+                              - name
+                            properties:
+                              configMap:
+                                description: configMap represents a configMap that should populate this volume
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items if unspecified, each key-value pair in the Data field of the referenced
+                                      ConfigMap will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the ConfigMap,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  name:
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                    default: ""
+                                  optional:
+                                    description: optional specify whether the ConfigMap or its keys must be defined
+                                    type: boolean
+                                x-kubernetes-map-type: atomic
+                              csi:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              emptyDir:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              image:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              name:
+                                description: |-
+                                  name of the volume.
+                                  Must be a DNS_LABEL and unique within the pod.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                              persistentVolumeClaim:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              projected:
+                                description: projected items for all in one resources secrets, configmaps, and downward API
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode are the mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  sources:
+                                    description: |-
+                                      sources is the list of volume projections. Each entry in this list
+                                      handles one source.
+                                    type: array
+                                    items:
+                                      description: |-
+                                        Projection that may be projected along with other supported volume types.
+                                        Exactly one of these fields must be set.
+                                      type: object
+                                      properties:
+                                        configMap:
+                                          description: configMap information about the configMap data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                ConfigMap will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the ConfigMap,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional specify whether the ConfigMap or its keys must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        downwardAPI:
+                                          description: downwardAPI information about the downwardAPI data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: Items is a list of DownwardAPIVolume file
+                                              type: array
+                                              items:
+                                                description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                                type: object
+                                                required:
+                                                  - path
+                                                properties:
+                                                  fieldRef:
+                                                    description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                                    type: object
+                                                    required:
+                                                      - fieldPath
+                                                    properties:
+                                                      apiVersion:
+                                                        description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                        type: string
+                                                      fieldPath:
+                                                        description: Path of the field to select in the specified API version.
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                                  mode:
+                                                    description: |-
+                                                      Optional: mode bits used to set permissions on this file, must be an octal value
+                                                      between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                                    type: string
+                                                  resourceFieldRef:
+                                                    description: |-
+                                                      Selects a resource of the container: only resources limits and requests
+                                                      (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                    type: object
+                                                    required:
+                                                      - resource
+                                                    properties:
+                                                      containerName:
+                                                        description: 'Container name: required for volumes, optional for env vars'
+                                                        type: string
+                                                      divisor:
+                                                        description: Specifies the output format of the exposed resources, defaults to "1"
+                                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                        anyOf:
+                                                          - type: integer
+                                                          - type: string
+                                                        x-kubernetes-int-or-string: true
+                                                      resource:
+                                                        description: 'Required: resource to select'
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                              x-kubernetes-list-type: atomic
+                                        secret:
+                                          description: secret information about the secret data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                Secret will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the Secret,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional field specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        serviceAccountToken:
+                                          description: serviceAccountToken is information about the serviceAccountToken data to project
+                                          type: object
+                                          required:
+                                            - path
+                                          properties:
+                                            audience:
+                                              description: |-
+                                                audience is the intended audience of the token. A recipient of a token
+                                                must identify itself with an identifier specified in the audience of the
+                                                token, and otherwise should reject the token. The audience defaults to the
+                                                identifier of the apiserver.
+                                              type: string
+                                            expirationSeconds:
+                                              description: |-
+                                                expirationSeconds is the requested duration of validity of the service
+                                                account token. As the token approaches expiration, the kubelet volume
+                                                plugin will proactively rotate the service account token. The kubelet will
+                                                start trying to rotate the token if the token is older than 80 percent of
+                                                its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                                and must be at least 10 minutes.
+                                              type: integer
+                                              format: int64
+                                            path:
+                                              description: |-
+                                                path is the path relative to the mount point of the file to project the
+                                                token into.
+                                              type: string
+                                    x-kubernetes-list-type: atomic
+                              secret:
+                                description: |-
+                                  secret represents a secret that should populate this volume.
+                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values
+                                      for mode bits. Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items If unspecified, each key-value pair in the Data field of the referenced
+                                      Secret will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the Secret,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  optional:
+                                    description: optional field specify whether the Secret or its keys must be defined
+                                    type: boolean
+                                  secretName:
+                                    description: |-
+                                      secretName is the name of the secret in the pod's namespace to use.
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                    type: string
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+            status:
+              description: ConfigurationStatus communicates the observed state of the Configuration (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                latestCreatedRevisionName:
+                  description: |-
+                    LatestCreatedRevisionName is the last revision that was created from this
+                    Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
+                  type: string
+                latestReadyRevisionName:
+                  description: |-
+                    LatestReadyRevisionName holds the name of the latest Revision stamped out
+                    from this Configuration that has had its "Ready" condition become "True".
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterdomainclaims.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the ClusterDomainClaim.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - namespace
+              properties:
+                namespace:
+                  description: |-
+                    Namespace is the namespace which is allowed to create a DomainMapping
+                    using this ClusterDomainClaim's name.
+                  type: string
+  names:
+    kind: ClusterDomainClaim
+    plural: clusterdomainclaims
+    singular: clusterdomainclaim
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - cdc
+  scope: Cluster
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: domainmappings.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: serving.knative.dev
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      "schema":
+        "openAPIV3Schema":
+          description: DomainMapping is a mapping from a custom hostname to an Addressable.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the DomainMapping.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - ref
+              properties:
+                ref:
+                  description: |-
+                    Ref specifies the target of the Domain Mapping.
+
+                    The object identified by the Ref must be an Addressable with a URL of the
+                    form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain,
+                    and `{name}` and `{namespace}` are the name and namespace of a Kubernetes
+                    Service.
+
+                    This contract is satisfied by Knative types such as Knative Services and
+                    Knative Routes, and by Kubernetes Services.
+                  type: object
+                  required:
+                    - kind
+                    - name
+                  properties:
+                    address:
+                      description: Address points to a specific Address Name.
+                      type: string
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    group:
+                      description: |-
+                        Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup.
+                        Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+                        This is optional field, it gets defaulted to the object holding it if left out.
+                      type: string
+                tls:
+                  description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret.
+                  type: object
+                  required:
+                    - secretName
+                  properties:
+                    secretName:
+                      description: SecretName is the name of the existing secret used to terminate TLS traffic.
+                      type: string
+            status:
+              description: |-
+                Status is the current state of the DomainMapping.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a DomainMapping to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                url:
+                  description: URL is the URL of this DomainMapping.
+                  type: string
+  names:
+    kind: DomainMapping
+    plural: domainmappings
+    singular: domainmapping
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - dm
+  scope: Namespaced
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: ingresses.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Ingress is a collection of rules that allow inbound connections to reach the endpoints defined
+            by a backend. An Ingress can be configured to give services externally-reachable URLs, load
+            balance traffic, offer name based virtual hosting, etc.
+
+            This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress
+            which some highlighted modifications.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the Ingress.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                httpOption:
+                  description: |-
+                    HTTPOption is the option of HTTP. It has the following two values:
+                    `HTTPOptionEnabled`, `HTTPOptionRedirected`
+                  type: string
+                rules:
+                  description: A list of host rules used to configure the Ingress.
+                  type: array
+                  items:
+                    description: |-
+                      IngressRule represents the rules mapping the paths under a specified host to
+                      the related backend services. Incoming requests are first evaluated for a host
+                      match, then routed to the backend associated with the matching IngressRuleValue.
+                    type: object
+                    properties:
+                      hosts:
+                        description: |-
+                          Host is the fully qualified domain name of a network host, as defined
+                          by RFC 3986. Note the following deviations from the "host" part of the
+                          URI as defined in the RFC:
+                          1. IPs are not allowed. Currently a rule value can only apply to the
+                          	  IP in the Spec of the parent .
+                          2. The `:` delimiter is not respected because ports are not allowed.
+                          	  Currently the port of an Ingress is implicitly :80 for http and
+                          	  :443 for https.
+                          Both these may change in the future.
+                          If the host is unspecified, the Ingress routes all traffic based on the
+                          specified IngressRuleValue.
+                          If multiple matching Hosts were provided, the first rule will take precedent.
+                        type: array
+                        items:
+                          type: string
+                      http:
+                        description: |-
+                          HTTP represents a rule to apply against incoming requests. If the
+                          rule is satisfied, the request is routed to the specified backend.
+                        type: object
+                        required:
+                          - paths
+                        properties:
+                          paths:
+                            description: |-
+                              A collection of paths that map requests to backends.
+
+                              If they are multiple matching paths, the first match takes precedence.
+                            type: array
+                            items:
+                              description: |-
+                                HTTPIngressPath associates a path regex with a backend. Incoming URLs matching
+                                the path are forwarded to the backend.
+                              type: object
+                              required:
+                                - splits
+                              properties:
+                                appendHeaders:
+                                  description: |-
+                                    AppendHeaders allow specifying additional HTTP headers to add
+                                    before forwarding a request to the destination service.
+
+                                    NOTE: This differs from K8s Ingress which doesn't allow header appending.
+                                  type: object
+                                  additionalProperties:
+                                    type: string
+                                headers:
+                                  description: |-
+                                    Headers defines header matching rules which is a map from a header name
+                                    to HeaderMatch which specify a matching condition.
+                                    When a request matched with all the header matching rules,
+                                    the request is routed by the corresponding ingress rule.
+                                    If it is empty, the headers are not used for matching
+                                  type: object
+                                  additionalProperties:
+                                    description: |-
+                                      HeaderMatch represents a matching value of Headers in HTTPIngressPath.
+                                      Currently, only the exact matching is supported.
+                                    type: object
+                                    required:
+                                      - exact
+                                    properties:
+                                      exact:
+                                        type: string
+                                path:
+                                  description: |-
+                                    Path represents a literal prefix to which this rule should apply.
+                                    Currently it can contain characters disallowed from the conventional
+                                    "path" part of a URL as defined by RFC 3986. Paths must begin with
+                                    a '/'. If unspecified, the path defaults to a catch all sending
+                                    traffic to the backend.
+                                  type: string
+                                rewriteHost:
+                                  description: |-
+                                    RewriteHost rewrites the incoming request's host header.
+
+                                    This field is currently experimental and not supported by all Ingress
+                                    implementations.
+                                  type: string
+                                splits:
+                                  description: |-
+                                    Splits defines the referenced service endpoints to which the traffic
+                                    will be forwarded to.
+                                  type: array
+                                  items:
+                                    description: IngressBackendSplit describes all endpoints for a given service and port.
+                                    type: object
+                                    required:
+                                      - serviceName
+                                      - serviceNamespace
+                                      - servicePort
+                                    properties:
+                                      appendHeaders:
+                                        description: |-
+                                          AppendHeaders allow specifying additional HTTP headers to add
+                                          before forwarding a request to the destination service.
+
+                                          NOTE: This differs from K8s Ingress which doesn't allow header appending.
+                                        type: object
+                                        additionalProperties:
+                                          type: string
+                                      percent:
+                                        description: |-
+                                          Specifies the split percentage, a number between 0 and 100.  If
+                                          only one split is specified, we default to 100.
+
+                                          NOTE: This differs from K8s Ingress to allow percentage split.
+                                        type: integer
+                                      serviceName:
+                                        description: Specifies the name of the referenced service.
+                                        type: string
+                                      serviceNamespace:
+                                        description: |-
+                                          Specifies the namespace of the referenced service.
+
+                                          NOTE: This differs from K8s Ingress to allow routing to different namespaces.
+                                        type: string
+                                      servicePort:
+                                        description: Specifies the port of the referenced service.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                      visibility:
+                        description: |-
+                          Visibility signifies whether this rule should `ClusterLocal`. If it's not
+                          specified then it defaults to `ExternalIP`.
+                        type: string
+                tls:
+                  description: |-
+                    TLS configuration. Currently Ingress only supports a single TLS
+                    port: 443. If multiple members of this list specify different hosts, they
+                    will be multiplexed on the same port according to the hostname specified
+                    through the SNI TLS extension, if the ingress controller fulfilling the
+                    ingress supports SNI.
+                  type: array
+                  items:
+                    description: IngressTLS describes the transport layer security associated with an Ingress.
+                    type: object
+                    properties:
+                      hosts:
+                        description: |-
+                          Hosts is a list of hosts included in the TLS certificate. The values in
+                          this list must match the name/s used in the tlsSecret. Defaults to the
+                          wildcard host setting for the loadbalancer controller fulfilling this
+                          Ingress, if left unspecified.
+                        type: array
+                        items:
+                          type: string
+                      secretName:
+                        description: SecretName is the name of the secret used to terminate SSL traffic.
+                        type: string
+                      secretNamespace:
+                        description: |-
+                          SecretNamespace is the namespace of the secret used to terminate SSL traffic.
+                          If not set the namespace should be assumed to be the same as the Ingress.
+                          If set the secret should have the same namespace as the Ingress otherwise
+                          the behaviour is undefined and not supported.
+                        type: string
+            status:
+              description: |-
+                Status is the current state of the Ingress.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateLoadBalancer:
+                  description: PrivateLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: |-
+                        Ingress is a list containing ingress points for the load-balancer.
+                        Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: |-
+                          LoadBalancerIngressStatus represents the status of a load-balancer ingress point:
+                          traffic intended for the service should be sent to an ingress point.
+                        type: object
+                        properties:
+                          domain:
+                            description: |-
+                              Domain is set for load-balancer ingress points that are DNS based
+                              (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: |-
+                              DomainInternal is set if there is a cluster-local DNS name to access the Ingress.
+
+                              NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local
+                                    DNS name to allow routing in case of not having a mesh.
+                            type: string
+                          ip:
+                            description: |-
+                              IP is set for load-balancer ingress points that are IP based
+                              (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+                publicLoadBalancer:
+                  description: PublicLoadBalancer contains the current status of the load-balancer.
+                  type: object
+                  properties:
+                    ingress:
+                      description: |-
+                        Ingress is a list containing ingress points for the load-balancer.
+                        Traffic intended for the service should be sent to these ingress points.
+                      type: array
+                      items:
+                        description: |-
+                          LoadBalancerIngressStatus represents the status of a load-balancer ingress point:
+                          traffic intended for the service should be sent to an ingress point.
+                        type: object
+                        properties:
+                          domain:
+                            description: |-
+                              Domain is set for load-balancer ingress points that are DNS based
+                              (typically AWS load-balancers)
+                            type: string
+                          domainInternal:
+                            description: |-
+                              DomainInternal is set if there is a cluster-local DNS name to access the Ingress.
+
+                              NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local
+                                    DNS name to allow routing in case of not having a mesh.
+                            type: string
+                          ip:
+                            description: |-
+                              IP is set for load-balancer ingress points that are IP based
+                              (typically GCE or OpenStack load-balancers)
+                            type: string
+                          meshOnly:
+                            description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh.
+                            type: boolean
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+  names:
+    kind: Ingress
+    plural: ingresses
+    singular: ingress
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - kingress
+      - king
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: metrics.autoscaling.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: autoscaling.internal.knative.dev
+  names:
+    kind: Metric
+    plural: metrics
+    singular: metric
+    categories:
+      - knative-internal
+      - autoscaling
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: Metric represents a resource to configure the metric collector with.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Metric (from the client).
+              type: object
+              required:
+                - panicWindow
+                - scrapeTarget
+                - stableWindow
+              properties:
+                panicWindow:
+                  description: PanicWindow is the aggregation window for metrics where quick reactions are needed.
+                  type: integer
+                  format: int64
+                scrapeTarget:
+                  description: ScrapeTarget is the K8s service that publishes the metric endpoint.
+                  type: string
+                stableWindow:
+                  description: StableWindow is the aggregation window for metrics in a stable state.
+                  type: integer
+                  format: int64
+            status:
+              description: Status communicates the observed state of the Metric (from the controller).
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: podautoscalers.autoscaling.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: autoscaling.internal.knative.dev
+  names:
+    kind: PodAutoscaler
+    plural: podautoscalers
+    singular: podautoscaler
+    categories:
+      - knative-internal
+      - autoscaling
+    shortNames:
+      - kpa
+      - pa
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: DesiredScale
+          type: integer
+          jsonPath: ".status.desiredScale"
+        - name: ActualScale
+          type: integer
+          jsonPath: ".status.actualScale"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative
+            components instantiate autoscalers.  This definition is an abstraction that may be backed
+            by multiple definitions.  For more information, see the Knative Pluggability presentation:
+            https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the PodAutoscaler (from the client).
+              type: object
+              required:
+                - protocolType
+                - scaleTargetRef
+              properties:
+                containerConcurrency:
+                  description: |-
+                    ContainerConcurrency specifies the maximum allowed
+                    in-flight (concurrent) requests per container of the Revision.
+                    Defaults to `0` which means unlimited concurrency.
+                  type: integer
+                  format: int64
+                protocolType:
+                  description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec.
+                  type: string
+                reachability:
+                  description: |-
+                    Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route).
+                    Defaults to `ReachabilityUnknown`
+                  type: string
+                scaleTargetRef:
+                  description: |-
+                    ScaleTargetRef defines the /scale-able resource that this PodAutoscaler
+                    is responsible for quickly right-sizing.
+                  type: object
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                  x-kubernetes-map-type: atomic
+            status:
+              description: Status communicates the observed state of the PodAutoscaler (from the controller).
+              type: object
+              required:
+                - metricsServiceName
+                - serviceName
+              properties:
+                actualScale:
+                  description: ActualScale shows the actual number of replicas for the revision.
+                  type: integer
+                  format: int32
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                desiredScale:
+                  description: DesiredScale shows the current desired number of replicas for the revision.
+                  type: integer
+                  format: int32
+                metricsServiceName:
+                  description: |-
+                    MetricsServiceName is the K8s Service name that provides revision metrics.
+                    The service is managed by the PA object.
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                serviceName:
+                  description: |-
+                    ServiceName is the K8s Service name that serves the revision, scaled by this PA.
+                    The service is created and owned by the ServerlessService object owned by this PA.
+                  type: string
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: revisions.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Revision
+    plural: revisions
+    singular: revision
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - rev
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Config Name
+          type: string
+          jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']"
+        - name: Generation
+          type: string # int in string form :(
+          jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+        - name: Actual Replicas
+          type: integer
+          jsonPath: ".status.actualReplicas"
+        - name: Desired Replicas
+          type: integer
+          jsonPath: ".status.desiredReplicas"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Revision is an immutable snapshot of code and configuration.  A revision
+            references a container image. Revisions are created by updates to a
+            Configuration.
+
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: RevisionSpec holds the desired state of the Revision (from the client).
+              type: object
+              required:
+                - containers
+              properties:
+                affinity:
+                  description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                automountServiceAccountToken:
+                  description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                  type: boolean
+                containerConcurrency:
+                  description: |-
+                    ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                    requests per container of the Revision.  Defaults to `0` which means
+                    concurrency to the application is not limited, and the system decides the
+                    target concurrency for the autoscaler.
+                  type: integer
+                  format: int64
+                containers:
+                  description: |-
+                    List of containers belonging to the pod.
+                    Containers cannot currently be added or removed.
+                    There must be at least one container in a Pod.
+                    Cannot be updated.
+                  type: array
+                  items:
+                    description: A single application container that you want to run within a pod.
+                    type: object
+                    properties:
+                      args:
+                        description: |-
+                          Arguments to the entrypoint.
+                          The container image's CMD is used if this is not provided.
+                          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                          of whether the variable exists or not. Cannot be updated.
+                          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                        type: array
+                        items:
+                          type: string
+                        x-kubernetes-list-type: atomic
+                      command:
+                        description: |-
+                          Entrypoint array. Not executed within a shell.
+                          The container image's ENTRYPOINT is used if this is not provided.
+                          Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                          cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                          to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                          produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                          of whether the variable exists or not. Cannot be updated.
+                          More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                        type: array
+                        items:
+                          type: string
+                        x-kubernetes-list-type: atomic
+                      env:
+                        description: |-
+                          List of environment variables to set in the container.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: EnvVar represents an environment variable present in a Container.
+                          type: object
+                          required:
+                            - name
+                          properties:
+                            name:
+                              description: Name of the environment variable. Must be a C_IDENTIFIER.
+                              type: string
+                            value:
+                              description: |-
+                                Variable references $(VAR_NAME) are expanded
+                                using the previously defined environment variables in the container and
+                                any service environment variables. If a variable cannot be resolved,
+                                the reference in the input string will be unchanged. Double $$ are reduced
+                                to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                Escaped references will never be expanded, regardless of whether the variable
+                                exists or not.
+                                Defaults to "".
+                              type: string
+                            valueFrom:
+                              description: Source for the environment variable's value. Cannot be used if value is not empty.
+                              type: object
+                              properties:
+                                configMapKeyRef:
+                                  description: Selects a key of a ConfigMap.
+                                  type: object
+                                  required:
+                                    - key
+                                  properties:
+                                    key:
+                                      description: The key to select.
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: Specify whether the ConfigMap or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                fieldRef:
+                                  description: |-
+                                    This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                  x-kubernetes-preserve-unknown-fields: true
+                                resourceFieldRef:
+                                  description: |-
+                                    This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                  x-kubernetes-preserve-unknown-fields: true
+                                secretKeyRef:
+                                  description: Selects a key of a secret in the pod's namespace
+                                  type: object
+                                  required:
+                                    - key
+                                  properties:
+                                    key:
+                                      description: The key of the secret to select from.  Must be a valid secret key.
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: Specify whether the Secret or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                        x-kubernetes-list-map-keys:
+                          - name
+                        x-kubernetes-list-type: map
+                      envFrom:
+                        description: |-
+                          List of sources to populate environment variables in the container.
+                          The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                          will be reported as an event when the container is starting. When a key exists in multiple
+                          sources, the value associated with the last source will take precedence.
+                          Values defined by an Env with a duplicate key will take precedence.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                          type: object
+                          properties:
+                            configMapRef:
+                              description: The ConfigMap to select from
+                              type: object
+                              properties:
+                                name:
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                  default: ""
+                                optional:
+                                  description: Specify whether the ConfigMap must be defined
+                                  type: boolean
+                              x-kubernetes-map-type: atomic
+                            prefix:
+                              description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                              type: string
+                            secretRef:
+                              description: The Secret to select from
+                              type: object
+                              properties:
+                                name:
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                  default: ""
+                                optional:
+                                  description: Specify whether the Secret must be defined
+                                  type: boolean
+                              x-kubernetes-map-type: atomic
+                        x-kubernetes-list-type: atomic
+                      image:
+                        description: |-
+                          Container image name.
+                          More info: https://kubernetes.io/docs/concepts/containers/images
+                          This field is optional to allow higher level config management to default or override
+                          container images in workload controllers like Deployments and StatefulSets.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Image pull policy.
+                          One of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        type: string
+                      livenessProbe:
+                        description: |-
+                          Periodic probe of container liveness.
+                          Container will be restarted if the probe fails.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      name:
+                        description: |-
+                          Name of the container specified as a DNS_LABEL.
+                          Each container in a pod must have a unique name (DNS_LABEL).
+                          Cannot be updated.
+                        type: string
+                      ports:
+                        description: |-
+                          List of ports to expose from the container. Not specifying a port here
+                          DOES NOT prevent that port from being exposed. Any port which is
+                          listening on the default "0.0.0.0" address inside a container will be
+                          accessible from the network.
+                          Modifying this array with strategic merge patch may corrupt the data.
+                          For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: ContainerPort represents a network port in a single container.
+                          type: object
+                          properties:
+                            containerPort:
+                              description: |-
+                                Number of port to expose on the pod's IP address.
+                                This must be a valid port number, 0 < x < 65536.
+                              type: integer
+                              format: int32
+                            name:
+                              description: |-
+                                If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                named port in a pod must have a unique name. Name for the port that can be
+                                referred to by services.
+                              type: string
+                            protocol:
+                              description: |-
+                                Protocol for port. Must be UDP, TCP, or SCTP.
+                                Defaults to "TCP".
+                              type: string
+                              default: TCP
+                      readinessProbe:
+                        description: |-
+                          Periodic probe of container service readiness.
+                          Container will be removed from service endpoints if the probe fails.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      resources:
+                        description: |-
+                          Compute Resources required by this container.
+                          Cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                        properties:
+                          limits:
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                            additionalProperties:
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              anyOf:
+                                - type: integer
+                                - type: string
+                              x-kubernetes-int-or-string: true
+                          requests:
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                            additionalProperties:
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              anyOf:
+                                - type: integer
+                                - type: string
+                              x-kubernetes-int-or-string: true
+                      securityContext:
+                        description: |-
+                          SecurityContext defines the security options the container should be run with.
+                          If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                          More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                        type: object
+                        properties:
+                          allowPrivilegeEscalation:
+                            description: |-
+                              AllowPrivilegeEscalation controls whether a process can gain more
+                              privileges than its parent process. This bool directly controls if
+                              the no_new_privs flag will be set on the container process.
+                              AllowPrivilegeEscalation is true always when the container is:
+                              1) run as Privileged
+                              2) has CAP_SYS_ADMIN
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: boolean
+                          capabilities:
+                            description: |-
+                              The capabilities to add/drop when running containers.
+                              Defaults to the default set of capabilities granted by the container runtime.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: object
+                            properties:
+                              add:
+                                description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                type: array
+                                items:
+                                  description: Capability represent POSIX capabilities type
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              drop:
+                                description: Removed capabilities
+                                type: array
+                                items:
+                                  description: Capability represent POSIX capabilities type
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          privileged:
+                            description: |-
+                              Run container in privileged mode. This can only be set to explicitly to 'false'
+                            type: boolean
+                          readOnlyRootFilesystem:
+                            description: |-
+                              Whether this container has a read-only root filesystem.
+                              Default is false.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: boolean
+                          runAsGroup:
+                            description: |-
+                              The GID to run the entrypoint of the container process.
+                              Uses runtime default if unset.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: integer
+                            format: int64
+                          runAsNonRoot:
+                            description: |-
+                              Indicates that the container must run as a non-root user.
+                              If true, the Kubelet will validate the image at runtime to ensure that it
+                              does not run as UID 0 (root) and fail to start the container if it does.
+                              If unset or false, no such validation will be performed.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                            type: boolean
+                          runAsUser:
+                            description: |-
+                              The UID to run the entrypoint of the container process.
+                              Defaults to user specified in image metadata if unspecified.
+                              May also be set in PodSecurityContext.  If set in both SecurityContext and
+                              PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: integer
+                            format: int64
+                          seccompProfile:
+                            description: |-
+                              The seccomp options to use by this container. If seccomp options are
+                              provided at both the pod & container level, the container options
+                              override the pod options.
+                              Note that this field cannot be set when spec.os.name is windows.
+                            type: object
+                            required:
+                              - type
+                            properties:
+                              localhostProfile:
+                                description: |-
+                                  localhostProfile indicates a profile defined in a file on the node should be used.
+                                  The profile must be preconfigured on the node to work.
+                                  Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                  Must be set if type is "Localhost". Must NOT be set for any other type.
+                                type: string
+                              type:
+                                description: |-
+                                  type indicates which kind of seccomp profile will be applied.
+                                  Valid options are:
+
+                                  Localhost - a profile defined in a file on the node should be used.
+                                  RuntimeDefault - the container runtime default profile should be used.
+                                  Unconfined - no profile should be applied.
+                                type: string
+                      startupProbe:
+                        description: |-
+                          StartupProbe indicates that the Pod has successfully initialized.
+                          If specified, no other probes are executed until this completes successfully.
+                          If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                          This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                          when it might take a long time to load data or warm a cache, than during steady-state operation.
+                          This cannot be updated.
+                          More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                        type: object
+                        properties:
+                          exec:
+                            description: Exec specifies a command to execute in the container.
+                            type: object
+                            properties:
+                              command:
+                                description: |-
+                                  Command is the command line to execute inside the container, the working directory for the
+                                  command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                  not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                  a shell, you need to explicitly call out to that shell.
+                                  Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                          failureThreshold:
+                            description: |-
+                              Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                              Defaults to 3. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          grpc:
+                            description: GRPC specifies a GRPC HealthCheckRequest.
+                            type: object
+                            properties:
+                              port:
+                                description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                type: integer
+                                format: int32
+                              service:
+                                description: |-
+                                  Service is the name of the service to place in the gRPC HealthCheckRequest
+                                  (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                  If this is not specified, the default behavior is defined by gRPC.
+                                type: string
+                                default: ""
+                          httpGet:
+                            description: HTTPGet specifies an HTTP GET request to perform.
+                            type: object
+                            properties:
+                              host:
+                                description: |-
+                                  Host name to connect to, defaults to the pod IP. You probably want to set
+                                  "Host" in httpHeaders instead.
+                                type: string
+                              httpHeaders:
+                                description: Custom headers to set in the request. HTTP allows repeated headers.
+                                type: array
+                                items:
+                                  description: HTTPHeader describes a custom header to be used in HTTP probes
+                                  type: object
+                                  required:
+                                    - name
+                                    - value
+                                  properties:
+                                    name:
+                                      description: |-
+                                        The header field name.
+                                        This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                      type: string
+                                    value:
+                                      description: The header field value
+                                      type: string
+                                x-kubernetes-list-type: atomic
+                              path:
+                                description: Path to access on the HTTP server.
+                                type: string
+                              port:
+                                description: |-
+                                  Name or number of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                              scheme:
+                                description: |-
+                                  Scheme to use for connecting to the host.
+                                  Defaults to HTTP.
+                                type: string
+                          initialDelaySeconds:
+                            description: |-
+                              Number of seconds after the container has started before liveness probes are initiated.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                          periodSeconds:
+                            description: |-
+                              How often (in seconds) to perform the probe.
+                            type: integer
+                            format: int32
+                          successThreshold:
+                            description: |-
+                              Minimum consecutive successes for the probe to be considered successful after having failed.
+                              Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                            type: integer
+                            format: int32
+                          tcpSocket:
+                            description: TCPSocket specifies a connection to a TCP port.
+                            type: object
+                            properties:
+                              host:
+                                description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                type: string
+                              port:
+                                description: |-
+                                  Number or name of the port to access on the container.
+                                  Number must be in the range 1 to 65535.
+                                  Name must be an IANA_SVC_NAME.
+                                anyOf:
+                                  - type: integer
+                                  - type: string
+                                x-kubernetes-int-or-string: true
+                          timeoutSeconds:
+                            description: |-
+                              Number of seconds after which the probe times out.
+                              Defaults to 1 second. Minimum value is 1.
+                              More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                            type: integer
+                            format: int32
+                      terminationMessagePath:
+                        description: |-
+                          Optional: Path at which the file to which the container's termination message
+                          will be written is mounted into the container's filesystem.
+                          Message written is intended to be brief final status, such as an assertion failure message.
+                          Will be truncated by the node if greater than 4096 bytes. The total message length across
+                          all containers will be limited to 12kb.
+                          Defaults to /dev/termination-log.
+                          Cannot be updated.
+                        type: string
+                      terminationMessagePolicy:
+                        description: |-
+                          Indicate how the termination message should be populated. File will use the contents of
+                          terminationMessagePath to populate the container status message on both success and failure.
+                          FallbackToLogsOnError will use the last chunk of container log output if the termination
+                          message file is empty and the container exited with an error.
+                          The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                          Defaults to File.
+                          Cannot be updated.
+                        type: string
+                      volumeMounts:
+                        description: |-
+                          Pod volumes to mount into the container's filesystem.
+                          Cannot be updated.
+                        type: array
+                        items:
+                          description: VolumeMount describes a mounting of a Volume within a container.
+                          type: object
+                          required:
+                            - mountPath
+                            - name
+                          properties:
+                            mountPath:
+                              description: |-
+                                Path within the container at which the volume should be mounted.  Must
+                                not contain ':'.
+                              type: string
+                            mountPropagation:
+                              description: |-
+                                This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                              type: string
+                            name:
+                              description: This must match the Name of a Volume.
+                              type: string
+                            readOnly:
+                              description: |-
+                                Mounted read-only if true, read-write otherwise (false or unspecified).
+                                Defaults to false.
+                              type: boolean
+                            subPath:
+                              description: |-
+                                Path within the volume from which the container's volume should be mounted.
+                                Defaults to "" (volume's root).
+                              type: string
+                        x-kubernetes-list-map-keys:
+                          - mountPath
+                        x-kubernetes-list-type: map
+                      workingDir:
+                        description: |-
+                          Container's working directory.
+                          If not specified, the container runtime's default will be used, which
+                          might be configured in the container image.
+                          Cannot be updated.
+                        type: string
+                dnsConfig:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                dnsPolicy:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                  type: string
+                enableServiceLinks:
+                  description: |-
+                    EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                  type: boolean
+                hostAliases:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                  type: array
+                  items:
+                    description: |-
+                      This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                hostIPC:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                  type: boolean
+                hostNetwork:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                  type: boolean
+                hostPID:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                  type: boolean
+                idleTimeoutSeconds:
+                  description: |-
+                    IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                    to stay open while not receiving any bytes from the user's application. If
+                    unspecified, a system default will be provided.
+                  type: integer
+                  format: int64
+                imagePullSecrets:
+                  description: |-
+                    ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                    If specified, these secrets will be passed to individual puller implementations for them to use.
+                    More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                  type: array
+                  items:
+                    description: |-
+                      LocalObjectReference contains enough information to let you locate the
+                      referenced object inside the same namespace.
+                    type: object
+                    properties:
+                      name:
+                        description: |-
+                          Name of the referent.
+                          This field is effectively required, but due to backwards compatibility is
+                          allowed to be empty. Instances of this type with an empty value here are
+                          almost certainly wrong.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                        default: ""
+                    x-kubernetes-map-type: atomic
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                initContainers:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                  type: array
+                  items:
+                    description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                nodeSelector:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                  type: object
+                  additionalProperties:
+                    type: string
+                  x-kubernetes-map-type: atomic
+                priorityClassName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                  type: string
+                responseStartTimeoutSeconds:
+                  description: |-
+                    ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                    routing layer will wait for a request delivered to a container to begin
+                    sending any network traffic.
+                  type: integer
+                  format: int64
+                runtimeClassName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                  type: string
+                schedulerName:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                  type: string
+                securityContext:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                serviceAccountName:
+                  description: |-
+                    ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                    More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                  type: string
+                shareProcessNamespace:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                  type: boolean
+                timeoutSeconds:
+                  description: |-
+                    TimeoutSeconds is the maximum duration in seconds that the request instance
+                    is allowed to respond to a request. If unspecified, a system default will
+                    be provided.
+                  type: integer
+                  format: int64
+                tolerations:
+                  description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                  type: array
+                  items:
+                    description: |-
+                      This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                topologySpreadConstraints:
+                  description: |-
+                    This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                  type: array
+                  items:
+                    description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                volumes:
+                  description: |-
+                    List of volumes that can be mounted by containers belonging to the pod.
+                    More info: https://kubernetes.io/docs/concepts/storage/volumes
+                  type: array
+                  items:
+                    description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                    type: object
+                    required:
+                      - name
+                    properties:
+                      configMap:
+                        description: configMap represents a configMap that should populate this volume
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode is optional: mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                              Defaults to 0644.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          items:
+                            description: |-
+                              items if unspecified, each key-value pair in the Data field of the referenced
+                              ConfigMap will be projected into the volume as a file whose name is the
+                              key and content is the value. If specified, the listed keys will be
+                              projected into the specified paths, and unlisted keys will not be
+                              present. If a key is specified which is not present in the ConfigMap,
+                              the volume setup will error unless it is marked optional. Paths must be
+                              relative and may not contain the '..' path or start with '..'.
+                            type: array
+                            items:
+                              description: Maps a string key to a path within a volume.
+                              type: object
+                              required:
+                                - key
+                                - path
+                              properties:
+                                key:
+                                  description: key is the key to project.
+                                  type: string
+                                mode:
+                                  description: |-
+                                    mode is Optional: mode bits used to set permissions on this file.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    If not specified, the volume defaultMode will be used.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  type: integer
+                                  format: int32
+                                path:
+                                  description: |-
+                                    path is the relative path of the file to map the key to.
+                                    May not be an absolute path.
+                                    May not contain the path element '..'.
+                                    May not start with the string '..'.
+                                  type: string
+                            x-kubernetes-list-type: atomic
+                          name:
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                            default: ""
+                          optional:
+                            description: optional specify whether the ConfigMap or its keys must be defined
+                            type: boolean
+                        x-kubernetes-map-type: atomic
+                      csi:
+                        description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      emptyDir:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      hostPath:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      image:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      name:
+                        description: |-
+                          name of the volume.
+                          Must be a DNS_LABEL and unique within the pod.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                      persistentVolumeClaim:
+                        description: |-
+                          This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                      projected:
+                        description: projected items for all in one resources secrets, configmaps, and downward API
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode are the mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          sources:
+                            description: |-
+                              sources is the list of volume projections. Each entry in this list
+                              handles one source.
+                            type: array
+                            items:
+                              description: |-
+                                Projection that may be projected along with other supported volume types.
+                                Exactly one of these fields must be set.
+                              type: object
+                              properties:
+                                configMap:
+                                  description: configMap information about the configMap data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: |-
+                                        items if unspecified, each key-value pair in the Data field of the referenced
+                                        ConfigMap will be projected into the volume as a file whose name is the
+                                        key and content is the value. If specified, the listed keys will be
+                                        projected into the specified paths, and unlisted keys will not be
+                                        present. If a key is specified which is not present in the ConfigMap,
+                                        the volume setup will error unless it is marked optional. Paths must be
+                                        relative and may not contain the '..' path or start with '..'.
+                                      type: array
+                                      items:
+                                        description: Maps a string key to a path within a volume.
+                                        type: object
+                                        required:
+                                          - key
+                                          - path
+                                        properties:
+                                          key:
+                                            description: key is the key to project.
+                                            type: string
+                                          mode:
+                                            description: |-
+                                              mode is Optional: mode bits used to set permissions on this file.
+                                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: |-
+                                              path is the relative path of the file to map the key to.
+                                              May not be an absolute path.
+                                              May not contain the path element '..'.
+                                              May not start with the string '..'.
+                                            type: string
+                                      x-kubernetes-list-type: atomic
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: optional specify whether the ConfigMap or its keys must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                downwardAPI:
+                                  description: downwardAPI information about the downwardAPI data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: Items is a list of DownwardAPIVolume file
+                                      type: array
+                                      items:
+                                        description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                        type: object
+                                        required:
+                                          - path
+                                        properties:
+                                          fieldRef:
+                                            description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                            type: object
+                                            required:
+                                              - fieldPath
+                                            properties:
+                                              apiVersion:
+                                                description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                type: string
+                                              fieldPath:
+                                                description: Path of the field to select in the specified API version.
+                                                type: string
+                                            x-kubernetes-map-type: atomic
+                                          mode:
+                                            description: |-
+                                              Optional: mode bits used to set permissions on this file, must be an octal value
+                                              between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                            type: string
+                                          resourceFieldRef:
+                                            description: |-
+                                              Selects a resource of the container: only resources limits and requests
+                                              (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                            type: object
+                                            required:
+                                              - resource
+                                            properties:
+                                              containerName:
+                                                description: 'Container name: required for volumes, optional for env vars'
+                                                type: string
+                                              divisor:
+                                                description: Specifies the output format of the exposed resources, defaults to "1"
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                anyOf:
+                                                  - type: integer
+                                                  - type: string
+                                                x-kubernetes-int-or-string: true
+                                              resource:
+                                                description: 'Required: resource to select'
+                                                type: string
+                                            x-kubernetes-map-type: atomic
+                                      x-kubernetes-list-type: atomic
+                                secret:
+                                  description: secret information about the secret data to project
+                                  type: object
+                                  properties:
+                                    items:
+                                      description: |-
+                                        items if unspecified, each key-value pair in the Data field of the referenced
+                                        Secret will be projected into the volume as a file whose name is the
+                                        key and content is the value. If specified, the listed keys will be
+                                        projected into the specified paths, and unlisted keys will not be
+                                        present. If a key is specified which is not present in the Secret,
+                                        the volume setup will error unless it is marked optional. Paths must be
+                                        relative and may not contain the '..' path or start with '..'.
+                                      type: array
+                                      items:
+                                        description: Maps a string key to a path within a volume.
+                                        type: object
+                                        required:
+                                          - key
+                                          - path
+                                        properties:
+                                          key:
+                                            description: key is the key to project.
+                                            type: string
+                                          mode:
+                                            description: |-
+                                              mode is Optional: mode bits used to set permissions on this file.
+                                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                              YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                              If not specified, the volume defaultMode will be used.
+                                              This might be in conflict with other options that affect the file
+                                              mode, like fsGroup, and the result can be other mode bits set.
+                                            type: integer
+                                            format: int32
+                                          path:
+                                            description: |-
+                                              path is the relative path of the file to map the key to.
+                                              May not be an absolute path.
+                                              May not contain the path element '..'.
+                                              May not start with the string '..'.
+                                            type: string
+                                      x-kubernetes-list-type: atomic
+                                    name:
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                      default: ""
+                                    optional:
+                                      description: optional field specify whether the Secret or its key must be defined
+                                      type: boolean
+                                  x-kubernetes-map-type: atomic
+                                serviceAccountToken:
+                                  description: serviceAccountToken is information about the serviceAccountToken data to project
+                                  type: object
+                                  required:
+                                    - path
+                                  properties:
+                                    audience:
+                                      description: |-
+                                        audience is the intended audience of the token. A recipient of a token
+                                        must identify itself with an identifier specified in the audience of the
+                                        token, and otherwise should reject the token. The audience defaults to the
+                                        identifier of the apiserver.
+                                      type: string
+                                    expirationSeconds:
+                                      description: |-
+                                        expirationSeconds is the requested duration of validity of the service
+                                        account token. As the token approaches expiration, the kubelet volume
+                                        plugin will proactively rotate the service account token. The kubelet will
+                                        start trying to rotate the token if the token is older than 80 percent of
+                                        its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                        and must be at least 10 minutes.
+                                      type: integer
+                                      format: int64
+                                    path:
+                                      description: |-
+                                        path is the path relative to the mount point of the file to project the
+                                        token into.
+                                      type: string
+                            x-kubernetes-list-type: atomic
+                      secret:
+                        description: |-
+                          secret represents a secret that should populate this volume.
+                          More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                        type: object
+                        properties:
+                          defaultMode:
+                            description: |-
+                              defaultMode is Optional: mode bits used to set permissions on created files by default.
+                              Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                              YAML accepts both octal and decimal values, JSON requires decimal values
+                              for mode bits. Defaults to 0644.
+                              Directories within the path are not affected by this setting.
+                              This might be in conflict with other options that affect the file
+                              mode, like fsGroup, and the result can be other mode bits set.
+                            type: integer
+                            format: int32
+                          items:
+                            description: |-
+                              items If unspecified, each key-value pair in the Data field of the referenced
+                              Secret will be projected into the volume as a file whose name is the
+                              key and content is the value. If specified, the listed keys will be
+                              projected into the specified paths, and unlisted keys will not be
+                              present. If a key is specified which is not present in the Secret,
+                              the volume setup will error unless it is marked optional. Paths must be
+                              relative and may not contain the '..' path or start with '..'.
+                            type: array
+                            items:
+                              description: Maps a string key to a path within a volume.
+                              type: object
+                              required:
+                                - key
+                                - path
+                              properties:
+                                key:
+                                  description: key is the key to project.
+                                  type: string
+                                mode:
+                                  description: |-
+                                    mode is Optional: mode bits used to set permissions on this file.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    If not specified, the volume defaultMode will be used.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  type: integer
+                                  format: int32
+                                path:
+                                  description: |-
+                                    path is the relative path of the file to map the key to.
+                                    May not be an absolute path.
+                                    May not contain the path element '..'.
+                                    May not start with the string '..'.
+                                  type: string
+                            x-kubernetes-list-type: atomic
+                          optional:
+                            description: optional field specify whether the Secret or its keys must be defined
+                            type: boolean
+                          secretName:
+                            description: |-
+                              secretName is the name of the secret in the pod's namespace to use.
+                              More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                            type: string
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+            status:
+              description: RevisionStatus communicates the observed state of the Revision (from the controller).
+              type: object
+              properties:
+                actualReplicas:
+                  description: ActualReplicas reflects the amount of ready pods running this revision.
+                  type: integer
+                  format: int32
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                containerStatuses:
+                  description: |-
+                    ContainerStatuses is a slice of images present in .Spec.Container[*].Image
+                    to their respective digests and their container name.
+                    The digests are resolved during the creation of Revision.
+                    ContainerStatuses holds the container name and image digests
+                    for both serving and non serving containers.
+                    ref: http://bit.ly/image-digests
+                  type: array
+                  items:
+                    description: ContainerStatus holds the information of container name and image digest value
+                    type: object
+                    properties:
+                      imageDigest:
+                        type: string
+                      name:
+                        type: string
+                desiredReplicas:
+                  description: DesiredReplicas reflects the desired amount of pods running this revision.
+                  type: integer
+                  format: int32
+                initContainerStatuses:
+                  description: |-
+                    InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image
+                    to their respective digests and their container name.
+                    The digests are resolved during the creation of Revision.
+                    ContainerStatuses holds the container name and image digests
+                    for both serving and non serving containers.
+                    ref: http://bit.ly/image-digests
+                  type: array
+                  items:
+                    description: ContainerStatus holds the information of container name and image digest value
+                    type: object
+                    properties:
+                      imageDigest:
+                        type: string
+                      name:
+                        type: string
+                logUrl:
+                  description: |-
+                    LogURL specifies the generated logging url for this particular revision
+                    based on the revision url template specified in the controller's config.
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: routes.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/addressable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Route
+    plural: routes
+    singular: route
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - rt
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Route is responsible for configuring ingress over a collection of Revisions.
+            Some of the Revisions a Route distributes traffic over may be specified by
+            referencing the Configuration responsible for creating them; in these cases
+            the Route is additionally responsible for monitoring the Configuration for
+            "latest ready revision" changes, and smoothly rolling out latest revisions.
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Spec holds the desired state of the Route (from the client).
+              type: object
+              properties:
+                traffic:
+                  description: |-
+                    Traffic specifies how to distribute traffic over a collection of
+                    revisions and configurations.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+            status:
+              description: Status communicates the observed state of the Route (from the controller).
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a Route to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                traffic:
+                  description: |-
+                    Traffic holds the configured traffic distribution.
+                    These entries will always contain RevisionName references.
+                    When ConfigurationName appears in the spec, this will hold the
+                    LatestReadyRevisionName that we last observed.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+                url:
+                  description: |-
+                    URL holds the url that will distribute traffic over the provided traffic targets.
+                    It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}
+                  type: string
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serverlessservices.networking.internal.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+spec:
+  group: networking.internal.knative.dev
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          description: |-
+            ServerlessService is a proxy for the K8s service objects containing the
+            endpoints for the revision, whether those are endpoints of the activator or
+            revision pods.
+            See: https://knative.page.link/naxz for details.
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec is the desired state of the ServerlessService.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              required:
+                - objectRef
+                - protocolType
+              properties:
+                mode:
+                  description: Mode describes the mode of operation of the ServerlessService.
+                  type: string
+                numActivators:
+                  description: |-
+                    NumActivators contains number of Activators that this revision should be
+                    assigned.
+                    O means — assign all.
+                  type: integer
+                  format: int32
+                objectRef:
+                  description: |-
+                    ObjectRef defines the resource that this ServerlessService
+                    is responsible for making "serverless".
+                  type: object
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    fieldPath:
+                      description: |-
+                        If referring to a piece of an object instead of an entire object, this string
+                        should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
+                        For example, if the object reference is to a container within a pod, this would take on a value like:
+                        "spec.containers{name}" (where "name" refers to the name of the container that triggered
+                        the event) or if no container name is specified "spec.containers[2]" (container with
+                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
+                        referencing a part of an object.
+                      type: string
+                    kind:
+                      description: |-
+                        Kind of the referent.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                      type: string
+                    name:
+                      description: |-
+                        Name of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      type: string
+                    namespace:
+                      description: |-
+                        Namespace of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+                      type: string
+                    resourceVersion:
+                      description: |-
+                        Specific resourceVersion to which this reference is made, if any.
+                        More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+                      type: string
+                    uid:
+                      description: |-
+                        UID of the referent.
+                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+                      type: string
+                  x-kubernetes-map-type: atomic
+                protocolType:
+                  description: |-
+                    The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision.
+                    serving imports networking, so just use string.
+                  type: string
+            status:
+              description: |-
+                Status is the current state of the ServerlessService.
+                More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                privateServiceName:
+                  description: |-
+                    PrivateServiceName holds the name of a core K8s Service resource that
+                    load balances over the user service pods backing this Revision.
+                  type: string
+                serviceName:
+                  description: |-
+                    ServiceName holds the name of a core K8s Service resource that
+                    load balances over the pods backing this Revision (activator or revision).
+                  type: string
+      additionalPrinterColumns:
+        - name: Mode
+          type: string
+          jsonPath: ".spec.mode"
+        - name: Activators
+          type: integer
+          jsonPath: ".spec.numActivators"
+        - name: ServiceName
+          type: string
+          jsonPath: ".status.serviceName"
+        - name: PrivateServiceName
+          type: string
+          jsonPath: ".status.privateServiceName"
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+  names:
+    kind: ServerlessService
+    plural: serverlessservices
+    singular: serverlessservice
+    categories:
+      - knative-internal
+      - networking
+    shortNames:
+      - sks
+  scope: Namespaced
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: services.serving.knative.dev
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+    knative.dev/crd-install: "true"
+    duck.knative.dev/addressable: "true"
+    duck.knative.dev/podspecable: "true"
+spec:
+  group: serving.knative.dev
+  names:
+    kind: Service
+    plural: services
+    singular: service
+    categories:
+      - all
+      - knative
+      - serving
+    shortNames:
+      - kservice
+      - ksvc
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: URL
+          type: string
+          jsonPath: .status.url
+        - name: LatestCreated
+          type: string
+          jsonPath: .status.latestCreatedRevisionName
+        - name: LatestReady
+          type: string
+          jsonPath: .status.latestReadyRevisionName
+        - name: Ready
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
+        - name: Reason
+          type: string
+          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Service acts as a top-level container that manages a Route and Configuration
+            which implement a network service. Service exists to provide a singular
+            abstraction which can be access controlled, reasoned about, and which
+            encapsulates software lifecycle decisions such as rollout policy and
+            team resource ownership. Service acts only as an orchestrator of the
+            underlying Routes and Configurations (much as a kubernetes Deployment
+            orchestrates ReplicaSets), and its usage is optional but recommended.
+
+            The Service's controller will track the statuses of its owned Configuration
+            and Route, reflecting their statuses and conditions as its own.
+
+            See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service
+          type: object
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                ServiceSpec represents the configuration for the Service object.
+                A Service's specification is the union of the specifications for a Route
+                and Configuration.  The Service restricts what can be expressed in these
+                fields, e.g. the Route must reference the provided Configuration;
+                however, these limitations also enable friendlier defaulting,
+                e.g. Route never needs a Configuration name, and may be defaulted to
+                the appropriate "run latest" spec.
+              type: object
+              properties:
+                template:
+                  description: Template holds the latest specification for the Revision to be stamped out.
+                  type: object
+                  properties:
+                    metadata:
+                      type: object
+                      properties:
+                        annotations:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        finalizers:
+                          type: array
+                          items:
+                            type: string
+                        labels:
+                          type: object
+                          additionalProperties:
+                            type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      x-kubernetes-preserve-unknown-fields: true
+                    spec:
+                      description: RevisionSpec holds the desired state of the Revision (from the client).
+                      type: object
+                      required:
+                        - containers
+                      properties:
+                        affinity:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-affinity
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        automountServiceAccountToken:
+                          description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
+                          type: boolean
+                        containerConcurrency:
+                          description: |-
+                            ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+                            requests per container of the Revision.  Defaults to `0` which means
+                            concurrency to the application is not limited, and the system decides the
+                            target concurrency for the autoscaler.
+                          type: integer
+                          format: int64
+                        containers:
+                          description: |-
+                            List of containers belonging to the pod.
+                            Containers cannot currently be added or removed.
+                            There must be at least one container in a Pod.
+                            Cannot be updated.
+                          type: array
+                          items:
+                            description: A single application container that you want to run within a pod.
+                            type: object
+                            properties:
+                              args:
+                                description: |-
+                                  Arguments to the entrypoint.
+                                  The container image's CMD is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              command:
+                                description: |-
+                                  Entrypoint array. Not executed within a shell.
+                                  The container image's ENTRYPOINT is used if this is not provided.
+                                  Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+                                  cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+                                  to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+                                  produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+                                  of whether the variable exists or not. Cannot be updated.
+                                  More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+                                type: array
+                                items:
+                                  type: string
+                                x-kubernetes-list-type: atomic
+                              env:
+                                description: |-
+                                  List of environment variables to set in the container.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvVar represents an environment variable present in a Container.
+                                  type: object
+                                  required:
+                                    - name
+                                  properties:
+                                    name:
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    value:
+                                      description: |-
+                                        Variable references $(VAR_NAME) are expanded
+                                        using the previously defined environment variables in the container and
+                                        any service environment variables. If a variable cannot be resolved,
+                                        the reference in the input string will be unchanged. Double $$ are reduced
+                                        to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+                                        "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+                                        Escaped references will never be expanded, regardless of whether the variable
+                                        exists or not.
+                                        Defaults to "".
+                                      type: string
+                                    valueFrom:
+                                      description: Source for the environment variable's value. Cannot be used if value is not empty.
+                                      type: object
+                                      properties:
+                                        configMapKeyRef:
+                                          description: Selects a key of a ConfigMap.
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key to select.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the ConfigMap or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        fieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        resourceFieldRef:
+                                          description: |-
+                                            This is accessible behind a feature flag - kubernetes.podspec-fieldref
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                          x-kubernetes-preserve-unknown-fields: true
+                                        secretKeyRef:
+                                          description: Selects a key of a secret in the pod's namespace
+                                          type: object
+                                          required:
+                                            - key
+                                          properties:
+                                            key:
+                                              description: The key of the secret to select from.  Must be a valid secret key.
+                                              type: string
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: Specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                x-kubernetes-list-map-keys:
+                                  - name
+                                x-kubernetes-list-type: map
+                              envFrom:
+                                description: |-
+                                  List of sources to populate environment variables in the container.
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
+                                  sources, the value associated with the last source will take precedence.
+                                  Values defined by an Env with a duplicate key will take precedence.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  type: object
+                                  properties:
+                                    configMapRef:
+                                      description: The ConfigMap to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the ConfigMap must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                    prefix:
+                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      type: string
+                                    secretRef:
+                                      description: The Secret to select from
+                                      type: object
+                                      properties:
+                                        name:
+                                          description: |-
+                                            Name of the referent.
+                                            This field is effectively required, but due to backwards compatibility is
+                                            allowed to be empty. Instances of this type with an empty value here are
+                                            almost certainly wrong.
+                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                          type: string
+                                          default: ""
+                                        optional:
+                                          description: Specify whether the Secret must be defined
+                                          type: boolean
+                                      x-kubernetes-map-type: atomic
+                                x-kubernetes-list-type: atomic
+                              image:
+                                description: |-
+                                  Container image name.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images
+                                  This field is optional to allow higher level config management to default or override
+                                  container images in workload controllers like Deployments and StatefulSets.
+                                type: string
+                              imagePullPolicy:
+                                description: |-
+                                  Image pull policy.
+                                  One of Always, Never, IfNotPresent.
+                                  Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                                type: string
+                              livenessProbe:
+                                description: |-
+                                  Periodic probe of container liveness.
+                                  Container will be restarted if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              name:
+                                description: |-
+                                  Name of the container specified as a DNS_LABEL.
+                                  Each container in a pod must have a unique name (DNS_LABEL).
+                                  Cannot be updated.
+                                type: string
+                              ports:
+                                description: |-
+                                  List of ports to expose from the container. Not specifying a port here
+                                  DOES NOT prevent that port from being exposed. Any port which is
+                                  listening on the default "0.0.0.0" address inside a container will be
+                                  accessible from the network.
+                                  Modifying this array with strategic merge patch may corrupt the data.
+                                  For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: ContainerPort represents a network port in a single container.
+                                  type: object
+                                  properties:
+                                    containerPort:
+                                      description: |-
+                                        Number of port to expose on the pod's IP address.
+                                        This must be a valid port number, 0 < x < 65536.
+                                      type: integer
+                                      format: int32
+                                    name:
+                                      description: |-
+                                        If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+                                        named port in a pod must have a unique name. Name for the port that can be
+                                        referred to by services.
+                                      type: string
+                                    protocol:
+                                      description: |-
+                                        Protocol for port. Must be UDP, TCP, or SCTP.
+                                        Defaults to "TCP".
+                                      type: string
+                                      default: TCP
+                              readinessProbe:
+                                description: |-
+                                  Periodic probe of container service readiness.
+                                  Container will be removed from service endpoints if the probe fails.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              resources:
+                                description: |-
+                                  Compute Resources required by this container.
+                                  Cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                type: object
+                                properties:
+                                  limits:
+                                    description: |-
+                                      Limits describes the maximum amount of compute resources allowed.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                                  requests:
+                                    description: |-
+                                      Requests describes the minimum amount of compute resources required.
+                                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    type: object
+                                    additionalProperties:
+                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                      anyOf:
+                                        - type: integer
+                                        - type: string
+                                      x-kubernetes-int-or-string: true
+                              securityContext:
+                                description: |-
+                                  SecurityContext defines the security options the container should be run with.
+                                  If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+                                  More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+                                type: object
+                                properties:
+                                  allowPrivilegeEscalation:
+                                    description: |-
+                                      AllowPrivilegeEscalation controls whether a process can gain more
+                                      privileges than its parent process. This bool directly controls if
+                                      the no_new_privs flag will be set on the container process.
+                                      AllowPrivilegeEscalation is true always when the container is:
+                                      1) run as Privileged
+                                      2) has CAP_SYS_ADMIN
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  capabilities:
+                                    description: |-
+                                      The capabilities to add/drop when running containers.
+                                      Defaults to the default set of capabilities granted by the container runtime.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    properties:
+                                      add:
+                                        description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      drop:
+                                        description: Removed capabilities
+                                        type: array
+                                        items:
+                                          description: Capability represent POSIX capabilities type
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  privileged:
+                                    description: |-
+                                      Run container in privileged mode. This can only be set to explicitly to 'false'
+                                    type: boolean
+                                  readOnlyRootFilesystem:
+                                    description: |-
+                                      Whether this container has a read-only root filesystem.
+                                      Default is false.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: boolean
+                                  runAsGroup:
+                                    description: |-
+                                      The GID to run the entrypoint of the container process.
+                                      Uses runtime default if unset.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  runAsNonRoot:
+                                    description: |-
+                                      Indicates that the container must run as a non-root user.
+                                      If true, the Kubelet will validate the image at runtime to ensure that it
+                                      does not run as UID 0 (root) and fail to start the container if it does.
+                                      If unset or false, no such validation will be performed.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                    type: boolean
+                                  runAsUser:
+                                    description: |-
+                                      The UID to run the entrypoint of the container process.
+                                      Defaults to user specified in image metadata if unspecified.
+                                      May also be set in PodSecurityContext.  If set in both SecurityContext and
+                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: integer
+                                    format: int64
+                                  seccompProfile:
+                                    description: |-
+                                      The seccomp options to use by this container. If seccomp options are
+                                      provided at both the pod & container level, the container options
+                                      override the pod options.
+                                      Note that this field cannot be set when spec.os.name is windows.
+                                    type: object
+                                    required:
+                                      - type
+                                    properties:
+                                      localhostProfile:
+                                        description: |-
+                                          localhostProfile indicates a profile defined in a file on the node should be used.
+                                          The profile must be preconfigured on the node to work.
+                                          Must be a descending path, relative to the kubelet's configured seccomp profile location.
+                                          Must be set if type is "Localhost". Must NOT be set for any other type.
+                                        type: string
+                                      type:
+                                        description: |-
+                                          type indicates which kind of seccomp profile will be applied.
+                                          Valid options are:
+
+                                          Localhost - a profile defined in a file on the node should be used.
+                                          RuntimeDefault - the container runtime default profile should be used.
+                                          Unconfined - no profile should be applied.
+                                        type: string
+                              startupProbe:
+                                description: |-
+                                  StartupProbe indicates that the Pod has successfully initialized.
+                                  If specified, no other probes are executed until this completes successfully.
+                                  If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+                                  This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+                                  when it might take a long time to load data or warm a cache, than during steady-state operation.
+                                  This cannot be updated.
+                                  More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                type: object
+                                properties:
+                                  exec:
+                                    description: Exec specifies a command to execute in the container.
+                                    type: object
+                                    properties:
+                                      command:
+                                        description: |-
+                                          Command is the command line to execute inside the container, the working directory for the
+                                          command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
+                                          not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+                                          a shell, you need to explicitly call out to that shell.
+                                          Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                  failureThreshold:
+                                    description: |-
+                                      Minimum consecutive failures for the probe to be considered failed after having succeeded.
+                                      Defaults to 3. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  grpc:
+                                    description: GRPC specifies a GRPC HealthCheckRequest.
+                                    type: object
+                                    properties:
+                                      port:
+                                        description: Port number of the gRPC service. Number must be in the range 1 to 65535.
+                                        type: integer
+                                        format: int32
+                                      service:
+                                        description: |-
+                                          Service is the name of the service to place in the gRPC HealthCheckRequest
+                                          (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+                                          If this is not specified, the default behavior is defined by gRPC.
+                                        type: string
+                                        default: ""
+                                  httpGet:
+                                    description: HTTPGet specifies an HTTP GET request to perform.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: |-
+                                          Host name to connect to, defaults to the pod IP. You probably want to set
+                                          "Host" in httpHeaders instead.
+                                        type: string
+                                      httpHeaders:
+                                        description: Custom headers to set in the request. HTTP allows repeated headers.
+                                        type: array
+                                        items:
+                                          description: HTTPHeader describes a custom header to be used in HTTP probes
+                                          type: object
+                                          required:
+                                            - name
+                                            - value
+                                          properties:
+                                            name:
+                                              description: |-
+                                                The header field name.
+                                                This will be canonicalized upon output, so case-variant names will be understood as the same header.
+                                              type: string
+                                            value:
+                                              description: The header field value
+                                              type: string
+                                        x-kubernetes-list-type: atomic
+                                      path:
+                                        description: Path to access on the HTTP server.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Name or number of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                      scheme:
+                                        description: |-
+                                          Scheme to use for connecting to the host.
+                                          Defaults to HTTP.
+                                        type: string
+                                  initialDelaySeconds:
+                                    description: |-
+                                      Number of seconds after the container has started before liveness probes are initiated.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                                  periodSeconds:
+                                    description: |-
+                                      How often (in seconds) to perform the probe.
+                                    type: integer
+                                    format: int32
+                                  successThreshold:
+                                    description: |-
+                                      Minimum consecutive successes for the probe to be considered successful after having failed.
+                                      Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+                                    type: integer
+                                    format: int32
+                                  tcpSocket:
+                                    description: TCPSocket specifies a connection to a TCP port.
+                                    type: object
+                                    properties:
+                                      host:
+                                        description: 'Optional: Host name to connect to, defaults to the pod IP.'
+                                        type: string
+                                      port:
+                                        description: |-
+                                          Number or name of the port to access on the container.
+                                          Number must be in the range 1 to 65535.
+                                          Name must be an IANA_SVC_NAME.
+                                        anyOf:
+                                          - type: integer
+                                          - type: string
+                                        x-kubernetes-int-or-string: true
+                                  timeoutSeconds:
+                                    description: |-
+                                      Number of seconds after which the probe times out.
+                                      Defaults to 1 second. Minimum value is 1.
+                                      More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+                                    type: integer
+                                    format: int32
+                              terminationMessagePath:
+                                description: |-
+                                  Optional: Path at which the file to which the container's termination message
+                                  will be written is mounted into the container's filesystem.
+                                  Message written is intended to be brief final status, such as an assertion failure message.
+                                  Will be truncated by the node if greater than 4096 bytes. The total message length across
+                                  all containers will be limited to 12kb.
+                                  Defaults to /dev/termination-log.
+                                  Cannot be updated.
+                                type: string
+                              terminationMessagePolicy:
+                                description: |-
+                                  Indicate how the termination message should be populated. File will use the contents of
+                                  terminationMessagePath to populate the container status message on both success and failure.
+                                  FallbackToLogsOnError will use the last chunk of container log output if the termination
+                                  message file is empty and the container exited with an error.
+                                  The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+                                  Defaults to File.
+                                  Cannot be updated.
+                                type: string
+                              volumeMounts:
+                                description: |-
+                                  Pod volumes to mount into the container's filesystem.
+                                  Cannot be updated.
+                                type: array
+                                items:
+                                  description: VolumeMount describes a mounting of a Volume within a container.
+                                  type: object
+                                  required:
+                                    - mountPath
+                                    - name
+                                  properties:
+                                    mountPath:
+                                      description: |-
+                                        Path within the container at which the volume should be mounted.  Must
+                                        not contain ':'.
+                                      type: string
+                                    mountPropagation:
+                                      description: |-
+                                        This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation
+                                      type: string
+                                    name:
+                                      description: This must match the Name of a Volume.
+                                      type: string
+                                    readOnly:
+                                      description: |-
+                                        Mounted read-only if true, read-write otherwise (false or unspecified).
+                                        Defaults to false.
+                                      type: boolean
+                                    subPath:
+                                      description: |-
+                                        Path within the volume from which the container's volume should be mounted.
+                                        Defaults to "" (volume's root).
+                                      type: string
+                                x-kubernetes-list-map-keys:
+                                  - mountPath
+                                x-kubernetes-list-type: map
+                              workingDir:
+                                description: |-
+                                  Container's working directory.
+                                  If not specified, the container runtime's default will be used, which
+                                  might be configured in the container image.
+                                  Cannot be updated.
+                                type: string
+                        dnsConfig:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnsconfig
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        dnsPolicy:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-dnspolicy
+                          type: string
+                        enableServiceLinks:
+                          description: |-
+                            EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.
+                          type: boolean
+                        hostAliases:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-hostaliases
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        hostIPC:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostipc
+                          type: boolean
+                        hostNetwork:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostnetwork
+                          type: boolean
+                        hostPID:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-hostpid
+                          type: boolean
+                        idleTimeoutSeconds:
+                          description: |-
+                            IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed
+                            to stay open while not receiving any bytes from the user's application. If
+                            unspecified, a system default will be provided.
+                          type: integer
+                          format: int64
+                        imagePullSecrets:
+                          description: |-
+                            ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
+                            If specified, these secrets will be passed to individual puller implementations for them to use.
+                            More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+                          type: array
+                          items:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            type: object
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                                default: ""
+                            x-kubernetes-map-type: atomic
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                        initContainers:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-init-containers
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        nodeSelector:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-nodeselector
+                          type: object
+                          additionalProperties:
+                            type: string
+                          x-kubernetes-map-type: atomic
+                        priorityClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-priorityclassname
+                          type: string
+                        responseStartTimeoutSeconds:
+                          description: |-
+                            ResponseStartTimeoutSeconds is the maximum duration in seconds that the request
+                            routing layer will wait for a request delivered to a container to begin
+                            sending any network traffic.
+                          type: integer
+                          format: int64
+                        runtimeClassName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname
+                          type: string
+                        schedulerName:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-schedulername
+                          type: string
+                        securityContext:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-securitycontext
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                        serviceAccountName:
+                          description: |-
+                            ServiceAccountName is the name of the ServiceAccount to use to run this pod.
+                            More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+                          type: string
+                        shareProcessNamespace:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace
+                          type: boolean
+                        timeoutSeconds:
+                          description: |-
+                            TimeoutSeconds is the maximum duration in seconds that the request instance
+                            is allowed to respond to a request. If unspecified, a system default will
+                            be provided.
+                          type: integer
+                          format: int64
+                        tolerations:
+                          description: This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                          type: array
+                          items:
+                            description: |-
+                              This is accessible behind a feature flag - kubernetes.podspec-tolerations
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        topologySpreadConstraints:
+                          description: |-
+                            This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                          type: array
+                          items:
+                            description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints
+                            type: object
+                            x-kubernetes-preserve-unknown-fields: true
+                        volumes:
+                          description: |-
+                            List of volumes that can be mounted by containers belonging to the pod.
+                            More info: https://kubernetes.io/docs/concepts/storage/volumes
+                          type: array
+                          items:
+                            description: Volume represents a named volume in a pod that may be accessed by any container in the pod.
+                            type: object
+                            required:
+                              - name
+                            properties:
+                              configMap:
+                                description: configMap represents a configMap that should populate this volume
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items if unspecified, each key-value pair in the Data field of the referenced
+                                      ConfigMap will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the ConfigMap,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  name:
+                                    description: |-
+                                      Name of the referent.
+                                      This field is effectively required, but due to backwards compatibility is
+                                      allowed to be empty. Instances of this type with an empty value here are
+                                      almost certainly wrong.
+                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                    type: string
+                                    default: ""
+                                  optional:
+                                    description: optional specify whether the ConfigMap or its keys must be defined
+                                    type: boolean
+                                x-kubernetes-map-type: atomic
+                              csi:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              emptyDir:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              image:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-volumes-image
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              name:
+                                description: |-
+                                  name of the volume.
+                                  Must be a DNS_LABEL and unique within the pod.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                type: string
+                              persistentVolumeClaim:
+                                description: |-
+                                  This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
+                              projected:
+                                description: projected items for all in one resources secrets, configmaps, and downward API
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode are the mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  sources:
+                                    description: |-
+                                      sources is the list of volume projections. Each entry in this list
+                                      handles one source.
+                                    type: array
+                                    items:
+                                      description: |-
+                                        Projection that may be projected along with other supported volume types.
+                                        Exactly one of these fields must be set.
+                                      type: object
+                                      properties:
+                                        configMap:
+                                          description: configMap information about the configMap data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                ConfigMap will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the ConfigMap,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional specify whether the ConfigMap or its keys must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        downwardAPI:
+                                          description: downwardAPI information about the downwardAPI data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: Items is a list of DownwardAPIVolume file
+                                              type: array
+                                              items:
+                                                description: DownwardAPIVolumeFile represents information to create the file containing the pod field
+                                                type: object
+                                                required:
+                                                  - path
+                                                properties:
+                                                  fieldRef:
+                                                    description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.'
+                                                    type: object
+                                                    required:
+                                                      - fieldPath
+                                                    properties:
+                                                      apiVersion:
+                                                        description: Version of the schema the FieldPath is written in terms of, defaults to "v1".
+                                                        type: string
+                                                      fieldPath:
+                                                        description: Path of the field to select in the specified API version.
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                                  mode:
+                                                    description: |-
+                                                      Optional: mode bits used to set permissions on this file, must be an octal value
+                                                      between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: 'Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..'''
+                                                    type: string
+                                                  resourceFieldRef:
+                                                    description: |-
+                                                      Selects a resource of the container: only resources limits and requests
+                                                      (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                    type: object
+                                                    required:
+                                                      - resource
+                                                    properties:
+                                                      containerName:
+                                                        description: 'Container name: required for volumes, optional for env vars'
+                                                        type: string
+                                                      divisor:
+                                                        description: Specifies the output format of the exposed resources, defaults to "1"
+                                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                        anyOf:
+                                                          - type: integer
+                                                          - type: string
+                                                        x-kubernetes-int-or-string: true
+                                                      resource:
+                                                        description: 'Required: resource to select'
+                                                        type: string
+                                                    x-kubernetes-map-type: atomic
+                                              x-kubernetes-list-type: atomic
+                                        secret:
+                                          description: secret information about the secret data to project
+                                          type: object
+                                          properties:
+                                            items:
+                                              description: |-
+                                                items if unspecified, each key-value pair in the Data field of the referenced
+                                                Secret will be projected into the volume as a file whose name is the
+                                                key and content is the value. If specified, the listed keys will be
+                                                projected into the specified paths, and unlisted keys will not be
+                                                present. If a key is specified which is not present in the Secret,
+                                                the volume setup will error unless it is marked optional. Paths must be
+                                                relative and may not contain the '..' path or start with '..'.
+                                              type: array
+                                              items:
+                                                description: Maps a string key to a path within a volume.
+                                                type: object
+                                                required:
+                                                  - key
+                                                  - path
+                                                properties:
+                                                  key:
+                                                    description: key is the key to project.
+                                                    type: string
+                                                  mode:
+                                                    description: |-
+                                                      mode is Optional: mode bits used to set permissions on this file.
+                                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                      YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                      If not specified, the volume defaultMode will be used.
+                                                      This might be in conflict with other options that affect the file
+                                                      mode, like fsGroup, and the result can be other mode bits set.
+                                                    type: integer
+                                                    format: int32
+                                                  path:
+                                                    description: |-
+                                                      path is the relative path of the file to map the key to.
+                                                      May not be an absolute path.
+                                                      May not contain the path element '..'.
+                                                      May not start with the string '..'.
+                                                    type: string
+                                              x-kubernetes-list-type: atomic
+                                            name:
+                                              description: |-
+                                                Name of the referent.
+                                                This field is effectively required, but due to backwards compatibility is
+                                                allowed to be empty. Instances of this type with an empty value here are
+                                                almost certainly wrong.
+                                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                              type: string
+                                              default: ""
+                                            optional:
+                                              description: optional field specify whether the Secret or its key must be defined
+                                              type: boolean
+                                          x-kubernetes-map-type: atomic
+                                        serviceAccountToken:
+                                          description: serviceAccountToken is information about the serviceAccountToken data to project
+                                          type: object
+                                          required:
+                                            - path
+                                          properties:
+                                            audience:
+                                              description: |-
+                                                audience is the intended audience of the token. A recipient of a token
+                                                must identify itself with an identifier specified in the audience of the
+                                                token, and otherwise should reject the token. The audience defaults to the
+                                                identifier of the apiserver.
+                                              type: string
+                                            expirationSeconds:
+                                              description: |-
+                                                expirationSeconds is the requested duration of validity of the service
+                                                account token. As the token approaches expiration, the kubelet volume
+                                                plugin will proactively rotate the service account token. The kubelet will
+                                                start trying to rotate the token if the token is older than 80 percent of
+                                                its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                                and must be at least 10 minutes.
+                                              type: integer
+                                              format: int64
+                                            path:
+                                              description: |-
+                                                path is the path relative to the mount point of the file to project the
+                                                token into.
+                                              type: string
+                                    x-kubernetes-list-type: atomic
+                              secret:
+                                description: |-
+                                  secret represents a secret that should populate this volume.
+                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                type: object
+                                properties:
+                                  defaultMode:
+                                    description: |-
+                                      defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                      Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                      YAML accepts both octal and decimal values, JSON requires decimal values
+                                      for mode bits. Defaults to 0644.
+                                      Directories within the path are not affected by this setting.
+                                      This might be in conflict with other options that affect the file
+                                      mode, like fsGroup, and the result can be other mode bits set.
+                                    type: integer
+                                    format: int32
+                                  items:
+                                    description: |-
+                                      items If unspecified, each key-value pair in the Data field of the referenced
+                                      Secret will be projected into the volume as a file whose name is the
+                                      key and content is the value. If specified, the listed keys will be
+                                      projected into the specified paths, and unlisted keys will not be
+                                      present. If a key is specified which is not present in the Secret,
+                                      the volume setup will error unless it is marked optional. Paths must be
+                                      relative and may not contain the '..' path or start with '..'.
+                                    type: array
+                                    items:
+                                      description: Maps a string key to a path within a volume.
+                                      type: object
+                                      required:
+                                        - key
+                                        - path
+                                      properties:
+                                        key:
+                                          description: key is the key to project.
+                                          type: string
+                                        mode:
+                                          description: |-
+                                            mode is Optional: mode bits used to set permissions on this file.
+                                            Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                            YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                            If not specified, the volume defaultMode will be used.
+                                            This might be in conflict with other options that affect the file
+                                            mode, like fsGroup, and the result can be other mode bits set.
+                                          type: integer
+                                          format: int32
+                                        path:
+                                          description: |-
+                                            path is the relative path of the file to map the key to.
+                                            May not be an absolute path.
+                                            May not contain the path element '..'.
+                                            May not start with the string '..'.
+                                          type: string
+                                    x-kubernetes-list-type: atomic
+                                  optional:
+                                    description: optional field specify whether the Secret or its keys must be defined
+                                    type: boolean
+                                  secretName:
+                                    description: |-
+                                      secretName is the name of the secret in the pod's namespace to use.
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                    type: string
+                          x-kubernetes-list-map-keys:
+                            - name
+                          x-kubernetes-list-type: map
+                traffic:
+                  description: |-
+                    Traffic specifies how to distribute traffic over a collection of
+                    revisions and configurations.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+            status:
+              description: ServiceStatus represents the Status stanza of the Service resource.
+              type: object
+              properties:
+                address:
+                  description: Address holds the information needed for a Route to be the target of an event.
+                  type: object
+                  properties:
+                    CACerts:
+                      description: |-
+                        CACerts is the Certification Authority (CA) certificates in PEM format
+                        according to https://www.rfc-editor.org/rfc/rfc7468.
+                      type: string
+                    audience:
+                      description: Audience is the OIDC audience for this address.
+                      type: string
+                    name:
+                      description: Name is the name of the address.
+                      type: string
+                    url:
+                      type: string
+                annotations:
+                  description: |-
+                    Annotations is additional Status fields for the Resource to save some
+                    additional State as well as convey more information to the user. This is
+                    roughly akin to Annotations on any k8s resource, just the reconciler conveying
+                    richer information outwards.
+                  type: object
+                  additionalProperties:
+                    type: string
+                conditions:
+                  description: Conditions the latest available observations of a resource's current state.
+                  type: array
+                  items:
+                    description: |-
+                      Condition defines a readiness condition for a Knative resource.
+                      See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          LastTransitionTime is the last time the condition transitioned from one status to another.
+                          We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic
+                          differences (all other things held constant).
+                        type: string
+                      message:
+                        description: A human readable message indicating details about the transition.
+                        type: string
+                      reason:
+                        description: The reason for the condition's last transition.
+                        type: string
+                      severity:
+                        description: |-
+                          Severity with which to treat failures of this type of condition.
+                          When this is not specified, it defaults to Error.
+                        type: string
+                      status:
+                        description: Status of the condition, one of True, False, Unknown.
+                        type: string
+                      type:
+                        description: Type of condition.
+                        type: string
+                latestCreatedRevisionName:
+                  description: |-
+                    LatestCreatedRevisionName is the last revision that was created from this
+                    Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
+                  type: string
+                latestReadyRevisionName:
+                  description: |-
+                    LatestReadyRevisionName holds the name of the latest Revision stamped out
+                    from this Configuration that has had its "Ready" condition become "True".
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the 'Generation' of the Service that
+                    was last processed by the controller.
+                  type: integer
+                  format: int64
+                traffic:
+                  description: |-
+                    Traffic holds the configured traffic distribution.
+                    These entries will always contain RevisionName references.
+                    When ConfigurationName appears in the spec, this will hold the
+                    LatestReadyRevisionName that we last observed.
+                  type: array
+                  items:
+                    description: TrafficTarget holds a single entry of the routing table for a Route.
+                    type: object
+                    properties:
+                      configurationName:
+                        description: |-
+                          ConfigurationName of a configuration to whose latest revision we will send
+                          this portion of traffic. When the "status.latestReadyRevisionName" of the
+                          referenced configuration changes, we will automatically migrate traffic
+                          from the prior "latest ready" revision to the new one.  This field is never
+                          set in Route's status, only its spec.  This is mutually exclusive with
+                          RevisionName.
+                        type: string
+                      latestRevision:
+                        description: |-
+                          LatestRevision may be optionally provided to indicate that the latest
+                          ready Revision of the Configuration should be used for this traffic
+                          target.  When provided LatestRevision must be true if RevisionName is
+                          empty; it must be false when RevisionName is non-empty.
+                        type: boolean
+                      percent:
+                        description: |-
+                          Percent indicates that percentage based routing should be used and
+                          the value indicates the percent of traffic that is be routed to this
+                          Revision or Configuration. `0` (zero) mean no traffic, `100` means all
+                          traffic.
+                          When percentage based routing is being used the follow rules apply:
+                          - the sum of all percent values must equal 100
+                          - when not specified, the implied value for `percent` is zero for
+                            that particular Revision or Configuration
+                        type: integer
+                        format: int64
+                      revisionName:
+                        description: |-
+                          RevisionName of a specific revision to which to send this portion of
+                          traffic.  This is mutually exclusive with ConfigurationName.
+                        type: string
+                      tag:
+                        description: |-
+                          Tag is optionally used to expose a dedicated url for referencing
+                          this target exclusively.
+                        type: string
+                      url:
+                        description: |-
+                          URL displays the URL for accessing named traffic targets. URL is displayed in
+                          status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and
+                          a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
+                        type: string
+                url:
+                  description: |-
+                    URL holds the url that will distribute traffic over the provided traffic targets.
+                    It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}
+                  type: string
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: caching.internal.knative.dev/v1alpha1
+kind: Image
+metadata:
+  name: queue-proxy
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: queue-proxy
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  # This is the Go import path for the binary that is containerized
+  # and substituted here.
+  image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:1310917822086a5d8daa6328f6014001d5ea7ccfb0afc1a4e74b1b6a2eadc5ba
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-autoscaler
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: autoscaler
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "47c2487f"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # The Revision ContainerConcurrency field specifies the maximum number
+    # of requests the Container can handle at once. Container concurrency
+    # target percentage is how much of that maximum to use in a stable
+    # state. E.g. if a Revision specifies ContainerConcurrency of 10, then
+    # the Autoscaler will try to maintain 7 concurrent connections per pod
+    # on average.
+    # Note: this limit will be applied to container concurrency set at every
+    # level (ConfigMap, Revision Spec or Annotation).
+    # For legacy and backwards compatibility reasons, this value also accepts
+    # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%).
+    # Thus minimal percentage value must be greater than 1.0, or it will be
+    # treated as a fraction.
+    # NOTE: that this value does not affect actual number of concurrent requests
+    #       the user container may receive, but only the average number of requests
+    #       that the revision pods will receive.
+    container-concurrency-target-percentage: "70"
+
+    # The container concurrency target default is what the Autoscaler will
+    # try to maintain when concurrency is used as the scaling metric for the
+    # Revision and the Revision specifies unlimited concurrency.
+    # When revision explicitly specifies container concurrency, that value
+    # will be used as a scaling target for autoscaler.
+    # When specifying unlimited concurrency, the autoscaler will
+    # horizontally scale the application based on this target concurrency.
+    # This is what we call "soft limit" in the documentation, i.e. it only
+    # affects number of pods and does not affect the number of requests
+    # individual pod processes.
+    # The value must be a positive number such that the value multiplied
+    # by container-concurrency-target-percentage is greater than 0.01.
+    # NOTE: that this value will be adjusted by application of
+    #       container-concurrency-target-percentage, i.e. by default
+    #       the system will target on average 70 concurrent requests
+    #       per revision pod.
+    # NOTE: Only one metric can be used for autoscaling a Revision.
+    container-concurrency-target-default: "100"
+
+    # The requests per second (RPS) target default is what the Autoscaler will
+    # try to maintain when RPS is used as the scaling metric for a Revision and
+    # the Revision specifies unlimited RPS. Even when specifying unlimited RPS,
+    # the autoscaler will horizontally scale the application based on this
+    # target RPS.
+    # Must be greater than 1.0.
+    # NOTE: Only one metric can be used for autoscaling a Revision.
+    requests-per-second-target-default: "200"
+
+    # The target burst capacity specifies the size of burst in concurrent
+    # requests that the system operator expects the system will receive.
+    # Autoscaler will try to protect the system from queueing by introducing
+    # Activator in the request path if the current spare capacity of the
+    # service is less than this setting.
+    # If this setting is 0, then Activator will be in the request path only
+    # when the revision is scaled to 0.
+    # If this setting is > 0 and container-concurrency-target-percentage is
+    # 100% or 1.0, then activator will always be in the request path.
+    # -1 denotes unlimited target-burst-capacity and activator will always
+    # be in the request path.
+    # Other negative values are invalid.
+    target-burst-capacity: "211"
+
+    # When operating in a stable mode, the autoscaler operates on the
+    # average concurrency over the stable window.
+    # Stable window must be in whole seconds.
+    stable-window: "60s"
+
+    # When observed average concurrency during the panic window reaches
+    # panic-threshold-percentage the target concurrency, the autoscaler
+    # enters panic mode. When operating in panic mode, the autoscaler
+    # scales on the average concurrency over the panic window which is
+    # panic-window-percentage of the stable-window.
+    # Must be in the [1, 100] range.
+    # When computing the panic window it will be rounded to the closest
+    # whole second, at least 1s.
+    panic-window-percentage: "10.0"
+
+    # The percentage of the container concurrency target at which to
+    # enter panic mode when reached within the panic window.
+    panic-threshold-percentage: "200.0"
+
+    # Max scale up rate limits the rate at which the autoscaler will
+    # increase pod count. It is the maximum ratio of desired pods versus
+    # observed pods.
+    # Cannot be less or equal to 1.
+    # I.e with value of 2.0 the number of pods can at most go N to 2N
+    # over single Autoscaler period (2s), but at least N to
+    # N+1, if Autoscaler needs to scale up.
+    max-scale-up-rate: "1000.0"
+
+    # Max scale down rate limits the rate at which the autoscaler will
+    # decrease pod count. It is the maximum ratio of observed pods versus
+    # desired pods.
+    # Cannot be less or equal to 1.
+    # I.e. with value of 2.0 the number of pods can at most go N to N/2
+    # over single Autoscaler evaluation period (2s), but at
+    # least N to N-1, if Autoscaler needs to scale down.
+    max-scale-down-rate: "2.0"
+
+    # Scale to zero feature flag.
+    enable-scale-to-zero: "true"
+
+    # Scale to zero grace period is the time an inactive revision is left
+    # running before it is scaled to zero (must be positive, but recommended
+    # at least a few seconds if running with mesh networking).
+    # This is the upper limit and is provided not to enforce timeout after
+    # the revision stopped receiving requests for stable window, but to
+    # ensure network reprogramming to put activator in the path has completed.
+    # If the system determines that a shorter period is satisfactory,
+    # then the system will only wait that amount of time before scaling to 0.
+    # NOTE: this period might actually be 0, if activator has been
+    # in the request path sufficiently long.
+    # If there is necessity for the last pod to linger longer use
+    # scale-to-zero-pod-retention-period flag.
+    scale-to-zero-grace-period: "30s"
+
+    # Scale to zero pod retention period defines the minimum amount
+    # of time the last pod will remain after Autoscaler has decided to
+    # scale to zero.
+    # This flag is for the situations where the pod startup is very expensive
+    # and the traffic is bursty (requiring smaller windows for fast action),
+    # but patchy.
+    # The larger of this flag and `scale-to-zero-grace-period` will effectively
+    # determine how the last pod will hang around.
+    scale-to-zero-pod-retention-period: "0s"
+
+    # pod-autoscaler-class specifies the default pod autoscaler class
+    # that should be used if none is specified. If omitted,
+    # the Knative Pod Autoscaler (KPA) is used by default.
+    pod-autoscaler-class: "kpa.autoscaling.knative.dev"
+
+    # The capacity of a single activator task.
+    # The `unit` is one concurrent request proxied by the activator.
+    # activator-capacity must be at least 1.
+    # This value is used for computation of the Activator subset size.
+    # See the algorithm here: http://bit.ly/38XiCZ3.
+    # TODO(vagababov): tune after actual benchmarking.
+    activator-capacity: "100.0"
+
+    # initial-scale is the cluster-wide default value for the initial target
+    # scale of a revision after creation, unless overridden by the
+    # "autoscaling.knative.dev/initialScale" annotation.
+    # This value must be greater than 0 unless allow-zero-initial-scale is true.
+    initial-scale: "1"
+
+    # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,
+    # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0.
+    allow-zero-initial-scale: "false"
+
+    # min-scale is the cluster-wide default value for the min scale of a revision,
+    # unless overridden by the "autoscaling.knative.dev/minScale" annotation.
+    min-scale: "0"
+
+    # max-scale is the cluster-wide default value for the max scale of a revision,
+    # unless overridden by the "autoscaling.knative.dev/maxScale" annotation.
+    # If set to 0, the revision has no maximum scale.
+    max-scale: "0"
+
+    # scale-down-delay is the amount of time that must pass at reduced
+    # concurrency before a scale down decision is applied. This can be useful,
+    # for example, to maintain replica count and avoid a cold start penalty if
+    # more requests come in within the scale down delay period.
+    # The default, 0s, imposes no delay at all.
+    scale-down-delay: "0s"
+
+    # max-scale-limit sets the maximum permitted value for the max scale of a revision.
+    # When this is set to a positive value, a revision with a maxScale above that value
+    # (including a maxScale of "0" = unlimited) is disallowed.
+    # A value of zero (the default) allows any limit, including unlimited.
+    max-scale-limit: "0"
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-certmanager
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+    networking.knative.dev/certificate-provider: cert-manager
+  annotations:
+    knative.dev/example-checksum: "b7a9a602"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this block and unindented to actually change the configuration.
+
+    # issuerRef is a reference to the issuer for external-domain certificates used for ingress.
+    # IssuerRef should be either `ClusterIssuer` or `Issuer`.
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
+    # for more details about IssuerRef configuration.
+    # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
+    issuerRef: |
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+
+    # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress.
+    # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`.
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
+    # for more details about ClusterInternalIssuerRef configuration.
+    # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
+    clusterLocalIssuerRef: |
+      kind: ClusterIssuer
+      name: your-company-issuer
+
+    # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components.
+    # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
+    # for more details about ClusterInternalIssuerRef configuration.
+    # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
+    systemInternalIssuerRef: |
+      kind: ClusterIssuer
+      name: knative-selfsigned-issuer
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-defaults
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "5b64ff5c"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # revision-timeout-seconds contains the default number of
+    # seconds to use for the revision's per-request timeout, if
+    # none is specified.
+    revision-timeout-seconds: "300"  # 5 minutes
+
+    # max-revision-timeout-seconds contains the maximum number of
+    # seconds that can be used for revision-timeout-seconds.
+    # This value must be greater than or equal to revision-timeout-seconds.
+    # If omitted, the system default is used (600 seconds).
+    #
+    # If this value is increased, the activator's terminationGracePeriodSeconds
+    # should also be increased to prevent in-flight requests being disrupted.
+    max-revision-timeout-seconds: "600"  # 10 minutes
+
+    # revision-response-start-timeout-seconds contains the default number of
+    # seconds a request will be allowed to stay open while waiting to
+    # receive any bytes from the user's application, if none is specified.
+    #
+    # This defaults to 'revision-timeout-seconds'
+    revision-response-start-timeout-seconds: "300"
+
+    # revision-idle-timeout-seconds contains the default number of
+    # seconds a request will be allowed to stay open while not receiving any
+    # bytes from the user's application, if none is specified.
+    revision-idle-timeout-seconds: "0"  # infinite
+
+    # revision-cpu-request contains the cpu allocation to assign
+    # to revisions by default.  If omitted, no value is specified
+    # and the system default is used.
+    # Below is an example of setting revision-cpu-request.
+    # By default, it is not set by Knative.
+    revision-cpu-request: "400m"  # 0.4 of a CPU (aka 400 milli-CPU)
+
+    # revision-memory-request contains the memory allocation to assign
+    # to revisions by default.  If omitted, no value is specified
+    # and the system default is used.
+    # Below is an example of setting revision-memory-request.
+    # By default, it is not set by Knative.
+    revision-memory-request: "100M"  # 100 megabytes of memory
+
+    # revision-ephemeral-storage-request contains the ephemeral storage
+    # allocation to assign to revisions by default.  If omitted, no value is
+    # specified and the system default is used.
+    revision-ephemeral-storage-request: "500M"  # 500 megabytes of storage
+
+    # revision-cpu-limit contains the cpu allocation to limit
+    # revisions to by default.  If omitted, no value is specified
+    # and the system default is used.
+    # Below is an example of setting revision-cpu-limit.
+    # By default, it is not set by Knative.
+    revision-cpu-limit: "1000m"  # 1 CPU (aka 1000 milli-CPU)
+
+    # revision-memory-limit contains the memory allocation to limit
+    # revisions to by default.  If omitted, no value is specified
+    # and the system default is used.
+    # Below is an example of setting revision-memory-limit.
+    # By default, it is not set by Knative.
+    revision-memory-limit: "200M"  # 200 megabytes of memory
+
+    # revision-ephemeral-storage-limit contains the ephemeral storage
+    # allocation to limit revisions to by default.  If omitted, no value is
+    # specified and the system default is used.
+    revision-ephemeral-storage-limit: "750M"  # 750 megabytes of storage
+
+    # container-name-template contains a template for the default
+    # container name, if none is specified.  This field supports
+    # Go templating and is supplied with the ObjectMeta of the
+    # enclosing Service or Configuration, so values such as
+    # {{.Name}} are also valid.
+    container-name-template: "user-container"
+
+    # init-container-name-template contains a template for the default
+    # init container name, if none is specified.  This field supports
+    # Go templating and is supplied with the ObjectMeta of the
+    # enclosing Service or Configuration, so values such as
+    # {{.Name}} are also valid.
+    init-container-name-template: "init-container"
+
+    # container-concurrency specifies the maximum number
+    # of requests the Container can handle at once, and requests
+    # above this threshold are queued.  Setting a value of zero
+    # disables this throttling and lets through as many requests as
+    # the pod receives.
+    container-concurrency: "0"
+
+    # The container concurrency max limit is an operator setting ensuring that
+    # the individual revisions cannot have arbitrary large concurrency
+    # values, or autoscaling targets. `container-concurrency` default setting
+    # must be at or below this value.
+    #
+    # Must be greater than 1.
+    #
+    # Note: even with this set, a user can choose a containerConcurrency
+    # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is
+    # set to "false".
+    container-concurrency-max-limit: "1000"
+
+    # allow-container-concurrency-zero controls whether users can
+    # specify 0 (i.e. unbounded) for containerConcurrency.
+    allow-container-concurrency-zero: "true"
+
+    # enable-service-links specifies the default value used for the
+    # enableServiceLinks field of the PodSpec, when it is omitted by the user.
+    # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service
+    #
+    # This is a tri-state flag with possible values of (true|false|default).
+    #
+    # In environments with large number of services it is suggested
+    # to set this value to `false`.
+    # See https://github.com/knative/serving/issues/8498.
+    enable-service-links: "false"
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-deployment
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "720ddb97"
+data:
+  # This is the Go import path for the binary that is containerized
+  # and substituted here.
+  queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:1310917822086a5d8daa6328f6014001d5ea7ccfb0afc1a4e74b1b6a2eadc5ba
+  _example: |-
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # List of repositories for which tag to digest resolving should be skipped
+    registries-skipping-tag-resolving: "kind.local,ko.local,dev.local"
+
+    # Maximum time allowed for an image's digests to be resolved.
+    digest-resolution-timeout: "10s"
+
+    # Duration we wait for the deployment to be ready before considering it failed.
+    progress-deadline: "600s"
+
+    # Sets the queue proxy's CPU request.
+    # If omitted, a default value (currently "25m"), is used.
+    queue-sidecar-cpu-request: "25m"
+
+    # Sets the queue proxy's CPU limit.
+    # If omitted, a default value (currently "1000m"), is used when
+    # `queueproxy.resource-defaults` is set to `Enabled`.
+    queue-sidecar-cpu-limit: "1000m"
+
+    # Sets the queue proxy's memory request.
+    # If omitted, a default value (currently "400Mi"), is used when
+    # `queueproxy.resource-defaults` is set to `Enabled`.
+    queue-sidecar-memory-request: "400Mi"
+
+    # Sets the queue proxy's memory limit.
+    # If omitted, a default value (currently "800Mi"), is used when
+    # `queueproxy.resource-defaults` is set to `Enabled`.
+    queue-sidecar-memory-limit: "800Mi"
+
+    # Sets the queue proxy's ephemeral storage request.
+    # If omitted, no value is specified and the system default is used.
+    queue-sidecar-ephemeral-storage-request: "512Mi"
+
+    # Sets the queue proxy's ephemeral storage limit.
+    # If omitted, no value is specified and the system default is used.
+    queue-sidecar-ephemeral-storage-limit: "1024Mi"
+
+    # Sets tokens associated with specific audiences for queue proxy - used by QPOptions
+    #
+    # For example, to add the `service-x` audience:
+    #    queue-sidecar-token-audiences: "service-x"
+    # Also supports a list of audiences, for example:
+    #    queue-sidecar-token-audiences: "service-x,service-y"
+    # If omitted, or empty, no tokens are created
+    queue-sidecar-token-audiences: ""
+
+    # Sets rootCA for the queue proxy - used by QPOptions
+    # If omitted, or empty, no rootCA is added to the golang rootCAs
+    queue-sidecar-rootca: ""
+
+    # If set, it automatically configures pod anti-affinity requirements for all Knative services.
+    # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,
+    # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:
+    # `
+    #   affinity:
+    #     podAntiAffinity:
+    #       preferredDuringSchedulingIgnoredDuringExecution:
+    #       - podAffinityTerm:
+    #           topologyKey: kubernetes.io/hostname
+    #           labelSelector:
+    #             matchLabels:
+    #               serving.knative.dev/revision: {{revision-name}}
+    #         weight: 100
+    # `
+    # This may be "none" or "prefer-spread-revision-over-nodes" (default)
+    # default-affinity-type: "prefer-spread-revision-over-nodes"
+
+    # runtime-class-name contains the selector for which runtimeClassName
+    # is selected to put in a revision.
+    # By default, it is not set by Knative.
+    #
+    # Example:
+    # runtime-class-name: |
+    #   "":
+    #     selector:
+    #       use-default-runc: "yes"
+    #   kata: {}
+    #   gvisor:
+    #     selector:
+    #       use-gvisor: "please"
+    runtime-class-name: ""
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-domain
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "26c09de5"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # Default value for domain.
+    # Routes having the cluster domain suffix (by default 'svc.cluster.local')
+    # will not be exposed through Ingress. You can define your own label
+    # selector to assign that domain suffix to your Route here, or you can set
+    # the label
+    #    "networking.knative.dev/visibility=cluster-local"
+    # to achieve the same effect.  This shows how to make routes having
+    # the label app=secret only exposed to the local cluster.
+    svc.cluster.local: |
+      selector:
+        app: secret
+
+    # These are example settings of domain.
+    # example.com will be used for all routes, but it is the least-specific rule so it
+    # will only be used if no other domain matches.
+    example.com: |
+
+    # example.org will be used for routes having app=nonprofit.
+    example.org: |
+      selector:
+        app: nonprofit
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-features
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "0f9b4ade"
+data:
+  _example: |-
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # Default SecurityContext settings to secure-by-default values
+    # if unset.
+    #
+    # This value will default to "enabled" in a future release,
+    # probably Knative 1.10
+    secure-pod-defaults: "disabled"
+
+    # Indicates whether multi container support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers
+    multi-container: "enabled"
+
+    # Indicates whether multi container probing is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing
+    multi-container-probing: "disabled"
+
+    # Indicates whether Kubernetes affinity support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity
+    kubernetes.podspec-affinity: "disabled"
+
+    # Indicates whether Kubernetes topologySpreadConstraints support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints
+    kubernetes.podspec-topologyspreadconstraints: "disabled"
+
+    # Indicates whether Kubernetes hostAliases support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases
+    kubernetes.podspec-hostaliases: "disabled"
+
+    # Indicates whether Kubernetes nodeSelector support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector
+    kubernetes.podspec-nodeselector: "disabled"
+
+    # Indicates whether Kubernetes tolerations support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration
+    kubernetes.podspec-tolerations: "disabled"
+
+    # Indicates whether Kubernetes FieldRef support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref
+    kubernetes.podspec-fieldref: "disabled"
+
+    # Indicates whether Kubernetes RuntimeClassName support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class
+    kubernetes.podspec-runtimeclassname: "disabled"
+
+    # Indicates whether Kubernetes DNSPolicy support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy
+    kubernetes.podspec-dnspolicy: "disabled"
+
+    # Indicates whether Kubernetes DNSConfig support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig
+    kubernetes.podspec-dnsconfig: "disabled"
+
+    # This feature allows end-users to set a subset of fields on the Pod's SecurityContext
+    #
+    # When set to "enabled" or "allowed" it allows the following
+    # PodSecurityContext properties:
+    # - FSGroup
+    # - RunAsGroup
+    # - RunAsNonRoot
+    # - SupplementalGroups
+    # - RunAsUser
+    # - SeccompProfile
+    #
+    # This feature flag should be used with caution as the PodSecurityContext
+    # properties may have a side-effect on non-user sidecar containers that come
+    # from Knative or your service mesh
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context
+    kubernetes.podspec-securitycontext: "disabled"
+
+    # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.
+    # This can be especially useful for sharing data from images directly between sidecars
+    #
+    # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace
+    kubernetes.podspec-shareprocessnamespace: "disabled"
+
+    # Indicates whether hostIPC support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc
+    kubernetes.podspec-hostipc: "disabled"
+
+    # Indicates whether hostPID support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid
+    kubernetes.podspec-hostpid: "disabled"
+
+    # Indicates whether hostNetwork support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network
+    kubernetes.podspec-hostnetwork: "disabled"
+
+    # Indicates whether Kubernetes PriorityClassName support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name
+    kubernetes.podspec-priorityclassname: "disabled"
+
+    # Indicates whether Kubernetes SchedulerName support is enabled
+    #
+    # WARNING: Cannot safely be disabled once enabled.
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name
+    kubernetes.podspec-schedulername: "disabled"
+
+    # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.
+    #
+    # When set to "enabled" or "allowed" it allows capabilities to be added to the container.
+    # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html
+    kubernetes.containerspec-addcapabilities: "disabled"
+
+    # This feature validates PodSpecs from the validating webhook
+    # against the K8s API Server.
+    #
+    # When "enabled", the server will always run the extra validation.
+    # When "allowed", the server will not run the dry-run validation by default.
+    #   However, clients may enable the behavior on an individual Service by
+    #   attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled".
+    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run
+    kubernetes.podspec-dryrun: "allowed"
+
+    # Controls whether tag header based routing feature are enabled or not.
+    # 1. Enabled: enabling tag header based routing
+    # 2. Disabled: disabling tag header based routing
+    # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing
+    tag-header-based-routing: "disabled"
+
+    # Controls whether http2 auto-detection should be enabled or not.
+    # 1. Enabled: http2 connection will be attempted via upgrade.
+    # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c".
+    autodetect-http2: "disabled"
+
+    # Controls whether volume support for EmptyDir is enabled or not.
+    # 1. Enabled: enabling EmptyDir volume support
+    # 2. Disabled: disabling EmptyDir volume support
+    kubernetes.podspec-volumes-emptydir: "enabled"
+
+    # Controls whether volume support for image is enabled or not.
+    # 1. Enabled: enabling image volume support
+    # 2. Disabled: disabling image volume support
+    kubernetes.podspec-volumes-image: "disabled"
+
+    # Controls whether volume support for HostPath is enabled or not.
+    # WARNING: Cannot safely be disabled once enabled.
+    # WARNING: If you can avoid using a hostPath volume, you should.
+    # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.
+    # 1. Enabled: enabling HostPath volume support
+    # 2. Disabled: disabling HostPath volume support
+    kubernetes.podspec-volumes-hostpath: "disabled"
+
+    # Controls whether volume support for CSI is enabled or not.
+    # 1. Enabled: enabling CSI volume support
+    # 2. Disabled: disabling CSI volume support
+    kubernetes.podspec-volumes-csi: "disabled"
+
+    # Controls whether init containers support is enabled or not.
+    # 1. Enabled: enabling init containers support
+    # 2. Disabled: disabling init containers support
+    kubernetes.podspec-init-containers: "disabled"
+
+    # Controls whether persistent volume claim support is enabled or not.
+    # 1. Enabled: enabling persistent volume claim support
+    # 2. Disabled: disabling persistent volume claim support
+    kubernetes.podspec-persistent-volume-claim: "disabled"
+
+    # Controls whether write access for persistent volumes is enabled or not.
+    # 1. Enabled: enabling write access for persistent volumes
+    # 2. Disabled: disabling write access for persistent volumes
+    kubernetes.podspec-persistent-volume-write: "disabled"
+
+    # Controls whether volume mount propagation support is enabled or not.
+    # 1. Enabled: enabling volume mount propagation support
+    # 2. Disabled: disabling volume mount propagation support
+    kubernetes.podspec-volumes-mount-propagation: "disabled"
+
+    # Controls if the queue proxy podInfo feature is enabled, allowed or disabled
+    #
+    # This feature should be enabled/allowed when using queue proxy Options (Extensions)
+    # Enabling will mount a podInfo volume to the queue proxy container.
+    # The volume will contains an 'annotations' file (from the pod's annotation field).
+    # The annotations in this file include the Service annotations set by the client creating the service.
+    # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations
+    #
+    # 1. "enabled": always mount a podInfo volume
+    # 2. "disabled": never mount a podInfo volume
+    # 3. "allowed": by default, do not mount a podInfo volume
+    #   However, a client may mount the podInfo volume on an individual Service by attaching
+    #   the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled".
+    #
+    # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE
+    queueproxy.mount-podinfo: "disabled"
+
+    # Default queue proxy resource requests and limits to good values for most cases if set.
+    queueproxy.resource-defaults: "disabled"
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-gc
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "aa3813a8"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # ---------------------------------------
+    # Garbage Collector Settings
+    # ---------------------------------------
+    #
+    # Active
+    #   * Revisions which are referenced by a Route are considered active.
+    #   * Individual revisions may be marked with the annotation
+    #      "serving.knative.dev/no-gc":"true" to be permanently considered active.
+    #   * Active revisions are not considered for GC.
+    # Retention
+    #   * Revisions are retained if they are any of the following:
+    #       1. Active
+    #       2. Were created within "retain-since-create-time"
+    #       3. Were last referenced by a route within
+    #           "retain-since-last-active-time"
+    #       4. There are fewer than "min-non-active-revisions"
+    #     If none of these conditions are met, or if the count of revisions exceed
+    #      "max-non-active-revisions", they will be deleted by GC.
+    #     The special value "disabled" may be used to turn off these limits.
+    #
+    # Example config to immediately collect any inactive revision:
+    #    min-non-active-revisions: "0"
+    #    max-non-active-revisions: "0"
+    #    retain-since-create-time: "disabled"
+    #    retain-since-last-active-time: "disabled"
+    #
+    # Example config to always keep around the last ten non-active revisions:
+    #     retain-since-create-time: "disabled"
+    #     retain-since-last-active-time: "disabled"
+    #     max-non-active-revisions: "10"
+    #
+    # Example config to disable all garbage collection:
+    #     retain-since-create-time: "disabled"
+    #     retain-since-last-active-time: "disabled"
+    #     max-non-active-revisions: "disabled"
+    #
+    # Example config to keep recently deployed or active revisions,
+    # always maintain the last two in case of rollback, and prevent
+    # burst activity from exploding the count of old revisions:
+    #      retain-since-create-time: "48h"
+    #      retain-since-last-active-time: "15h"
+    #      min-non-active-revisions: "2"
+    #      max-non-active-revisions: "1000"
+
+    # Duration since creation before considering a revision for GC or "disabled".
+    retain-since-create-time: "48h"
+
+    # Duration since active before considering a revision for GC or "disabled".
+    retain-since-last-active-time: "15h"
+
+    # Minimum number of non-active revisions to retain.
+    min-non-active-revisions: "20"
+
+    # Maximum number of non-active revisions to retain
+    # or "disabled" to disable any maximum limit.
+    max-non-active-revisions: "1000"
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-leader-election
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "f4b71f57"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # lease-duration is how long non-leaders will wait to try to acquire the
+    # lock; 15 seconds is the value used by core kubernetes controllers.
+    lease-duration: "60s"
+
+    # renew-deadline is how long a leader will try to renew the lease before
+    # giving up; 10 seconds is the value used by core kubernetes controllers.
+    renew-deadline: "40s"
+
+    # retry-period is how long the leader election client waits between tries of
+    # actions; 2 seconds is the value used by core kubernetes controllers.
+    retry-period: "10s"
+
+    # buckets is the number of buckets used to partition key space of each
+    # Reconciler. If this number is M and the replica number of the controller
+    # is N, the N replicas will compete for the M buckets. The owner of a
+    # bucket will take care of the reconciling for the keys partitioned into
+    # that bucket.
+    buckets: "1"
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-logging
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/component: logging
+    app.kubernetes.io/name: knative-serving
+  annotations:
+    knative.dev/example-checksum: "9f25d429"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # Common configuration for all Knative codebase
+    zap-logger-config: |
+      {
+        "level": "info",
+        "development": false,
+        "outputPaths": ["stdout"],
+        "errorOutputPaths": ["stderr"],
+        "encoding": "json",
+        "encoderConfig": {
+          "timeKey": "timestamp",
+          "levelKey": "severity",
+          "nameKey": "logger",
+          "callerKey": "caller",
+          "messageKey": "message",
+          "stacktraceKey": "stacktrace",
+          "lineEnding": "",
+          "levelEncoder": "",
+          "timeEncoder": "iso8601",
+          "durationEncoder": "",
+          "callerEncoder": ""
+        }
+      }
+
+    # Log level overrides
+    # For all components except the queue proxy,
+    # changes are picked up immediately.
+    # For queue proxy, changes require recreation of the pods.
+    loglevel.controller: "info"
+    loglevel.autoscaler: "info"
+    loglevel.queueproxy: "info"
+    loglevel.webhook: "info"
+    loglevel.activator: "info"
+    loglevel.hpaautoscaler: "info"
+    loglevel.net-istio-controller: "info"
+    loglevel.net-contour-controller: "info"
+    loglevel.net-kourier-controller: "info"
+    loglevel.net-gateway-api-controller: "info"
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-network
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: networking
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "0573e07d"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # ingress-class specifies the default ingress class
+    # to use when not dictated by Route annotation.
+    #
+    # If not specified, will use the Istio ingress.
+    #
+    # Note that changing the Ingress class of an existing Route
+    # will result in undefined behavior.  Therefore it is best to only
+    # update this value during the setup of Knative, to avoid getting
+    # undefined behavior.
+    ingress-class: "istio.ingress.networking.knative.dev"
+
+    # certificate-class specifies the default Certificate class
+    # to use when not dictated by Route annotation.
+    #
+    # If not specified, will use the Cert-Manager Certificate.
+    #
+    # Note that changing the Certificate class of an existing Route
+    # will result in undefined behavior.  Therefore it is best to only
+    # update this value during the setup of Knative, to avoid getting
+    # undefined behavior.
+    certificate-class: "cert-manager.certificate.networking.knative.dev"
+
+    # namespace-wildcard-cert-selector specifies a LabelSelector which
+    # determines which namespaces should have a wildcard certificate
+    # provisioned.
+    #
+    # Use an empty value to disable the feature (this is the default):
+    #   namespace-wildcard-cert-selector: ""
+    #
+    # Use an empty object to enable for all namespaces
+    #   namespace-wildcard-cert-selector: {}
+    #
+    # Useful labels include the "kubernetes.io/metadata.name" label to
+    # avoid provisioning a certificate for the "kube-system" namespaces.
+    # Use the following selector to match pre-1.0 behavior of using
+    # "networking.knative.dev/disableWildcardCert" to exclude namespaces:
+    #
+    # matchExpressions:
+    # - key: "networking.knative.dev/disableWildcardCert"
+    #   operator: "NotIn"
+    #   values: ["true"]
+    namespace-wildcard-cert-selector: ""
+
+    # domain-template specifies the golang text template string to use
+    # when constructing the Knative service's DNS name. The default
+    # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}".
+    #
+    # Valid variables defined in the template include Name, Namespace, Domain,
+    # Labels, and Annotations. Name will be the result of the tag-template
+    # below, if a tag is specified for the route.
+    #
+    # Changing this value might be necessary when the extra levels in
+    # the domain name generated is problematic for wildcard certificates
+    # that only support a single level of domain name added to the
+    # certificate's domain. In those cases you might consider using a value
+    # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace
+    # entirely from the template. When choosing a new value be thoughtful
+    # of the potential for conflicts - for example, when users choose to use
+    # characters such as `-` in their service, or namespace, names.
+    # {{.Annotations}} or {{.Labels}} can be used for any customization in the
+    # go template if needed.
+    # We strongly recommend keeping namespace part of the template to avoid
+    # domain name clashes:
+    # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}'
+    # and you have an annotation {"sub":"foo"}, then the generated template
+    # would be {Name}-{Namespace}.foo.{Domain}
+    domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}"
+
+    # tag-template specifies the golang text template string to use
+    # when constructing the DNS name for "tags" within the traffic blocks
+    # of Routes and Configuration.  This is used in conjunction with the
+    # domain-template above to determine the full URL for the tag.
+    tag-template: "{{.Tag}}-{{.Name}}"
+
+    # auto-tls is deprecated and replaced by external-domain-tls
+    auto-tls: "Disabled"
+
+    # Controls whether TLS certificates are automatically provisioned and
+    # installed in the Knative ingress to terminate TLS connections
+    # for cluster external domains (like: app.example.com)
+    # - Enabled: enables the TLS certificate provisioning feature for cluster external domains.
+    # - Disabled: disables the TLS certificate provisioning feature for cluster external domains.
+    external-domain-tls: "Disabled"
+
+    # Controls weather TLS certificates are automatically provisioned and
+    # installed in the Knative ingress to terminate TLS connections
+    # for cluster local domains (like: app.namespace.svc.<your-cluster-domain>)
+    # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.
+    # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
+    #       for now. Use with caution.
+    cluster-local-domain-tls: "Disabled"
+
+    # internal-encryption is deprecated and replaced by system-internal-tls
+    internal-encryption: "false"
+
+    # system-internal-tls controls weather TLS encryption is used for connections between
+    # the internal components of Knative:
+    # - ingress to activator
+    # - ingress to queue-proxy
+    # - activator to queue-proxy
+    #
+    # Possible values for this flag are:
+    # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.
+    # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
+    #       for now. Use with caution.
+    system-internal-tls: "Disabled"
+
+    # Controls the behavior of the HTTP endpoint for the Knative ingress.
+    # It requires auto-tls to be enabled.
+    # - Enabled: The Knative ingress will be able to serve HTTP connection.
+    # - Redirected: The Knative ingress will send a 301 redirect for all
+    # http connections, asking the clients to use HTTPS.
+    #
+    # "Disabled" option is deprecated.
+    http-protocol: "Enabled"
+
+    # rollout-duration contains the minimal duration in seconds over which the
+    # Configuration traffic targets are rolled out to the newest revision.
+    rollout-duration: "0"
+
+    # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should
+    # be automatically created (and deleted) as needed when DomainMappings are
+    # reconciled.
+    #
+    # If this is "false" (the default), the cluster administrator is
+    # responsible for creating ClusterDomainClaims and delegating them to
+    # namespaces via their spec.Namespace field. This setting should be used in
+    # multitenant environments which need to control which namespace can use a
+    # particular domain name in a domain mapping.
+    #
+    # If this is "true", users are able to associate arbitrary names with their
+    # services via the DomainMapping feature.
+    autocreate-cluster-domain-claims: "false"
+
+    # If true, networking plugins can add additional information to deployed
+    # applications to make their pods directly accessible via their IPs even if mesh is
+    # enabled and thus direct-addressability is usually not possible.
+    # Consumers like Knative Serving can use this setting to adjust their behavior
+    # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems.
+    #
+    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
+    #       for now. Use with caution.
+    enable-mesh-pod-addressability: "false"
+
+    # mesh-compatibility-mode indicates whether consumers of network plugins
+    # should directly contact Pod IPs (most efficient), or should use the
+    # Cluster IP (less efficient, needed when mesh is enabled unless
+    # `enable-mesh-pod-addressability`, above, is set).
+    # Permitted values are:
+    #  - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed.
+    #  - "enabled": always use Cluster IP and do not attempt to use Pod IPs.
+    #  - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure.
+    mesh-compatibility-mode: "auto"
+
+    # Defines the scheme used for external URLs if auto-tls is not enabled.
+    # This can be used for making Knative report all URLs as "HTTPS" for example, if you're
+    # fronting Knative with an external loadbalancer that deals with TLS termination and
+    # Knative doesn't know about that otherwise.
+    default-external-scheme: "http"
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-observability
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: observability
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "6bc8b73d"
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # These sample configuration options may be copied out of
+    # this example block and unindented to be in the data block
+    # to actually change the configuration.
+
+    # logging.enable-var-log-collection defaults to false.
+    # The fluentd daemon set will be set up to collect /var/log if
+    # this flag is true.
+    logging.enable-var-log-collection: "false"
+
+    # logging.revision-url-template provides a template to use for producing the
+    # logging URL that is injected into the status of each Revision.
+    logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}"
+
+    # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe
+    # requests.
+    # NB: after 0.18 release logging.enable-request-log must be explicitly set to true
+    # in order for request logging to be enabled.
+    #
+    # The value determines the shape of the request logs and it must be a valid go text/template.
+    # It is important to keep this as a single line. Multiple lines are parsed as separate entities
+    # by most collection agents and will split the request logs into multiple records.
+    #
+    # The following fields and functions are available to the template:
+    #
+    # Request: An http.Request (see https://golang.org/pkg/net/http/#Request)
+    # representing an HTTP request received by the server.
+    #
+    # Response:
+    # struct {
+    #   Code    int       // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)
+    #   Size    int       // An int representing the size of the response.
+    #   Latency float64   // A float64 representing the latency of the response in seconds.
+    # }
+    #
+    # Revision:
+    # struct {
+    #   Name          string  // Knative revision name
+    #   Namespace     string  // Knative revision namespace
+    #   Service       string  // Knative service name
+    #   Configuration string  // Knative configuration name
+    #   PodName       string  // Name of the pod hosting the revision
+    #   PodIP         string  // IP of the pod hosting the revision
+    # }
+    #
+    logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}'
+
+    # If true, the request logging will be enabled.
+    logging.enable-request-log: "false"
+
+    # If true, this enables queue proxy writing request logs for probe requests to stdout.
+    # It uses the same template for user requests, i.e. logging.request-log-template.
+    logging.enable-probe-request-log: "false"
+
+    # metrics-protocol field specifies the protocol used when exporting metrics
+    # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)
+    metrics-protocol: http/protobuf
+
+    # metrics-endpoint field specifies the destination metrics should be exporter to.
+    #
+    # The endpoint MUST be set when the protocol is http/protobuf or grpc.
+    # The endpoint MUST NOT be set when the protocol is none.
+    #
+    # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the
+    # listening host interface and port.
+    metrics-endpoint: http://example.com/v1/traces
+
+    # metrics-export-interval specifies the global metrics reporting period for control and data plane components.
+    # If a zero or negative value is passed the default reporting OTel period is used (60 secs).
+    metrics-export-interval: 60s
+
+    # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics
+    # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)
+    request-metrics-protocol: http/protobuf
+
+    # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to.
+    #
+    # The endpoint MUST be set when the protocol is http/protobuf or grpc.
+    # The endpoint MUST NOT be set when the protocol is none.
+    #
+    # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the
+    # listening host interface and port.
+    request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics
+
+    # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy.
+    #
+    # If a zero or negative value is passed the default reporting OTel period is used (60 secs).
+    request-metrics-export-interval: 60s
+
+    # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from
+    # the pods via an HTTP server in the format expected by the pprof visualization tool. When
+    # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.
+    # The HTTP context root for profiling is then /debug/pprof/.
+    runtime-profiling: enabled
+
+
+    # tracing-protocol field specifies the protocol used when exporting metrics
+    # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)
+    # or `stdout` for debugging purposes
+    tracing-protocol: http/protobuf
+
+    # tracing-endpoint field specifies the destination traces should be exporter to.
+    #
+    # The endpoint MUST be set when the protocol is http/protobuf or grpc.
+    # The endpoint MUST NOT be set when the protocol is none.
+    tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces
+
+    # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported
+    # The value should be between 0 (never sample) to 1 (always sample)
+    tracing-sampling-rate: "1"
+
+---
+# Copyright 2019 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-tracing
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/component: tracing
+    app.kubernetes.io/version: "1.19.0"
+  annotations:
+    knative.dev/example-checksum: "04c7e9a3"
+data:
+  _example: |
+    ###########################################################
+    #                                                         #
+    #  This config is deprecated - use config-observability   #
+    #                                                         #
+    ###########################################################
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: activator
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  minReplicas: 1
+  maxReplicas: 20
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: activator
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          # Percentage of the requested CPU
+          averageUtilization: 100
+---
+# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time.
+# Given the subsetting and that the activators are partially stateful systems, we want
+# a slow rollout of the new versions and slow migration during node upgrades.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: activator-pdb
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  minAvailable: 80%
+  selector:
+    matchLabels:
+      app: activator
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: activator
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+spec:
+  selector:
+    matchLabels:
+      app: activator
+      role: activator
+  template:
+    metadata:
+      labels:
+        app: activator
+        role: activator
+        app.kubernetes.io/component: activator
+        app.kubernetes.io/name: knative-serving
+        app.kubernetes.io/version: "1.19.0"
+    spec:
+      # To avoid node becoming SPOF, spread our replicas to different nodes.
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: activator
+                topologyKey: kubernetes.io/hostname
+              weight: 100
+      serviceAccountName: activator
+      containers:
+        - name: activator
+          # This is the Go import path for the binary that is containerized
+          # and substituted here.
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:3e81e0b0e2ead666c131a17b437b1759e59ec2b066db49c493e4663e42fa4452
+          # The numbers are based on performance test results from
+          # https://github.com/knative/serving/issues/1625#issuecomment-511930023
+          resources:
+            requests:
+              cpu: 300m
+              memory: 60Mi
+            limits:
+              cpu: 1000m
+              memory: 600Mi
+          env:
+            # Run Activator with GC collection when newly generated memory is 500%.
+            - name: GOGC
+              value: "500"
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
+            - name: METRICS_DOMAIN
+              value: knative.dev/internal/serving
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: metrics
+              containerPort: 9090
+            - name: profiling
+              containerPort: 8008
+            - name: http1
+              containerPort: 8012
+            - name: h2c
+              containerPort: 8013
+          readinessProbe:
+            httpGet:
+              port: 8012
+            periodSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              port: 8012
+            periodSeconds: 10
+            failureThreshold: 12
+            initialDelaySeconds: 15
+      # The activator (often) sits on the dataplane, and may proxy long (e.g.
+      # streaming, websockets) requests.  We give a long grace period for the
+      # activator to "lame duck" and drain outstanding requests before we
+      # forcibly terminate the pod (and outstanding connections).  This value
+      # should be at least as large as the upper bound on the Revision's
+      # timeoutSeconds property to avoid servicing events disrupting
+      # connections.
+      terminationGracePeriodSeconds: 600
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: activator-service
+  namespace: knative-serving
+  labels:
+    app: activator
+    app.kubernetes.io/component: activator
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+spec:
+  selector:
+    app: activator
+  ports:
+    # Define metrics and profiling for them to be accessible within service meshes.
+    - name: http-metrics
+      port: 9090
+      targetPort: 9090
+    - name: http-profiling
+      port: 8008
+      targetPort: 8008
+    - name: http
+      port: 80
+      targetPort: 8012
+    - name: http2
+      port: 81
+      targetPort: 8013
+    - name: https
+      port: 443
+      targetPort: 8112
+  type: ClusterIP
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: autoscaler
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: autoscaler
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: autoscaler
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: autoscaler
+        app.kubernetes.io/component: autoscaler
+        app.kubernetes.io/name: knative-serving
+        app.kubernetes.io/version: "1.19.0"
+    spec:
+      # To avoid node becoming SPOF, spread our replicas to different nodes.
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: autoscaler
+                topologyKey: kubernetes.io/hostname
+              weight: 100
+      serviceAccountName: controller
+      containers:
+        - name: autoscaler
+          # This is the Go import path for the binary that is containerized
+          # and substituted here.
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:998a790f7f74caec6e7fc9084d7b85f25b6c011e753b26076c7db766587b3e08
+          resources:
+            requests:
+              cpu: 100m
+              memory: 100Mi
+            limits:
+              cpu: 1000m
+              memory: 1000Mi
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
+            - name: METRICS_DOMAIN
+              value: knative.dev/serving
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: metrics
+              containerPort: 9090
+            - name: profiling
+              containerPort: 8008
+            - name: websocket
+              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              port: 8080
+          livenessProbe:
+            httpGet:
+              port: 8080
+            failureThreshold: 6
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: autoscaler
+    app.kubernetes.io/component: autoscaler
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+  name: autoscaler
+  namespace: knative-serving
+spec:
+  ports:
+    # Define metrics and profiling for them to be accessible within service meshes.
+    - name: http-metrics
+      port: 9090
+      targetPort: 9090
+    - name: http-profiling
+      port: 8008
+      targetPort: 8008
+    - name: http
+      port: 8080
+      targetPort: 8080
+  selector:
+    app: autoscaler
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  selector:
+    matchLabels:
+      app: controller
+  template:
+    metadata:
+      labels:
+        app: controller
+        app.kubernetes.io/component: controller
+        app.kubernetes.io/name: knative-serving
+        app.kubernetes.io/version: "1.19.0"
+    spec:
+      # To avoid node becoming SPOF, spread our replicas to different nodes.
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: controller
+                topologyKey: kubernetes.io/hostname
+              weight: 100
+      serviceAccountName: controller
+      containers:
+        - name: controller
+          # This is the Go import path for the binary that is containerized
+          # and substituted here.
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:d9f40097903d1d9f4108723d2e41dfc21039ff380671ab80723fc861d81b8071
+          resources:
+            requests:
+              cpu: 100m
+              memory: 100Mi
+            limits:
+              cpu: 1000m
+              memory: 1000Mi
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
+            - name: METRICS_DOMAIN
+              value: knative.dev/internal/serving
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: probes
+              scheme: HTTP
+            periodSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /readiness
+              port: probes
+              scheme: HTTP
+            periodSeconds: 5
+            failureThreshold: 3
+          ports:
+            - name: metrics
+              containerPort: 9090
+            - name: profiling
+              containerPort: 8008
+            - name: probes
+              containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: controller
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+  name: controller
+  namespace: knative-serving
+spec:
+  ports:
+    # Define metrics and profiling for them to be accessible within service meshes.
+    - name: http-metrics
+      port: 9090
+      targetPort: 9090
+    - name: http-profiling
+      port: 8008
+      targetPort: 8008
+  selector:
+    app: controller
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: webhook
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  minReplicas: 1
+  maxReplicas: 5
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: webhook
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          # Percentage of the requested CPU
+          averageUtilization: 100
+---
+# Webhook PDB.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: webhook-pdb
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+spec:
+  minAvailable: 80%
+  selector:
+    matchLabels:
+      app: webhook
+
+---
+# Copyright 2018 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+spec:
+  selector:
+    matchLabels:
+      app: webhook
+      role: webhook
+  template:
+    metadata:
+      labels:
+        app: webhook
+        role: webhook
+        app.kubernetes.io/component: webhook
+        app.kubernetes.io/version: "1.19.0"
+        app.kubernetes.io/name: knative-serving
+    spec:
+      # To avoid node becoming SPOF, spread our replicas to different nodes.
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: webhook
+                topologyKey: kubernetes.io/hostname
+              weight: 100
+      serviceAccountName: controller
+      containers:
+        - name: webhook
+          # This is the Go import path for the binary that is containerized
+          # and substituted here.
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:deb7f4ff25b854c6a1f58c2435fe0799731eba974d50dd012b534b6daf8eebf3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 100Mi
+            limits:
+              cpu: 500m
+              memory: 500Mi
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+            - name: WEBHOOK_NAME
+              value: webhook
+            - name: WEBHOOK_PORT
+              value: "8443"
+            # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config
+            - name: METRICS_DOMAIN
+              value: knative.dev/internal/serving
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: metrics
+              containerPort: 9090
+            - name: profiling
+              containerPort: 8008
+            - name: https-webhook
+              containerPort: 8443
+          readinessProbe:
+            periodSeconds: 1
+            httpGet:
+              scheme: HTTPS
+              port: 8443
+          livenessProbe:
+            periodSeconds: 10
+            httpGet:
+              scheme: HTTPS
+              port: 8443
+            failureThreshold: 6
+            initialDelaySeconds: 20
+      # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently
+      # high value that we respect whatever value it has configured for the lame duck grace period.
+      terminationGracePeriodSeconds: 300
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: webhook
+    role: webhook
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/version: "1.19.0"
+    app.kubernetes.io/name: knative-serving
+  name: webhook
+  namespace: knative-serving
+spec:
+  ports:
+    # Define metrics and profiling for them to be accessible within service meshes.
+    - name: http-metrics
+      port: 9090
+      targetPort: 9090
+    - name: http-profiling
+      port: 8008
+      targetPort: 8008
+    - name: https-webhook
+      port: 443
+      targetPort: 8443
+  selector:
+    app: webhook
+    role: webhook
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: config.webhook.serving.knative.dev
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+webhooks:
+  - admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: webhook
+        namespace: knative-serving
+    failurePolicy: Fail
+    sideEffects: None
+    name: config.webhook.serving.knative.dev
+    objectSelector:
+      matchExpressions:
+        - key: app.kubernetes.io/name
+          operator: In
+          values: ["knative-serving"]
+        - key: app.kubernetes.io/component
+          operator: In
+          values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"]
+    timeoutSeconds: 10
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: webhook.serving.knative.dev
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+webhooks:
+  - admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: webhook
+        namespace: knative-serving
+    failurePolicy: Fail
+    sideEffects: None
+    name: webhook.serving.knative.dev
+    timeoutSeconds: 10
+    rules:
+      - apiGroups:
+          - autoscaling.internal.knative.dev
+          - networking.internal.knative.dev
+          - serving.knative.dev
+        apiVersions:
+          - "*"
+        operations:
+          - CREATE
+          - UPDATE
+        scope: "*"
+        resources:
+          - metrics
+          - podautoscalers
+          - certificates
+          - ingresses
+          - serverlessservices
+          - configurations
+          - revisions
+          - routes
+          - services
+          - domainmappings
+          - domainmappings/status
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: validation.webhook.serving.knative.dev
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+webhooks:
+  - admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: webhook
+        namespace: knative-serving
+    failurePolicy: Fail
+    sideEffects: None
+    name: validation.webhook.serving.knative.dev
+    timeoutSeconds: 10
+    rules:
+      - apiGroups:
+          - autoscaling.internal.knative.dev
+          - networking.internal.knative.dev
+          - serving.knative.dev
+        apiVersions:
+          - "*"
+        operations:
+          - CREATE
+          - UPDATE
+          - DELETE
+        scope: "*"
+        resources:
+          - metrics
+          - podautoscalers
+          - certificates
+          - ingresses
+          - serverlessservices
+          - configurations
+          - revisions
+          - routes
+          - services
+          - domainmappings
+          - domainmappings/status
+
+---
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: webhook-certs
+  namespace: knative-serving
+  labels:
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/name: knative-serving
+    app.kubernetes.io/version: "1.19.0"
+# The data is populated at install time.
+
+---
diff --git a/integration/fixtures/knative/04-serving-tests-namespace.yaml b/integration/fixtures/knative/04-serving-tests-namespace.yaml
new file mode 100644
index 000000000..0a6d3c67d
--- /dev/null
+++ b/integration/fixtures/knative/04-serving-tests-namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: serving-tests
diff --git a/integration/fixtures/knative/tools.go b/integration/fixtures/knative/tools.go
new file mode 100644
index 000000000..02790a0e8
--- /dev/null
+++ b/integration/fixtures/knative/tools.go
@@ -0,0 +1,14 @@
+//go:build tools
+
+package tools
+
+// The following dependencies are required by the Knative conformance tests.
+// They allow to download the test_images when calling "go mod vendor".
+import (
+	_ "knative.dev/networking/test/test_images/grpc-ping"
+	_ "knative.dev/networking/test/test_images/httpproxy"
+	_ "knative.dev/networking/test/test_images/retry"
+	_ "knative.dev/networking/test/test_images/runtime"
+	_ "knative.dev/networking/test/test_images/timeout"
+	_ "knative.dev/networking/test/test_images/wsserver"
+)
diff --git a/integration/fixtures/knative/upload-test-images.sh b/integration/fixtures/knative/upload-test-images.sh
new file mode 100755
index 000000000..cbbacb9b8
--- /dev/null
+++ b/integration/fixtures/knative/upload-test-images.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+
+function upload_test_images() {
+  echo ">> Publishing test images"
+  (
+    # Script needs to be executed from repo root
+    cd "$( dirname "$0")/../../../"
+    echo "Current working directory: $(pwd)"
+    local image_dir="vendor/knative.dev/networking/test/test_images"
+    local docker_tag=$1
+    local tag_option=""
+    if [ -n "${docker_tag}" ]; then
+      tag_option="--tags $docker_tag,latest"
+    fi
+
+    # ko resolve is being used for the side-effect of publishing images,
+    # so the resulting yaml produced is ignored.
+    # shellcheck disable=SC2086
+    ko resolve --jobs=4 ${tag_option} -RBf "${image_dir}" > /dev/null
+  )
+}
+
+: "${KO_DOCKER_REPO:?"You must set 'KO_DOCKER_REPO', see DEVELOPMENT.md"}"
+
+upload_test_images "$@"
diff --git a/integration/fixtures/leasttime_server.toml b/integration/fixtures/leasttime_server.toml
new file mode 100644
index 000000000..263fe906a
--- /dev/null
+++ b/integration/fixtures/leasttime_server.toml
@@ -0,0 +1,36 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[api]
+  insecure = true
+
+[log]
+  level = "DEBUG"
+  noColor = true
+
+[entryPoints]
+
+  [entryPoints.web]
+    address = ":8000"
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[http.routers]
+  [http.routers.router]
+    service = "service1"
+    rule = "Path(`/whoami`)"
+
+[http.services]
+
+  [http.services.service1.loadBalancer]
+    strategy = "leasttime"
+    [[http.services.service1.loadBalancer.servers]]
+      url = "{{ .Server1 }}"
+      weight = 1
+    [[http.services.service1.loadBalancer.servers]]
+      url = "{{ .Server2 }}"
+      weight = 1
diff --git a/integration/fixtures/routing/multi_layer_auth.toml b/integration/fixtures/routing/multi_layer_auth.toml
new file mode 100644
index 000000000..59d91c90f
--- /dev/null
+++ b/integration/fixtures/routing/multi_layer_auth.toml
@@ -0,0 +1,51 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[log]
+  level = "DEBUG"
+  noColor = true
+
+[entryPoints]
+  [entryPoints.web]
+    address = ":8000"
+
+[api]
+  insecure = true
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## Dynamic Configuration ##
+
+[http.middlewares]
+  [http.middlewares.auth-middleware.forwardAuth]
+    address = "http://127.0.0.1:{{ .AuthPort }}/auth"
+    authResponseHeaders = ["X-User-Role", "X-User-Name"]
+
+[http.services]
+  [http.services.admin-service.loadBalancer]
+    [[http.services.admin-service.loadBalancer.servers]]
+      url = "http://{{ .AdminIP }}:80"
+
+  [http.services.developer-service.loadBalancer]
+    [[http.services.developer-service.loadBalancer.servers]]
+      url = "http://{{ .DeveloperIP }}:80"
+
+[http.routers]
+  # Parent router: matches path, applies auth middleware
+  [http.routers.parent-router]
+    rule = "PathPrefix(`/whoami`)"
+    middlewares = ["auth-middleware"]
+
+  # Child router for admin role
+  [http.routers.admin-router]
+    rule = "Header(`X-User-Role`, `admin`)"
+    service = "admin-service"
+    parentRefs = ["parent-router"]
+
+  # Child router for developer role
+  [http.routers.developer-router]
+    rule = "Header(`X-User-Role`, `developer`)"
+    service = "developer-service"
+    parentRefs = ["parent-router"]
diff --git a/integration/fixtures/simple_deny.toml b/integration/fixtures/simple_deny.toml
new file mode 100644
index 000000000..36168fd40
--- /dev/null
+++ b/integration/fixtures/simple_deny.toml
@@ -0,0 +1,20 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[entryPoints]
+  [entryPoints.web]
+    address = ":8000"
+
+[api]
+  insecure = true
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[http.routers]
+  [http.routers.router]
+    service = "noop@internal"
+    rule = "Host(`deny.localhost`)"
diff --git a/integration/fixtures/simple_encoded_chars.toml b/integration/fixtures/simple_encoded_chars.toml
new file mode 100644
index 000000000..669c60b9b
--- /dev/null
+++ b/integration/fixtures/simple_encoded_chars.toml
@@ -0,0 +1,40 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[log]
+  level = "DEBUG"
+
+[entryPoints]
+  [entryPoints.strict]
+    address = ":8000"
+    [entryPoints.strict.http.encodedCharacters]
+        allowEncodedSlash = false
+
+  [entryPoints.permissive]
+    address = ":8001"
+    # No config, default values should apply
+
+  [entryPoints.permissive2]
+    address = ":8002"
+    # No config for allowEncodedSlash, default value is effectively true
+    [entryPoints.permissive.http.encodedCharacters]
+        allowEncodedBackSlash = false
+
+[api]
+  insecure = true
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[http.routers]
+  [http.routers.sameRouter]
+    service = "service1"
+    rule = "Host(`test.localhost`)"
+
+[http.services]
+  [http.services.service1.loadBalancer]
+    [[http.services.service1.loadBalancer.servers]]
+      url = "{{ .Server1 }}"
diff --git a/integration/fixtures/tcp_healthcheck/simple.toml b/integration/fixtures/tcp_healthcheck/simple.toml
new file mode 100644
index 000000000..4897052e9
--- /dev/null
+++ b/integration/fixtures/tcp_healthcheck/simple.toml
@@ -0,0 +1,52 @@
+[global]
+  checkNewVersion = false
+  sendAnonymousUsage = false
+
+[log]
+  level = "DEBUG"
+  noColor = true
+
+[entryPoints]
+  [entryPoints.tcp]
+    address = ":8093"
+
+[api]
+  insecure = true
+
+[providers.file]
+  filename = "{{ .SelfFilename }}"
+
+## dynamic configuration ##
+
+[tcp.routers]
+  [tcp.routers.router1]
+    rule = "HostSNI(`*`)"
+    service = "weightedservice"
+
+[tcp.services]
+  [tcp.services.weightedservice.weighted]
+    [tcp.services.weightedservice.weighted.healthCheck]
+    [[tcp.services.weightedservice.weighted.services]]
+      name = "service1"
+      weight = 1
+    [[tcp.services.weightedservice.weighted.services]]
+      name = "service2"
+      weight = 1
+
+  [tcp.services.service1.loadBalancer]
+    [tcp.services.service1.loadBalancer.healthCheck]
+      interval = "500ms"
+      timeout = "500ms"
+      send = "PING"
+      expect = "Received: PING"
+    [[tcp.services.service1.loadBalancer.servers]]
+      address = "{{.Server1}}:8080"
+
+  [tcp.services.service2.loadBalancer]
+    [tcp.services.service2.loadBalancer.healthCheck]
+      interval = "500ms"
+      timeout = "500ms"
+      send = "PING"
+      expect = "Received: PING"
+    [[tcp.services.service2.loadBalancer.servers]]
+      address = "{{.Server2}}:8080"
diff --git a/integration/conformance-reports/v1.3.0/experimental-v3.5-default-report.yaml b/integration/gateway-api-conformance-reports/v1.4.0/experimental-v3.6-default-report.yaml
similarity index 93%
rename from integration/conformance-reports/v1.3.0/experimental-v3.5-default-report.yaml
rename to integration/gateway-api-conformance-reports/v1.4.0/experimental-v3.6-default-report.yaml
index 0facbd714..429592e4a 100644
--- a/integration/conformance-reports/v1.3.0/experimental-v3.5-default-report.yaml
+++ b/integration/gateway-api-conformance-reports/v1.4.0/experimental-v3.6-default-report.yaml
@@ -1,14 +1,14 @@
 apiVersion: gateway.networking.k8s.io/v1
 date: '-'
 gatewayAPIChannel: experimental
-gatewayAPIVersion: v1.3.0
+gatewayAPIVersion: v1.4.0
 implementation:
   contact:
   - '@traefik/maintainers'
   organization: traefik
   project: traefik
   url: https://traefik.io/
-  version: v3.5
+  version: v3.6
 kind: ConformanceReport
 mode: default
 profiles:
@@ -16,7 +16,7 @@ profiles:
     result: success
     statistics:
       Failed: 0
-      Passed: 12
+      Passed: 13
       Skipped: 0
   name: GATEWAY-GRPC
   summary: Core tests succeeded.
@@ -52,6 +52,8 @@ profiles:
     - GatewayStaticAddresses
     - HTTPRouteBackendRequestHeaderModification
     - HTTPRouteBackendTimeout
+    - HTTPRouteCORS
+    - HTTPRouteNamedRouteRule
     - HTTPRouteParentRefPort
     - HTTPRouteRequestMirror
     - HTTPRouteRequestMultipleMirrors
diff --git a/integration/k8s_conformance_test.go b/integration/gateway_api_conformance_test.go
similarity index 83%
rename from integration/k8s_conformance_test.go
rename to integration/gateway_api_conformance_test.go
index 1e03f223b..9a25125d6 100644
--- a/integration/k8s_conformance_test.go
+++ b/integration/gateway_api_conformance_test.go
@@ -1,3 +1,5 @@
+//go:build gatewayAPIConformance
+
 package integration
 
 import (
@@ -37,15 +39,8 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
-const (
-	k3sImage          = "docker.io/rancher/k3s:v1.29.3-k3s1"
-	traefikImage      = "traefik/traefik:latest"
-	traefikDeployment = "deployments/traefik"
-	traefikNamespace  = "traefik"
-)
-
-// K8sConformanceSuite tests suite.
-type K8sConformanceSuite struct {
+// GatewayAPIConformanceSuite tests suite.
+type GatewayAPIConformanceSuite struct {
 	BaseSuite
 
 	k3sContainer *k3s.K3sContainer
@@ -54,15 +49,11 @@ type K8sConformanceSuite struct {
 	clientSet    *kclientset.Clientset
 }
 
-func TestK8sConformanceSuite(t *testing.T) {
-	suite.Run(t, new(K8sConformanceSuite))
+func TestGatewayAPIConformanceSuite(t *testing.T) {
+	suite.Run(t, new(GatewayAPIConformanceSuite))
 }
 
-func (s *K8sConformanceSuite) SetupSuite() {
-	if !*k8sConformance {
-		s.T().Skip("Skip because it can take a long time to execute. To enable pass the `k8sConformance` flag.")
-	}
-
+func (s *GatewayAPIConformanceSuite) SetupSuite() {
 	s.BaseSuite.SetupSuite()
 
 	// Avoid panic.
@@ -89,9 +80,9 @@ func (s *K8sConformanceSuite) SetupSuite() {
 
 	s.k3sContainer, err = k3s.Run(ctx,
 		k3sImage,
-		k3s.WithManifest("./fixtures/k8s-conformance/00-experimental-v1.3.0.yml"),
-		k3s.WithManifest("./fixtures/k8s-conformance/01-rbac.yml"),
-		k3s.WithManifest("./fixtures/k8s-conformance/02-traefik.yml"),
+		k3s.WithManifest("./fixtures/gateway-api-conformance/00-experimental-v1.4.0.yml"),
+		k3s.WithManifest("./fixtures/gateway-api-conformance/01-rbac.yml"),
+		k3s.WithManifest("./fixtures/gateway-api-conformance/02-traefik.yml"),
 		network.WithNetwork(nil, s.network),
 	)
 	if err != nil {
@@ -144,7 +135,7 @@ func (s *K8sConformanceSuite) SetupSuite() {
 	}
 }
 
-func (s *K8sConformanceSuite) TearDownSuite() {
+func (s *GatewayAPIConformanceSuite) TearDownSuite() {
 	ctx := s.T().Context()
 
 	if s.T().Failed() || *showLog {
@@ -170,7 +161,7 @@ func (s *K8sConformanceSuite) TearDownSuite() {
 	s.BaseSuite.TearDownSuite()
 }
 
-func (s *K8sConformanceSuite) TestK8sGatewayAPIConformance() {
+func (s *GatewayAPIConformanceSuite) TestK8sGatewayAPIConformance() {
 	// Wait for traefik to start
 	k3sContainerIP, err := s.k3sContainer.ContainerIP(s.T().Context())
 	require.NoError(s.T(), err)
@@ -188,12 +179,12 @@ func (s *K8sConformanceSuite) TestK8sGatewayAPIConformance() {
 		TimeoutConfig:              config.DefaultTimeoutConfig(),
 		ManifestFS:                 []fs.FS{&conformance.Manifests},
 		EnableAllSupportedFeatures: false,
-		RunTest:                    *k8sConformanceRunTest,
+		RunTest:                    *gatewayAPIConformanceRunTest,
 		Implementation: v1.Implementation{
 			Organization: "traefik",
 			Project:      "traefik",
 			URL:          "https://traefik.io/",
-			Version:      *k8sConformanceTraefikVersion,
+			Version:      *traefikVersion,
 			Contact:      []string{"@traefik/maintainers"},
 		},
 		ConformanceProfiles: sets.New(
@@ -227,8 +218,8 @@ func (s *K8sConformanceSuite) TestK8sGatewayAPIConformance() {
 	require.NoError(s.T(), err)
 	s.T().Logf("Conformance report:\n%s", string(rawReport))
 
-	require.NoError(s.T(), os.MkdirAll("./conformance-reports/"+report.GatewayAPIVersion, 0o755))
-	outFile := filepath.Join("conformance-reports/"+report.GatewayAPIVersion, fmt.Sprintf("%s-%s-%s-report.yaml", report.GatewayAPIChannel, report.Version, report.Mode))
+	require.NoError(s.T(), os.MkdirAll("./gateway-api-conformance-reports/"+report.GatewayAPIVersion, 0o755))
+	outFile := filepath.Join("gateway-api-conformance-reports/"+report.GatewayAPIVersion, fmt.Sprintf("%s-%s-%s-report.yaml", report.GatewayAPIChannel, report.Version, report.Mode))
 	require.NoError(s.T(), os.WriteFile(outFile, rawReport, 0o600))
 	s.T().Logf("Report written to: %s", outFile)
 }
diff --git a/integration/healthcheck_test.go b/integration/healthcheck_test.go
index 1276f09dd..6ab2ac618 100644
--- a/integration/healthcheck_test.go
+++ b/integration/healthcheck_test.go
@@ -108,6 +108,53 @@ func (s *HealthCheckSuite) TestSimpleConfiguration() {
 	assert.Equal(s.T(), http.StatusNotFound, resp.StatusCode)
 }
 
+func (s *HealthCheckSuite) TestSimpleConfiguration_Passive() {
+	file := s.adaptFile("fixtures/healthcheck/simple_passive.toml", struct {
+		Server1 string
+	}{s.whoami1IP})
+
+	s.traefikCmd(withConfigFile(file))
+
+	// wait for traefik
+	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 60*time.Second, try.BodyContains("Host(`test.localhost`)"))
+	require.NoError(s.T(), err)
+
+	frontendHealthReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/health", nil)
+	require.NoError(s.T(), err)
+	frontendHealthReq.Host = "test.localhost"
+
+	err = try.Request(frontendHealthReq, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK))
+	require.NoError(s.T(), err)
+
+	// Fix all whoami health to 500
+	client := &http.Client{}
+	whoamiHosts := []string{s.whoami1IP, s.whoami2IP}
+	for _, whoami := range whoamiHosts {
+		statusInternalServerErrorReq, err := http.NewRequest(http.MethodPost, "http://"+whoami+"/health", bytes.NewBufferString("500"))
+		require.NoError(s.T(), err)
+		_, err = client.Do(statusInternalServerErrorReq)
+		require.NoError(s.T(), err)
+	}
+
+	// First call, the passive health check is not yet triggered, so we expect a 500.
+	err = try.Request(frontendHealthReq, 3*time.Second, try.StatusCodeIs(http.StatusInternalServerError))
+	require.NoError(s.T(), err)
+
+	// Verify no backend service is available due to failing health checks
+	err = try.Request(frontendHealthReq, 3*time.Second, try.StatusCodeIs(http.StatusServiceUnavailable))
+	require.NoError(s.T(), err)
+
+	// Change one whoami health to 200
+	statusOKReq1, err := http.NewRequest(http.MethodPost, "http://"+s.whoami1IP+"/health", bytes.NewBufferString("200"))
+	require.NoError(s.T(), err)
+	_, err = client.Do(statusOKReq1)
+	require.NoError(s.T(), err)
+
+	// Verify frontend health : after
+	err = try.Request(frontendHealthReq, 3*time.Second, try.StatusCodeIs(http.StatusOK))
+	require.NoError(s.T(), err)
+}
+
 func (s *HealthCheckSuite) TestMultipleEntrypoints() {
 	file := s.adaptFile("fixtures/healthcheck/multiple-entrypoints.toml", struct {
 		Server1 string
diff --git a/integration/integration_test.go b/integration/integration_test.go
index bb0fc2bfd..9ef4f8782 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -37,12 +37,17 @@ import (
 
 var (
 	showLog                      = flag.Bool("tlog", false, "always show Traefik logs")
-	k8sConformance               = flag.Bool("k8sConformance", false, "run K8s Gateway API conformance test")
-	k8sConformanceRunTest        = flag.String("k8sConformanceRunTest", "", "run a specific K8s Gateway API conformance test")
-	k8sConformanceTraefikVersion = flag.String("k8sConformanceTraefikVersion", "dev", "specify the Traefik version for the K8s Gateway API conformance report")
+	gatewayAPIConformanceRunTest = flag.String("gatewayAPIConformanceRunTest", "", "runs a specific Gateway API conformance test")
+	traefikVersion               = flag.String("traefikVersion", "dev", "defines the Traefik version")
 )
 
-const tailscaleSecretFilePath = "tailscale.secret"
+const (
+	k3sImage                = "docker.io/rancher/k3s:v1.34.2-k3s1"
+	traefikImage            = "traefik/traefik:latest"
+	traefikDeployment       = "deployments/traefik"
+	traefikNamespace        = "traefik"
+	tailscaleSecretFilePath = "tailscale.secret"
+)
 
 type composeConfig struct {
 	Services map[string]composeService `yaml:"services"`
diff --git a/integration/k8s_test.go b/integration/k8s_test.go
index 396913538..3e81d8b0b 100644
--- a/integration/k8s_test.go
+++ b/integration/k8s_test.go
@@ -199,9 +199,9 @@ func matchesConfig(wantConfig string, buf *bytes.Buffer) try.ResponseCondition {
 		sanitizedExpected := rxURL.ReplaceAll(bytes.TrimSpace(expected), []byte(`"$1": "XXXX"`))
 		sanitizedGot := rxURL.ReplaceAll(got, []byte(`"$1": "XXXX"`))
 
-		rxServerStatus := regexp.MustCompile(`"http://.*?":\s+(".*")`)
-		sanitizedExpected = rxServerStatus.ReplaceAll(sanitizedExpected, []byte(`"http://XXXX": $1`))
-		sanitizedGot = rxServerStatus.ReplaceAll(sanitizedGot, []byte(`"http://XXXX": $1`))
+		rxServerStatus := regexp.MustCompile(`"(http://)?.*?":\s+(".*")`)
+		sanitizedExpected = rxServerStatus.ReplaceAll(sanitizedExpected, []byte(`"XXXX": $1`))
+		sanitizedGot = rxServerStatus.ReplaceAll(sanitizedGot, []byte(`"XXXX": $1`))
 
 		if bytes.Equal(sanitizedExpected, sanitizedGot) {
 			return nil
diff --git a/integration/knative_conformance_test.go b/integration/knative_conformance_test.go
new file mode 100644
index 000000000..89ffa323a
--- /dev/null
+++ b/integration/knative_conformance_test.go
@@ -0,0 +1,178 @@
+// Use a build tag to include and run Knative conformance tests.
+// The Knative conformance toolkit redefines the skip-tests flag,
+// which conflicts with the testing library and causes a panic.
+//go:build knativeConformance
+
+package integration
+
+import (
+	"flag"
+	"io"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/modules/k3s"
+	"github.com/testcontainers/testcontainers-go/network"
+	"github.com/traefik/traefik/v3/integration/try"
+	"knative.dev/networking/test/conformance/ingress"
+	klog "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+)
+
+const knativeNamespace = "knative-serving"
+
+var imageNames = []string{
+	traefikImage,
+	"ko.local/grpc-ping:latest",
+	"ko.local/httpproxy:latest",
+	"ko.local/retry:latest",
+	"ko.local/runtime:latest",
+	"ko.local/wsserver:latest",
+	"ko.local/timeout:latest",
+}
+
+type KnativeConformanceSuite struct {
+	BaseSuite
+
+	k3sContainer *k3s.K3sContainer
+}
+
+func TestKnativeConformanceSuite(t *testing.T) {
+	suite.Run(t, new(KnativeConformanceSuite))
+}
+
+func (s *KnativeConformanceSuite) SetupSuite() {
+	s.BaseSuite.SetupSuite()
+
+	// Avoid panic.
+	klog.SetLogger(zap.New())
+
+	provider, err := testcontainers.ProviderDocker.GetProvider()
+	if err != nil {
+		s.T().Fatal(err)
+	}
+
+	ctx := s.T().Context()
+
+	// Ensure image is available locally.
+	images, err := provider.ListImages(ctx)
+	if err != nil {
+		s.T().Fatal(err)
+	}
+
+	if !slices.ContainsFunc(images, func(img testcontainers.ImageInfo) bool {
+		return img.Name == traefikImage
+	}) {
+		s.T().Fatal("Traefik image is not present")
+	}
+
+	s.k3sContainer, err = k3s.Run(ctx,
+		k3sImage,
+		k3s.WithManifest("./fixtures/knative/00-knative-crd-v1.19.0.yml"),
+		k3s.WithManifest("./fixtures/knative/01-rbac.yml"),
+		k3s.WithManifest("./fixtures/knative/02-traefik.yml"),
+		k3s.WithManifest("./fixtures/knative/03-knative-serving-v1.19.0.yaml"),
+		k3s.WithManifest("./fixtures/knative/04-serving-tests-namespace.yaml"),
+		network.WithNetwork(nil, s.network),
+	)
+	if err != nil {
+		s.T().Fatal(err)
+	}
+
+	for _, imageName := range imageNames {
+		if err = s.k3sContainer.LoadImages(ctx, imageName); err != nil {
+			s.T().Fatal(err)
+		}
+	}
+
+	exitCode, _, err := s.k3sContainer.Exec(ctx, []string{"kubectl", "wait", "-n", traefikNamespace, traefikDeployment, "--for=condition=Available", "--timeout=10s"})
+	if err != nil || exitCode > 0 {
+		s.T().Fatalf("Traefik pod is not ready: %v", err)
+	}
+
+	exitCode, _, err = s.k3sContainer.Exec(ctx, []string{"kubectl", "wait", "-n", knativeNamespace, "deployment/activator", "--for=condition=Available", "--timeout=10s"})
+	if err != nil || exitCode > 0 {
+		s.T().Fatalf("Activator pod is not ready: %v", err)
+	}
+
+	exitCode, _, err = s.k3sContainer.Exec(ctx, []string{"kubectl", "wait", "-n", knativeNamespace, "deployment/controller", "--for=condition=Available", "--timeout=10s"})
+	if err != nil || exitCode > 0 {
+		s.T().Fatalf("Controller pod is not ready: %v", err)
+	}
+
+	exitCode, _, err = s.k3sContainer.Exec(ctx, []string{"kubectl", "wait", "-n", knativeNamespace, "deployment/autoscaler", "--for=condition=Available", "--timeout=10s"})
+	if err != nil || exitCode > 0 {
+		s.T().Fatalf("Autoscaler pod is not ready: %v", err)
+	}
+
+	exitCode, _, err = s.k3sContainer.Exec(ctx, []string{"kubectl", "wait", "-n", knativeNamespace, "deployment/webhook", "--for=condition=Available", "--timeout=10s"})
+	if err != nil || exitCode > 0 {
+		s.T().Fatalf("Webhook pod is not ready: %v", err)
+	}
+}
+
+func (s *KnativeConformanceSuite) TearDownSuite() {
+	ctx := s.T().Context()
+
+	if s.T().Failed() || *showLog {
+		k3sLogs, err := s.k3sContainer.Logs(ctx)
+		if err == nil {
+			if res, err := io.ReadAll(k3sLogs); err == nil {
+				s.T().Log(string(res))
+			}
+		}
+
+		exitCode, result, err := s.k3sContainer.Exec(ctx, []string{"kubectl", "logs", "-n", traefikNamespace, traefikDeployment})
+		if err == nil || exitCode == 0 {
+			if res, err := io.ReadAll(result); err == nil {
+				s.T().Log(string(res))
+			}
+		}
+	}
+
+	if err := s.k3sContainer.Terminate(ctx); err != nil {
+		s.T().Fatal(err)
+	}
+
+	s.BaseSuite.TearDownSuite()
+}
+
+func (s *KnativeConformanceSuite) TestKnativeConformance() {
+	// Wait for traefik to start
+	k3sContainerIP, err := s.k3sContainer.ContainerIP(s.T().Context())
+	require.NoError(s.T(), err)
+
+	err = try.GetRequest("http://"+k3sContainerIP+":9000/api/entrypoints", 10*time.Second, try.BodyContains(`"name":"pweb"`))
+	require.NoError(s.T(), err)
+
+	kubeconfig, err := s.k3sContainer.GetKubeConfig(s.T().Context())
+	if err != nil {
+		s.T().Fatal(err)
+	}
+
+	// Write the kubeconfig.yaml in a temp file.
+	kubeconfigFile := s.T().TempDir() + "/kubeconfig.yaml"
+
+	if err = os.WriteFile(kubeconfigFile, kubeconfig, 0o644); err != nil {
+		s.T().Fatal(err)
+	}
+
+	if err = flag.CommandLine.Set("kubeconfig", kubeconfigFile); err != nil {
+		s.T().Fatal(err)
+	}
+
+	if err = flag.CommandLine.Set("ingressClass", "traefik.ingress.networking.knative.dev"); err != nil {
+		s.T().Fatal(err)
+	}
+
+	if err = flag.CommandLine.Set("skip-tests", "headers/probe"); err != nil {
+		s.T().Fatal(err)
+	}
+
+	ingress.RunConformance(s.T())
+}
diff --git a/integration/resources/compose/docker.yml b/integration/resources/compose/docker.yml
index 7ee4492cf..783d5be38 100644
--- a/integration/resources/compose/docker.yml
+++ b/integration/resources/compose/docker.yml
@@ -36,13 +36,8 @@ services:
       traefik.http.Routers.Super.Rule: Host(`my.super.host`)
       traefik.http.Services.powpow.LoadBalancer.server.Port: 2375
 
-  wrr-server:
+  nonRunning:
     image: traefik/whoami
     labels:
-      traefik.http.Routers.wrr-server.Rule: Host(`my.wrr.host`)
-      traefik.http.Services.wrr-server.LoadBalancer.server.Weight: 4
-  wrr-server2:
-    image: traefik/whoami
-    labels:
-      traefik.http.Routers.wrr-server.Rule: Host(`my.wrr.host`)
-      traefik.http.Services.wrr-server.LoadBalancer.server.Weight: 1
+      traefik.http.Routers.NonRunning.Rule: Host(`non.running.host`)
+      traefik.docker.allownonrunning: "true"
diff --git a/integration/resources/compose/k8s.yml b/integration/resources/compose/k8s.yml
index 51e46b0be..81c098d98 100644
--- a/integration/resources/compose/k8s.yml
+++ b/integration/resources/compose/k8s.yml
@@ -1,6 +1,6 @@
 services:
   server:
-    image: rancher/k3s:v1.21.14-k3s1
+    image: rancher/k3s:v1.34.2-k3s1
     privileged: true
     command:
       - server
@@ -25,7 +25,7 @@ services:
       - ./fixtures/k8s:/var/lib/rancher/k3s/server/manifests
 
   node:
-    image: rancher/k3s:v1.21.14-k3s1
+    image: rancher/k3s:v1.34.2-k3s1
     privileged: true
     environment:
       K3S_TOKEN: somethingtotallyrandom
diff --git a/integration/resources/compose/pebble.yml b/integration/resources/compose/pebble.yml
index 4e9eac58b..621c6910f 100644
--- a/integration/resources/compose/pebble.yml
+++ b/integration/resources/compose/pebble.yml
@@ -1,8 +1,7 @@
 services:
   pebble:
-    image: letsencrypt/pebble:v2.3.1
+    image: ghcr.io/letsencrypt/pebble:2.8.0
     command:
-      - pebble
       - --dnsserver
       - host.docker.internal:5053
     environment:
diff --git a/integration/resources/compose/routing.yml b/integration/resources/compose/routing.yml
new file mode 100644
index 000000000..88bbc6d93
--- /dev/null
+++ b/integration/resources/compose/routing.yml
@@ -0,0 +1,8 @@
+services:
+  whoami-admin:
+    image: traefik/whoami
+    hostname: whoami-admin
+
+  whoami-developer:
+    image: traefik/whoami
+    hostname: whoami-developer
\ No newline at end of file
diff --git a/integration/resources/compose/tcp_healthcheck.yml b/integration/resources/compose/tcp_healthcheck.yml
new file mode 100644
index 000000000..fe7d93b68
--- /dev/null
+++ b/integration/resources/compose/tcp_healthcheck.yml
@@ -0,0 +1,12 @@
+services:
+  whoamitcp1:
+    image: traefik/whoamitcp
+    command:
+      - -name
+      - whoamitcp1
+
+  whoamitcp2:
+    image: traefik/whoamitcp
+    command:
+      - -name
+      - whoamitcp2
diff --git a/integration/routing_test.go b/integration/routing_test.go
new file mode 100644
index 000000000..8f643802b
--- /dev/null
+++ b/integration/routing_test.go
@@ -0,0 +1,154 @@
+package integration
+
+import (
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"github.com/traefik/traefik/v3/integration/try"
+)
+
+// RoutingSuite tests multi-layer routing with authentication middleware.
+type RoutingSuite struct{ BaseSuite }
+
+func TestRoutingSuite(t *testing.T) {
+	suite.Run(t, new(RoutingSuite))
+}
+
+func (s *RoutingSuite) SetupSuite() {
+	s.BaseSuite.SetupSuite()
+
+	s.createComposeProject("routing")
+	s.composeUp()
+}
+
+func (s *RoutingSuite) TearDownSuite() {
+	s.BaseSuite.TearDownSuite()
+}
+
+// authHandler implements the ForwardAuth protocol.
+// It validates Bearer tokens and adds X-User-Role and X-User-Name headers.
+func authHandler(w http.ResponseWriter, r *http.Request) {
+	authHeader := r.Header.Get("Authorization")
+	if authHeader == "" {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	if !strings.HasPrefix(authHeader, "Bearer ") {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	token := strings.TrimPrefix(authHeader, "Bearer ")
+	role, username, ok := getUserByToken(token)
+	if !ok {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	// Set headers that will be forwarded by Traefik
+	w.Header().Set("X-User-Role", role)
+	w.Header().Set("X-User-Name", username)
+	w.WriteHeader(http.StatusOK)
+}
+
+// getUserByToken returns the role and username for a given token.
+func getUserByToken(token string) (role, username string, ok bool) {
+	users := map[string]struct {
+		role     string
+		username string
+	}{
+		"bob-token":   {role: "admin", username: "bob"},
+		"jack-token":  {role: "developer", username: "jack"},
+		"alice-token": {role: "guest", username: "alice"},
+	}
+
+	u, exists := users[token]
+	return u.role, u.username, exists
+}
+
+// TestMultiLayerRoutingWithAuth tests the complete multi layer routing scenario:
+// - Parent router matches path and applies authentication middleware
+// - Auth middleware validates token and adds role header
+// - Child routers route based on the role header added by the middleware
+func (s *RoutingSuite) TestMultiLayerRoutingWithAuth() {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(s.T(), err)
+	defer listener.Close()
+
+	_, authPort, err := net.SplitHostPort(listener.Addr().String())
+	require.NoError(s.T(), err)
+
+	go func() {
+		_ = http.Serve(listener, http.HandlerFunc(authHandler))
+	}()
+
+	adminIP := s.getComposeServiceIP("whoami-admin")
+	require.NotEmpty(s.T(), adminIP)
+
+	developerIP := s.getComposeServiceIP("whoami-developer")
+	require.NotEmpty(s.T(), developerIP)
+
+	file := s.adaptFile("fixtures/routing/multi_layer_auth.toml", struct {
+		AuthPort    string
+		AdminIP     string
+		DeveloperIP string
+	}{
+		AuthPort:    authPort,
+		AdminIP:     adminIP,
+		DeveloperIP: developerIP,
+	})
+
+	s.traefikCmd(withConfigFile(file))
+
+	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 2*time.Second, try.BodyContains("parent-router"))
+	require.NoError(s.T(), err)
+
+	// Test 1: bob (admin role) routes to admin-service
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	require.NoError(s.T(), err)
+	req.Header.Set("Authorization", "Bearer bob-token")
+
+	err = try.Request(req, 2*time.Second,
+		try.StatusCodeIs(http.StatusOK),
+		try.BodyContains("whoami-admin"))
+	require.NoError(s.T(), err)
+
+	// Test 2: jack (developer role) routes to developer-service
+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	require.NoError(s.T(), err)
+	req.Header.Set("Authorization", "Bearer jack-token")
+
+	err = try.Request(req, 2*time.Second,
+		try.StatusCodeIs(http.StatusOK),
+		try.BodyContains("whoami-developer"))
+	require.NoError(s.T(), err)
+
+	// Test 3: Invalid token returns 401
+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	require.NoError(s.T(), err)
+	req.Header.Set("Authorization", "Bearer invalid-token")
+
+	err = try.Request(req, 2*time.Second, try.StatusCodeIs(http.StatusUnauthorized))
+	require.NoError(s.T(), err)
+
+	// Test 4: Missing token returns 401
+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	require.NoError(s.T(), err)
+
+	err = try.Request(req, 2*time.Second, try.StatusCodeIs(http.StatusUnauthorized))
+	require.NoError(s.T(), err)
+
+	// Test 5: Valid auth but role has no matching child router returns 404
+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	require.NoError(s.T(), err)
+	req.Header.Set("Authorization", "Bearer alice-token")
+
+	err = try.Request(req, 2*time.Second, try.StatusCodeIs(http.StatusNotFound))
+	require.NoError(s.T(), err)
+}
diff --git a/integration/simple_test.go b/integration/simple_test.go
index 675e21c3d..16c743829 100644
--- a/integration/simple_test.go
+++ b/integration/simple_test.go
@@ -885,6 +885,109 @@ func (s *SimpleSuite) TestWRRServer() {
 	assert.Equal(s.T(), 1, repartition[whoami2IP])
 }
 
+func (s *SimpleSuite) TestLeastTimeServer() {
+	s.createComposeProject("base")
+
+	s.composeUp()
+	defer s.composeDown()
+
+	whoami1IP := s.getComposeServiceIP("whoami1")
+	whoami2IP := s.getComposeServiceIP("whoami2")
+
+	file := s.adaptFile("fixtures/leasttime_server.toml", struct {
+		Server1 string
+		Server2 string
+	}{Server1: "http://" + whoami1IP, Server2: "http://" + whoami2IP})
+
+	s.traefikCmd(withConfigFile(file))
+
+	err := try.GetRequest("http://127.0.0.1:8080/api/http/services", 1000*time.Millisecond, try.BodyContains("service1"))
+	require.NoError(s.T(), err)
+
+	// Verify leasttime strategy is configured
+	err = try.GetRequest("http://127.0.0.1:8080/api/http/services", 1000*time.Millisecond, try.BodyContains("leasttime"))
+	require.NoError(s.T(), err)
+
+	// Make requests and verify both servers respond
+	repartition := map[string]int{}
+	for range 10 {
+		req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+		require.NoError(s.T(), err)
+
+		response, err := http.DefaultClient.Do(req)
+		require.NoError(s.T(), err)
+		assert.Equal(s.T(), http.StatusOK, response.StatusCode)
+
+		body, err := io.ReadAll(response.Body)
+		require.NoError(s.T(), err)
+
+		if strings.Contains(string(body), whoami1IP) {
+			repartition[whoami1IP]++
+		}
+		if strings.Contains(string(body), whoami2IP) {
+			repartition[whoami2IP]++
+		}
+	}
+
+	// Both servers should have received requests
+	assert.Positive(s.T(), repartition[whoami1IP])
+	assert.Positive(s.T(), repartition[whoami2IP])
+}
+
+func (s *SimpleSuite) TestLeastTimeHeterogeneousPerformance() {
+	// Create test servers with different response times
+	var fastServerCalls, slowServerCalls atomic.Int32
+
+	fastServer := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		fastServerCalls.Add(1)
+		time.Sleep(10 * time.Millisecond) // Fast server
+		rw.WriteHeader(http.StatusOK)
+		_, _ = rw.Write([]byte("fast-server"))
+	}))
+	defer fastServer.Close()
+
+	slowServer := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		slowServerCalls.Add(1)
+		time.Sleep(100 * time.Millisecond) // Slow server
+		rw.WriteHeader(http.StatusOK)
+		_, _ = rw.Write([]byte("slow-server"))
+	}))
+	defer slowServer.Close()
+
+	file := s.adaptFile("fixtures/leasttime_server.toml", struct {
+		Server1 string
+		Server2 string
+	}{Server1: fastServer.URL, Server2: slowServer.URL})
+
+	s.traefikCmd(withConfigFile(file))
+
+	err := try.GetRequest("http://127.0.0.1:8080/api/http/services", 1000*time.Millisecond, try.BodyContains("service1"))
+	require.NoError(s.T(), err)
+
+	// Make 20 requests to build up response time statistics
+	for range 20 {
+		req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+		require.NoError(s.T(), err)
+
+		response, err := http.DefaultClient.Do(req)
+		require.NoError(s.T(), err)
+		assert.Equal(s.T(), http.StatusOK, response.StatusCode)
+		_, _ = io.ReadAll(response.Body)
+		response.Body.Close()
+	}
+
+	// Verify that the fast server received significantly more requests (>70%)
+	fastCalls := fastServerCalls.Load()
+	slowCalls := slowServerCalls.Load()
+	totalCalls := fastCalls + slowCalls
+
+	assert.Equal(s.T(), int32(20), totalCalls)
+
+	// Fast server should get >70% of traffic due to lower response time
+	fastPercentage := float64(fastCalls) / float64(totalCalls) * 100
+	assert.Greater(s.T(), fastPercentage, 70.0)
+}
+
 func (s *SimpleSuite) TestWRR() {
 	s.createComposeProject("base")
 
@@ -1217,6 +1320,74 @@ func (s *SimpleSuite) TestMirrorCanceled() {
 	assert.Equal(s.T(), int32(0), val2)
 }
 
+func (s *SimpleSuite) TestHighestRandomWeight() {
+	var count1, count2, count3 int32
+
+	service1 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		atomic.AddInt32(&count1, 1)
+		rw.WriteHeader(http.StatusOK)
+	}))
+
+	service2 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		atomic.AddInt32(&count2, 1)
+		rw.WriteHeader(http.StatusOK)
+	}))
+
+	service3 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		atomic.AddInt32(&count3, 1)
+		rw.WriteHeader(http.StatusOK)
+	}))
+
+	service1Server := service1.URL
+	service2Server := service2.URL
+	service3Server := service3.URL
+
+	file := s.adaptFile("fixtures/highest_random_weight.toml", struct {
+		Service1Server string
+		Service2Server string
+		Service3Server string
+	}{Service1Server: service1Server, Service2Server: service2Server, Service3Server: service3Server})
+
+	s.traefikCmd(withConfigFile(file))
+
+	err := try.GetRequest("http://127.0.0.1:8080/api/http/services", 3*time.Second, try.BodyContains("service1", "service2", "service3", "hrw"))
+	require.NoError(s.T(), err)
+
+	// Make 10 requests from the same client (127.0.0.1) - should all go to the same service
+	client := &http.Client{}
+	for range 10 {
+		req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+		require.NoError(s.T(), err)
+
+		response, err := client.Do(req)
+		require.NoError(s.T(), err)
+		assert.Equal(s.T(), http.StatusOK, response.StatusCode)
+		response.Body.Close()
+	}
+
+	// Check if all requests went to the same service
+	val1 := atomic.LoadInt32(&count1)
+	val2 := atomic.LoadInt32(&count2)
+	val3 := atomic.LoadInt32(&count3)
+
+	// All requests should have been handled (total should be 10)
+	assert.Equal(s.T(), int32(10), val1+val2+val3)
+
+	// All requests from same remoteAddr (127.0.0.1) should go to exactly one service
+	servicesUsed := 0
+	if val1 > 0 {
+		servicesUsed++
+	}
+	if val2 > 0 {
+		servicesUsed++
+	}
+	if val3 > 0 {
+		servicesUsed++
+	}
+
+	assert.Equal(s.T(), 1, servicesUsed, "All requests from same remoteAddr should go to exactly one service")
+}
+
 func (s *SimpleSuite) TestSecureAPI() {
 	s.createComposeProject("base")
 
@@ -1524,16 +1695,15 @@ func (s *SimpleSuite) TestDenyFragment() {
 	s.composeUp()
 	defer s.composeDown()
 
-	s.traefikCmd(withConfigFile("fixtures/simple_default.toml"))
+	s.traefikCmd(withConfigFile(s.adaptFile("fixtures/simple_deny.toml", struct{}{})))
 
-	// Expected a 404 as we did not configure anything
-	err := try.GetRequest("http://127.0.0.1:8000/", 1*time.Second, try.StatusCodeIs(http.StatusNotFound))
+	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`deny.localhost`)"))
 	require.NoError(s.T(), err)
 
 	conn, err := net.Dial("tcp", "127.0.0.1:8000")
 	require.NoError(s.T(), err)
 
-	_, err = conn.Write([]byte("GET /#/?bar=toto;boo=titi HTTP/1.1\nHost: other.localhost\n\n"))
+	_, err = conn.Write([]byte("GET /#/?bar=toto;boo=titi HTTP/1.1\nHost: deny.localhost\n\n"))
 	require.NoError(s.T(), err)
 
 	resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
@@ -1922,3 +2092,84 @@ func (s *SimpleSuite) TestSanitizePathSyntaxV2() {
 		}
 	}
 }
+
+// TestEncodedCharactersDifferentEntryPoints verifies that router handler caching does not interfere with
+// per-entry-point encoded characters configuration.
+// The same router should behave differently on different entry points.
+func (s *SimpleSuite) TestEncodedCharactersDifferentEntryPoints() {
+	s.createComposeProject("base")
+
+	s.composeUp()
+	defer s.composeDown()
+
+	whoami1URL := "http://" + net.JoinHostPort(s.getComposeServiceIP("whoami1"), "80")
+
+	file := s.adaptFile("fixtures/simple_encoded_chars.toml", struct {
+		Server1 string
+	}{whoami1URL})
+
+	s.traefikCmd(withConfigFile(file))
+
+	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`test.localhost`)"))
+	require.NoError(s.T(), err)
+
+	testCases := []struct {
+		desc     string
+		request  string
+		target   string
+		expected int
+	}{
+		{
+			desc:     "Encoded slash should be REJECTED on strict entry point",
+			request:  "GET /path%2Fwith%2Fslash HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8000", // strict entry point
+			expected: http.StatusBadRequest,
+		},
+		{
+			desc:     "Encoded slash should be ALLOWED on permissive entry point",
+			request:  "GET /path%2Fwith%2Fslash HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8001", // permissive entry point
+			expected: http.StatusOK,
+		},
+		{
+			desc:     "Encoded slash should be ALLOWED on permissive2 entry point",
+			request:  "GET /path%2Fwith%2Fslash HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8002", // permissive2 entry point
+			expected: http.StatusOK,
+		},
+		{
+			desc:     "Regular path should work on strict entry point",
+			request:  "GET /regular/path HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8000",
+			expected: http.StatusOK,
+		},
+		{
+			desc:     "Regular path should work on permissive entry point",
+			request:  "GET /regular/path HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8001",
+			expected: http.StatusOK,
+		},
+		{
+			desc:     "Regular path should work on permissive2 entry point",
+			request:  "GET /regular/path HTTP/1.1\r\nHost: test.localhost\r\n\r\n",
+			target:   "127.0.0.1:8002",
+			expected: http.StatusOK,
+		},
+	}
+
+	for _, test := range testCases {
+		conn, err := net.Dial("tcp", test.target)
+		require.NoError(s.T(), err)
+
+		_, err = conn.Write([]byte(test.request))
+		require.NoError(s.T(), err)
+
+		resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
+		require.NoError(s.T(), err)
+
+		assert.Equalf(s.T(), test.expected, resp.StatusCode, "%s failed with %d instead of %d", test.desc, resp.StatusCode, test.expected)
+
+		err = conn.Close()
+		require.NoError(s.T(), err)
+	}
+}
diff --git a/integration/tcp_healthcheck_test.go b/integration/tcp_healthcheck_test.go
new file mode 100644
index 000000000..d79fb610b
--- /dev/null
+++ b/integration/tcp_healthcheck_test.go
@@ -0,0 +1,114 @@
+package integration
+
+import (
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"github.com/traefik/traefik/v3/integration/try"
+)
+
+// TCPHealthCheckSuite test suite for TCP health checks.
+type TCPHealthCheckSuite struct {
+	BaseSuite
+	whoamitcp1IP string
+	whoamitcp2IP string
+}
+
+func TestTCPHealthCheckSuite(t *testing.T) {
+	suite.Run(t, new(TCPHealthCheckSuite))
+}
+
+func (s *TCPHealthCheckSuite) SetupSuite() {
+	s.BaseSuite.SetupSuite()
+
+	s.createComposeProject("tcp_healthcheck")
+	s.composeUp()
+
+	s.whoamitcp1IP = s.getComposeServiceIP("whoamitcp1")
+	s.whoamitcp2IP = s.getComposeServiceIP("whoamitcp2")
+}
+
+func (s *TCPHealthCheckSuite) TearDownSuite() {
+	s.BaseSuite.TearDownSuite()
+}
+
+func (s *TCPHealthCheckSuite) TestSimpleConfiguration() {
+	file := s.adaptFile("fixtures/tcp_healthcheck/simple.toml", struct {
+		Server1 string
+		Server2 string
+	}{s.whoamitcp1IP, s.whoamitcp2IP})
+
+	s.traefikCmd(withConfigFile(file))
+
+	// Wait for Traefik.
+	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 60*time.Second, try.BodyContains("HostSNI(`*`)"))
+	require.NoError(s.T(), err)
+
+	// Test that we can consistently reach servers through load balancing.
+	var (
+		successfulConnectionsWhoamitcp1 int
+		successfulConnectionsWhoamitcp2 int
+	)
+	for range 4 {
+		out := s.whoIs("127.0.0.1:8093")
+		require.NoError(s.T(), err)
+
+		if strings.Contains(out, "whoamitcp1") {
+			successfulConnectionsWhoamitcp1++
+		}
+		if strings.Contains(out, "whoamitcp2") {
+			successfulConnectionsWhoamitcp2++
+		}
+	}
+
+	assert.Equal(s.T(), 2, successfulConnectionsWhoamitcp1)
+	assert.Equal(s.T(), 2, successfulConnectionsWhoamitcp2)
+
+	// Stop one whoamitcp2 containers to simulate health check failure.
+	conn, err := net.DialTimeout("tcp", s.whoamitcp2IP+":8080", time.Second)
+	require.NoError(s.T(), err)
+
+	s.T().Cleanup(func() {
+		_ = conn.Close()
+	})
+
+	s.composeStop("whoamitcp2")
+
+	// Wait for the health check to detect the failure.
+	time.Sleep(1 * time.Second)
+
+	// Verify that the remaining server still responds.
+	for range 3 {
+		out := s.whoIs("127.0.0.1:8093")
+		require.NoError(s.T(), err)
+		assert.Contains(s.T(), out, "whoamitcp1")
+	}
+}
+
+// connectTCP connects to the given TCP address and returns the response.
+func (s *TCPHealthCheckSuite) whoIs(addr string) string {
+	s.T().Helper()
+
+	conn, err := net.DialTimeout("tcp", addr, time.Second)
+	require.NoError(s.T(), err)
+
+	s.T().Cleanup(func() {
+		_ = conn.Close()
+	})
+
+	_, err = conn.Write([]byte("WHO"))
+	require.NoError(s.T(), err)
+
+	_ = conn.SetReadDeadline(time.Now().Add(2 * time.Second))
+
+	buffer := make([]byte, 1024)
+	n, err := conn.Read(buffer)
+	require.NoError(s.T(), err)
+
+	return string(buffer[:n])
+}
diff --git a/integration/testdata/rawdata-crd.json b/integration/testdata/rawdata-crd.json
index 9f1b2d33c..ece3a7dd3 100644
--- a/integration/testdata/rawdata-crd.json
+++ b/integration/testdata/rawdata-crd.json
@@ -78,6 +78,24 @@
 				"web"
 			]
 		},
+		"default-test4-route-466d8d3a547de55dfe8a@kubernetescrd": {
+			"entryPoints": [
+				"web"
+			],
+			"service": "default-hrw1",
+			"rule": "Host(`foo.com`) \u0026\u0026 PathPrefix(`/hrw1`)",
+			"priority": 38,
+			"observability": {
+				"accessLogs": true,
+				"metrics": true,
+				"tracing": true,
+				"traceVerbosity": "minimal"
+			},
+			"status": "enabled",
+			"using": [
+				"web"
+			]
+		},
 		"default-testst-route-60ad45fcb5fc1f5f3629@kubernetescrd": {
 			"entryPoints": [
 				"web"
@@ -157,6 +175,24 @@
 		"dashboard@internal": {
 			"status": "enabled"
 		},
+		"default-hrw1@kubernetescrd": {
+			"highestRandomWeight": {
+				"services": [
+					{
+						"name": "default-whoami-80",
+						"weight": 10
+					},
+					{
+						"name": "default-whoami-80",
+						"weight": 20
+					}
+				]
+			},
+			"status": "enabled",
+			"usedBy": [
+				"default-test4-route-466d8d3a547de55dfe8a@kubernetescrd"
+			]
+		},
 		"default-mirror1@kubernetescrd": {
 			"mirroring": {
 				"service": "default-whoami-80",
@@ -326,7 +362,10 @@
 					}
 				]
 			},
-			"status": "enabled"
+			"status": "enabled",
+			"serverStatus": {
+				"domain.com:9090": "UP"
+			}
 		},
 		"default-test3.route-673acf455cb2dab0b43a-whoamitcp-8080@kubernetescrd": {
 			"loadBalancer": {
@@ -339,7 +378,11 @@
 					}
 				]
 			},
-			"status": "enabled"
+			"status": "enabled",
+			"serverStatus": {
+				"10.42.0.2:8080": "UP",
+				"10.42.0.6:8080": "UP"
+			}
 		},
 		"default-test3.route-673acf455cb2dab0b43a@kubernetescrd": {
 			"weighted": {
diff --git a/integration/testdata/rawdata-gateway.json b/integration/testdata/rawdata-gateway.json
index 8a6e1bc8c..0b1f9fc20 100644
--- a/integration/testdata/rawdata-gateway.json
+++ b/integration/testdata/rawdata-gateway.json
@@ -233,7 +233,11 @@
 					}
 				]
 			},
-			"status": "enabled"
+			"status": "enabled",
+			"serverStatus": {
+				"10.42.0.2:8080": "UP",
+				"10.42.0.6:8080": "UP"
+			}
 		},
 		"tcproute-default-tcp-app-1-gw-default-my-tcp-gateway-ep-footcp-0-e3b0c44298fc1c149afb-wrr@kubernetesgateway": {
 			"weighted": {
diff --git a/pkg/api/dashboard/dashboard.go b/pkg/api/dashboard/dashboard.go
index b44a14bba..dd8c335b5 100644
--- a/pkg/api/dashboard/dashboard.go
+++ b/pkg/api/dashboard/dashboard.go
@@ -79,7 +79,13 @@ func Append(router *mux.Router, basePath string, customAssets fs.FS) error {
 	router.Methods(http.MethodGet).
 		Path(basePath).
 		HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
-			prefix := strings.TrimSuffix(req.Header.Get("X-Forwarded-Prefix"), "/")
+			xfPrefix := req.Header.Get("X-Forwarded-Prefix")
+			if strings.Contains(xfPrefix, "//") {
+				log.Error().Msgf("X-Forwarded-Prefix contains an invalid value: %s, defaulting to empty prefix", xfPrefix)
+				xfPrefix = ""
+			}
+
+			prefix := strings.TrimSuffix(xfPrefix, "/")
 			http.Redirect(resp, req, prefix+dashboardPath, http.StatusFound)
 		})
 
diff --git a/pkg/api/dashboard/dashboard_test.go b/pkg/api/dashboard/dashboard_test.go
index b07bff4f6..f7d387e0c 100644
--- a/pkg/api/dashboard/dashboard_test.go
+++ b/pkg/api/dashboard/dashboard_test.go
@@ -9,7 +9,9 @@ import (
 	"testing/fstest"
 	"time"
 
+	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func Test_ContentSecurityPolicy(t *testing.T) {
@@ -60,6 +62,52 @@ func Test_ContentSecurityPolicy(t *testing.T) {
 	}
 }
 
+func Test_XForwardedPrefix(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		prefix   string
+		expected string
+	}{
+		{
+			desc:     "location in X-Forwarded-Prefix",
+			prefix:   "//foobar/test",
+			expected: "/dashboard/",
+		},
+		{
+			desc:     "scheme in X-Forwarded-Prefix",
+			prefix:   "http://foobar",
+			expected: "/dashboard/",
+		},
+		{
+			desc:     "path in X-Forwarded-Prefix",
+			prefix:   "foobar",
+			expected: "/foobar/dashboard/",
+		},
+	}
+
+	router := mux.NewRouter()
+	err := Append(router, "/", fstest.MapFS{"index.html": &fstest.MapFile{
+		Mode:    0o755,
+		ModTime: time.Now(),
+	}})
+	require.NoError(t, err)
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			req := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+			req.Header.Set("X-Forwarded-Prefix", test.prefix)
+			rw := httptest.NewRecorder()
+
+			router.ServeHTTP(rw, req)
+
+			assert.Equal(t, http.StatusFound, rw.Code)
+			assert.Equal(t, test.expected, rw.Result().Header.Get("Location"))
+		})
+	}
+}
+
 type errorFS struct{}
 
 func (e errorFS) Open(name string) (fs.File, error) {
diff --git a/pkg/api/handler.go b/pkg/api/handler.go
index 6c99ca12e..6a2f82270 100644
--- a/pkg/api/handler.go
+++ b/pkg/api/handler.go
@@ -33,16 +33,53 @@ type serviceInfoRepresentation struct {
 	ServerStatus map[string]string `json:"serverStatus,omitempty"`
 }
 
+type tcpServiceInfoRepresentation struct {
+	*runtime.TCPServiceInfo
+	ServerStatus map[string]string `json:"serverStatus,omitempty"`
+}
+
 // RunTimeRepresentation is the configuration information exposed by the API handler.
 type RunTimeRepresentation struct {
-	Routers        map[string]*runtime.RouterInfo        `json:"routers,omitempty"`
-	Middlewares    map[string]*runtime.MiddlewareInfo    `json:"middlewares,omitempty"`
-	Services       map[string]*serviceInfoRepresentation `json:"services,omitempty"`
-	TCPRouters     map[string]*runtime.TCPRouterInfo     `json:"tcpRouters,omitempty"`
-	TCPMiddlewares map[string]*runtime.TCPMiddlewareInfo `json:"tcpMiddlewares,omitempty"`
-	TCPServices    map[string]*runtime.TCPServiceInfo    `json:"tcpServices,omitempty"`
-	UDPRouters     map[string]*runtime.UDPRouterInfo     `json:"udpRouters,omitempty"`
-	UDPServices    map[string]*runtime.UDPServiceInfo    `json:"udpServices,omitempty"`
+	Routers        map[string]*runtime.RouterInfo           `json:"routers,omitempty"`
+	Middlewares    map[string]*runtime.MiddlewareInfo       `json:"middlewares,omitempty"`
+	Services       map[string]*serviceInfoRepresentation    `json:"services,omitempty"`
+	TCPRouters     map[string]*runtime.TCPRouterInfo        `json:"tcpRouters,omitempty"`
+	TCPMiddlewares map[string]*runtime.TCPMiddlewareInfo    `json:"tcpMiddlewares,omitempty"`
+	TCPServices    map[string]*tcpServiceInfoRepresentation `json:"tcpServices,omitempty"`
+	UDPRouters     map[string]*runtime.UDPRouterInfo        `json:"udpRouters,omitempty"`
+	UDPServices    map[string]*runtime.UDPServiceInfo       `json:"udpServices,omitempty"`
+}
+
+// TODO: think about this for longer
+func GetRunTimeRepresentation(runtimeConfiguration *runtime.Configuration) *RunTimeRepresentation {
+	siRepr := make(map[string]*serviceInfoRepresentation, len(runtimeConfiguration.Services))
+	for k, v := range runtimeConfiguration.Services {
+		siRepr[k] = &serviceInfoRepresentation{
+			ServiceInfo:  v,
+			ServerStatus: v.GetAllStatus(),
+		}
+	}
+
+	tcpSIRepr := make(map[string]*tcpServiceInfoRepresentation, len(h.runtimeConfiguration.Services))
+	for k, v := range h.runtimeConfiguration.TCPServices {
+		tcpSIRepr[k] = &tcpServiceInfoRepresentation{
+			TCPServiceInfo: v,
+			ServerStatus:   v.GetAllStatus(),
+		}
+	}
+
+	result := RunTimeRepresentation{
+		Routers:        runtimeConfiguration.Routers,
+		Middlewares:    runtimeConfiguration.Middlewares,
+		Services:       siRepr,
+		TCPRouters:     runtimeConfiguration.TCPRouters,
+		TCPMiddlewares: runtimeConfiguration.TCPMiddlewares,
+		TCPServices:    tcpSIRepr,
+		UDPRouters:     runtimeConfiguration.UDPRouters,
+		UDPServices:    runtimeConfiguration.UDPServices,
+	}
+
+	return &result
 }
 
 // Handler serves the configuration and status of Traefik on API endpoints.
@@ -119,24 +156,7 @@ func (h Handler) createRouter() *mux.Router {
 }
 
 func (h Handler) getRuntimeConfiguration(rw http.ResponseWriter, request *http.Request) {
-	siRepr := make(map[string]*serviceInfoRepresentation, len(h.runtimeConfiguration.Services))
-	for k, v := range h.runtimeConfiguration.Services {
-		siRepr[k] = &serviceInfoRepresentation{
-			ServiceInfo:  v,
-			ServerStatus: v.GetAllStatus(),
-		}
-	}
-
-	result := RunTimeRepresentation{
-		Routers:        h.runtimeConfiguration.Routers,
-		Middlewares:    h.runtimeConfiguration.Middlewares,
-		Services:       siRepr,
-		TCPRouters:     h.runtimeConfiguration.TCPRouters,
-		TCPMiddlewares: h.runtimeConfiguration.TCPMiddlewares,
-		TCPServices:    h.runtimeConfiguration.TCPServices,
-		UDPRouters:     h.runtimeConfiguration.UDPRouters,
-		UDPServices:    h.runtimeConfiguration.UDPServices,
-	}
+	result := GetRunTimeRepresentation(h.runtimeConfiguration)
 
 	rw.Header().Set("Content-Type", "application/json")
 
diff --git a/pkg/api/handler_http.go b/pkg/api/handler_http.go
index 9439d8ab8..a0ca84ce7 100644
--- a/pkg/api/handler_http.go
+++ b/pkg/api/handler_http.go
@@ -34,10 +34,10 @@ func newRouterRepresentation(name string, rt *runtime.RouterInfo) routerRepresen
 
 type serviceRepresentation struct {
 	*runtime.ServiceInfo
-	ServerStatus map[string]string `json:"serverStatus,omitempty"`
 	Name         string            `json:"name,omitempty"`
 	Provider     string            `json:"provider,omitempty"`
 	Type         string            `json:"type,omitempty"`
+	ServerStatus map[string]string `json:"serverStatus,omitempty"`
 }
 
 func newServiceRepresentation(name string, si *runtime.ServiceInfo) serviceRepresentation {
@@ -45,8 +45,8 @@ func newServiceRepresentation(name string, si *runtime.ServiceInfo) serviceRepre
 		ServiceInfo:  si,
 		Name:         name,
 		Provider:     getProviderName(name),
-		ServerStatus: si.GetAllStatus(),
 		Type:         strings.ToLower(extractType(si.Service)),
+		ServerStatus: si.GetAllStatus(),
 	}
 }
 
diff --git a/pkg/api/handler_support_dump_test.go b/pkg/api/handler_support_dump_test.go
index f1c4d507a..8de6e766a 100644
--- a/pkg/api/handler_support_dump_test.go
+++ b/pkg/api/handler_support_dump_test.go
@@ -76,7 +76,7 @@ func TestHandler_SupportDump(t *testing.T) {
 				assert.Contains(t, string(files["version.json"]), `"version":"dev"`)
 
 				// Verify static config contains entry points
-				assert.Contains(t, string(files["static-config.json"]), `"entryPoints":{"web":{"address":"xxxx","http":{}}}`)
+				assert.Contains(t, string(files["static-config.json"]), `"entryPoints":{"web":{"address":"xxxx","http":{}`)
 
 				// Verify runtime config contains services
 				assert.Contains(t, string(files["runtime-config.json"]), `"services":`)
diff --git a/pkg/api/handler_tcp.go b/pkg/api/handler_tcp.go
index 3ad0fb5b7..cc8f9aeed 100644
--- a/pkg/api/handler_tcp.go
+++ b/pkg/api/handler_tcp.go
@@ -29,9 +29,10 @@ func newTCPRouterRepresentation(name string, rt *runtime.TCPRouterInfo) tcpRoute
 
 type tcpServiceRepresentation struct {
 	*runtime.TCPServiceInfo
-	Name     string `json:"name,omitempty"`
-	Provider string `json:"provider,omitempty"`
-	Type     string `json:"type,omitempty"`
+	Name         string            `json:"name,omitempty"`
+	Provider     string            `json:"provider,omitempty"`
+	Type         string            `json:"type,omitempty"`
+	ServerStatus map[string]string `json:"serverStatus,omitempty"`
 }
 
 func newTCPServiceRepresentation(name string, si *runtime.TCPServiceInfo) tcpServiceRepresentation {
@@ -40,6 +41,7 @@ func newTCPServiceRepresentation(name string, si *runtime.TCPServiceInfo) tcpSer
 		Name:           name,
 		Provider:       getProviderName(name),
 		Type:           strings.ToLower(extractType(si.TCPService)),
+		ServerStatus:   si.GetAllStatus(),
 	}
 }
 
diff --git a/pkg/api/handler_tcp_test.go b/pkg/api/handler_tcp_test.go
index 387c39050..b0ee4cc2f 100644
--- a/pkg/api/handler_tcp_test.go
+++ b/pkg/api/handler_tcp_test.go
@@ -355,45 +355,57 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-						Status: runtime.StatusEnabled,
-					},
-					"baz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+							Status: runtime.StatusEnabled,
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
+					"baz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.2:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusWarning,
-					},
-					"foz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusWarning,
+						}
+						si.UpdateServerStatus("127.0.0.2:2345", "UP")
+						return si
+					}(),
+					"foz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.3:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusDisabled,
-					},
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusDisabled,
+						}
+						si.UpdateServerStatus("127.0.0.3:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -407,45 +419,57 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services?status=enabled",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-						Status: runtime.StatusEnabled,
-					},
-					"baz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+							Status: runtime.StatusEnabled,
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
+					"baz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.2:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusWarning,
-					},
-					"foz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusWarning,
+						}
+						si.UpdateServerStatus("127.0.0.2:2345", "UP")
+						return si
+					}(),
+					"foz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.3:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusDisabled,
-					},
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusDisabled,
+						}
+						si.UpdateServerStatus("127.0.0.3:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -459,45 +483,57 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services?search=baz@my",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-						Status: runtime.StatusEnabled,
-					},
-					"baz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+							Status: runtime.StatusEnabled,
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
+					"baz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.2:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusWarning,
-					},
-					"foz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusWarning,
+						}
+						si.UpdateServerStatus("127.0.0.2:2345", "UP")
+						return si
+					}(),
+					"foz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.3:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-						Status: runtime.StatusDisabled,
-					},
+							UsedBy: []string{"foo@myprovider"},
+							Status: runtime.StatusDisabled,
+						}
+						si.UpdateServerStatus("127.0.0.3:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -511,41 +547,53 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services?page=2&per_page=1",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-					},
-					"baz@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.2:2345",
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
+					"baz@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.2:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider"},
-					},
-					"test@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.3:2345",
+							UsedBy: []string{"foo@myprovider"},
+						}
+						si.UpdateServerStatus("127.0.0.2:2345", "UP")
+						return si
+					}(),
+					"test@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.3:2345",
+										},
 									},
 								},
 							},
-						},
-					},
+						}
+						si.UpdateServerStatus("127.0.0.3:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -559,18 +607,22 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services/bar@myprovider",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-					},
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -583,18 +635,22 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services/" + url.PathEscape("foo / bar@myprovider"),
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"foo / bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"foo / bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-					},
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
@@ -607,18 +663,22 @@ func TestHandler_TCP(t *testing.T) {
 			path: "/api/tcp/services/nono@myprovider",
 			conf: runtime.Configuration{
 				TCPServices: map[string]*runtime.TCPServiceInfo{
-					"bar@myprovider": {
-						TCPService: &dynamic.TCPService{
-							LoadBalancer: &dynamic.TCPServersLoadBalancer{
-								Servers: []dynamic.TCPServer{
-									{
-										Address: "127.0.0.1:2345",
+					"bar@myprovider": func() *runtime.TCPServiceInfo {
+						si := &runtime.TCPServiceInfo{
+							TCPService: &dynamic.TCPService{
+								LoadBalancer: &dynamic.TCPServersLoadBalancer{
+									Servers: []dynamic.TCPServer{
+										{
+											Address: "127.0.0.1:2345",
+										},
 									},
 								},
 							},
-						},
-						UsedBy: []string{"foo@myprovider", "test@myprovider"},
-					},
+							UsedBy: []string{"foo@myprovider", "test@myprovider"},
+						}
+						si.UpdateServerStatus("127.0.0.1:2345", "UP")
+						return si
+					}(),
 				},
 			},
 			expected: expected{
diff --git a/pkg/api/testdata/entrypoint-bar.json b/pkg/api/testdata/entrypoint-bar.json
index 897b16e00..e68aa5d99 100644
--- a/pkg/api/testdata/entrypoint-bar.json
+++ b/pkg/api/testdata/entrypoint-bar.json
@@ -2,4 +2,4 @@
 	"address": ":81",
 	"http": {},
 	"name": "bar"
-}
\ No newline at end of file
+}
diff --git a/pkg/api/testdata/entrypoints-many-lastpage.json b/pkg/api/testdata/entrypoints-many-lastpage.json
index 3e0f438e5..4d2917405 100644
--- a/pkg/api/testdata/entrypoints-many-lastpage.json
+++ b/pkg/api/testdata/entrypoints-many-lastpage.json
@@ -24,4 +24,4 @@
 		"http": {},
 		"name": "ep18"
 	}
-]
\ No newline at end of file
+]
diff --git a/pkg/api/testdata/entrypoints-page2.json b/pkg/api/testdata/entrypoints-page2.json
index 2d674dc6d..b98ced751 100644
--- a/pkg/api/testdata/entrypoints-page2.json
+++ b/pkg/api/testdata/entrypoints-page2.json
@@ -4,4 +4,4 @@
 		"http": {},
 		"name": "web2"
 	}
-]
\ No newline at end of file
+]
diff --git a/pkg/api/testdata/tcpservice-bar.json b/pkg/api/testdata/tcpservice-bar.json
index ade480a92..1c0476407 100644
--- a/pkg/api/testdata/tcpservice-bar.json
+++ b/pkg/api/testdata/tcpservice-bar.json
@@ -8,6 +8,9 @@
 	},
 	"name": "bar@myprovider",
 	"provider": "myprovider",
+	"serverStatus": {
+		"127.0.0.1:2345": "UP"
+	},
 	"status": "enabled",
 	"type": "loadbalancer",
 	"usedBy": [
diff --git a/pkg/api/testdata/tcpservice-foo-slash-bar.json b/pkg/api/testdata/tcpservice-foo-slash-bar.json
index b250966d5..ee36ad8b8 100644
--- a/pkg/api/testdata/tcpservice-foo-slash-bar.json
+++ b/pkg/api/testdata/tcpservice-foo-slash-bar.json
@@ -8,6 +8,9 @@
 	},
 	"name": "foo / bar@myprovider",
 	"provider": "myprovider",
+	"serverStatus": {
+		"127.0.0.1:2345": "UP"
+	},
 	"status": "enabled",
 	"type": "loadbalancer",
 	"usedBy": [
diff --git a/pkg/api/testdata/tcpservices-filtered-search.json b/pkg/api/testdata/tcpservices-filtered-search.json
index 130d5eace..653cfb884 100644
--- a/pkg/api/testdata/tcpservices-filtered-search.json
+++ b/pkg/api/testdata/tcpservices-filtered-search.json
@@ -9,6 +9,9 @@
 		},
 		"name": "baz@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.2:2345": "UP"
+		},
 		"status": "warning",
 		"type": "loadbalancer",
 		"usedBy": [
diff --git a/pkg/api/testdata/tcpservices-filtered-status.json b/pkg/api/testdata/tcpservices-filtered-status.json
index 03ec085a0..61fe14b45 100644
--- a/pkg/api/testdata/tcpservices-filtered-status.json
+++ b/pkg/api/testdata/tcpservices-filtered-status.json
@@ -9,6 +9,9 @@
 		},
 		"name": "bar@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.1:2345": "UP"
+		},
 		"status": "enabled",
 		"type": "loadbalancer",
 		"usedBy": [
diff --git a/pkg/api/testdata/tcpservices-page2.json b/pkg/api/testdata/tcpservices-page2.json
index 414e0f37d..ff3025fc7 100644
--- a/pkg/api/testdata/tcpservices-page2.json
+++ b/pkg/api/testdata/tcpservices-page2.json
@@ -9,6 +9,9 @@
 		},
 		"name": "baz@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.2:2345": "UP"
+		},
 		"status": "enabled",
 		"type": "loadbalancer",
 		"usedBy": [
diff --git a/pkg/api/testdata/tcpservices.json b/pkg/api/testdata/tcpservices.json
index c3f9f7ea6..e741f119e 100644
--- a/pkg/api/testdata/tcpservices.json
+++ b/pkg/api/testdata/tcpservices.json
@@ -9,6 +9,9 @@
 		},
 		"name": "bar@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.1:2345": "UP"
+		},
 		"status": "enabled",
 		"type": "loadbalancer",
 		"usedBy": [
@@ -26,6 +29,9 @@
 		},
 		"name": "baz@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.2:2345": "UP"
+		},
 		"status": "warning",
 		"type": "loadbalancer",
 		"usedBy": [
@@ -36,12 +42,15 @@
 		"loadBalancer": {
 			"servers": [
 				{
-					"address": "127.0.0.2:2345"
+					"address": "127.0.0.3:2345"
 				}
 			]
 		},
 		"name": "foz@myprovider",
 		"provider": "myprovider",
+		"serverStatus": {
+			"127.0.0.3:2345": "UP"
+		},
 		"status": "disabled",
 		"type": "loadbalancer",
 		"usedBy": [
diff --git a/pkg/cli/deprecation.go b/pkg/cli/deprecation.go
index c7c262ba7..1277e52c6 100644
--- a/pkg/cli/deprecation.go
+++ b/pkg/cli/deprecation.go
@@ -2,31 +2,39 @@ package cli
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"reflect"
+	"strconv"
 	"strings"
 
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/traefik/paerser/cli"
+	"github.com/traefik/paerser/env"
+	"github.com/traefik/paerser/file"
 	"github.com/traefik/paerser/flag"
 	"github.com/traefik/paerser/parser"
 )
 
 type DeprecationLoader struct{}
 
-func (d DeprecationLoader) Load(args []string, cmd *cli.Command) (bool, error) {
-	if logDeprecation(cmd.Configuration, args) {
-		return true, errors.New("incompatible deprecated static option found")
+func (d DeprecationLoader) Load(args []string, _ *cli.Command) (bool, error) {
+	hasIncompatibleOptions, err := logDeprecations(args)
+	if err != nil {
+		log.Error().Err(err).Msg("Deprecated install configuration options analysis failed")
+		return false, nil
 	}
 
+	if hasIncompatibleOptions {
+		return true, errors.New("incompatible deprecated install configuration option found")
+	}
 	return false, nil
 }
 
-// logDeprecation prints deprecation hints and returns whether incompatible deprecated options need to be removed.
-func logDeprecation(traefikConfiguration interface{}, arguments []string) bool {
-	// This part doesn't handle properly a flag defined like this:
-	// --accesslog true
+// logDeprecations prints deprecation hints and returns whether incompatible deprecated options need to be removed.
+func logDeprecations(arguments []string) (bool, error) {
+	// This part doesn't handle properly a flag defined like this: --accesslog true
 	// where `true` could be considered as a new argument.
 	// This is not really an issue with the deprecation loader since it will filter the unknown nodes later in this function.
 	var args []string
@@ -35,86 +43,153 @@ func logDeprecation(traefikConfiguration interface{}, arguments []string) bool {
 			args = append(args, arg+"=true")
 			continue
 		}
-
 		args = append(args, arg)
 	}
 
-	labels, err := flag.Parse(args, nil)
+	// ARGS
+	// Parse arguments to labels.
+	argsLabels, err := flag.Parse(args, nil)
 	if err != nil {
-		log.Error().Err(err).Msg("deprecated static options analysis failed")
-		return false
+		return false, fmt.Errorf("parsing arguments to labels: %w", err)
 	}
 
-	node, err := parser.DecodeToNode(labels, "traefik")
+	config, err := parseDeprecatedConfig(argsLabels)
 	if err != nil {
-		log.Error().Err(err).Msg("deprecated static options analysis failed")
-		return false
+		return false, fmt.Errorf("parsing deprecated config from args: %w", err)
 	}
 
-	if node != nil && len(node.Children) > 0 {
-		config := &configuration{}
-		filterUnknownNodes(reflect.TypeOf(config), node)
-
-		if len(node.Children) > 0 {
-			// Telling parser to look for the label struct tag to allow empty values.
-			err = parser.AddMetadata(config, node, parser.MetadataOpts{TagName: "label"})
-			if err != nil {
-				log.Error().Err(err).Msg("deprecated static options analysis failed")
-				return false
-			}
-
-			err = parser.Fill(config, node, parser.FillerOpts{})
-			if err != nil {
-				log.Error().Err(err).Msg("deprecated static options analysis failed")
-				return false
-			}
-
-			if config.deprecationNotice(log.With().Str("loader", "FLAG").Logger()) {
-				return true
-			}
-
-			// No further deprecation parsing and logging,
-			// as args configuration contains at least one deprecated option.
-			return false
-		}
+	if config.deprecationNotice(log.With().Str("loader", "args").Logger()) {
+		return true, nil
 	}
 
 	// FILE
-	ref, err := flag.Parse(args, traefikConfiguration)
+	// Find the config file using the same logic as the normal file loader.
+	finder := cli.Finder{
+		BasePaths:  []string{"/etc/traefik/traefik", "$XDG_CONFIG_HOME/traefik", "$HOME/.config/traefik", "./traefik"},
+		Extensions: []string{"toml", "yaml", "yml"},
+	}
+
+	configFile, ok := argsLabels["traefik.configfile"]
+	if !ok {
+		configFile = argsLabels["traefik.configFile"]
+	}
+
+	filePath, err := finder.Find(configFile)
 	if err != nil {
-		log.Error().Err(err).Msg("deprecated static options analysis failed")
-		return false
+		return false, fmt.Errorf("finding configuration file: %w", err)
 	}
 
-	configFileFlag := "traefik.configfile"
-	if _, ok := ref["traefik.configFile"]; ok {
-		configFileFlag = "traefik.configFile"
-	}
+	if filePath != "" {
+		// We don't rely on the Parser file loader here to avoid issues with unknown fields.
+		// Parse file content into a generic map.
+		var fileConfig map[string]interface{}
+		if err := file.Decode(filePath, &fileConfig); err != nil {
+			return false, fmt.Errorf("decoding configuration file %s: %w", filePath, err)
+		}
 
-	config := &configuration{}
-	_, err = loadConfigFiles(ref[configFileFlag], config)
+		// Convert the file config to label format.
+		fileLabels := make(map[string]string)
+		flattenToLabels(fileConfig, "", fileLabels)
 
-	if err == nil {
-		if config.deprecationNotice(log.With().Str("loader", "FILE").Logger()) {
-			return true
+		config, err := parseDeprecatedConfig(fileLabels)
+		if err != nil {
+			return false, fmt.Errorf("parsing deprecated config from file: %w", err)
+		}
+
+		if config.deprecationNotice(log.With().Str("loader", "file").Logger()) {
+			return true, nil
 		}
 	}
 
-	config = &configuration{}
-	l := EnvLoader{}
-	_, err = l.Load(os.Args, &cli.Command{
-		Configuration: config,
-	})
+	// ENV
+	vars := env.FindPrefixedEnvVars(os.Environ(), env.DefaultNamePrefix, &configuration{})
+	if len(vars) > 0 {
+		// We don't rely on the Parser env loader here to avoid issues with unknown fields.
+		// Decode environment variables to a generic map.
+		var envConfig map[string]interface{}
+		if err := env.Decode(vars, env.DefaultNamePrefix, &envConfig); err != nil {
+			return false, fmt.Errorf("decoding environment variables: %w", err)
+		}
 
-	if err == nil {
-		if config.deprecationNotice(log.With().Str("loader", "ENV").Logger()) {
-			return true
+		// Convert the env config to label format.
+		envLabels := make(map[string]string)
+		flattenToLabels(envConfig, "", envLabels)
+
+		config, err := parseDeprecatedConfig(envLabels)
+		if err != nil {
+			return false, fmt.Errorf("parsing deprecated config from environment variables: %w", err)
+		}
+
+		if config.deprecationNotice(log.With().Str("loader", "env").Logger()) {
+			return true, nil
 		}
 	}
 
-	return false
+	return false, nil
 }
 
+// flattenToLabels recursively flattens a nested map into label key-value pairs.
+// Example: {"experimental": {"http3": true}} -> {"traefik.experimental.http3": "true"}.
+func flattenToLabels(config interface{}, currKey string, labels map[string]string) {
+	switch v := config.(type) {
+	case map[string]interface{}:
+		for key, value := range v {
+			newKey := key
+			if currKey != "" {
+				newKey = currKey + "." + key
+			}
+			flattenToLabels(value, newKey, labels)
+		}
+	case []interface{}:
+		for i, item := range v {
+			newKey := currKey + "[" + strconv.Itoa(i) + "]"
+			flattenToLabels(item, newKey, labels)
+		}
+	default:
+		// Convert value to string and create label with traefik prefix.
+		labels["traefik."+currKey] = fmt.Sprintf("%v", v)
+	}
+}
+
+// parseDeprecatedConfig parses command-line arguments using the deprecation configuration struct,
+// filtering unknown nodes and checking for deprecated options.
+// Returns true if incompatible deprecated options are found.
+func parseDeprecatedConfig(labels map[string]string) (*configuration, error) {
+	// If no config, we can return without error to allow other loaders to proceed.
+	if len(labels) == 0 {
+		return nil, nil
+	}
+
+	// Convert labels to node tree.
+	node, err := parser.DecodeToNode(labels, "traefik")
+	if err != nil {
+		return nil, fmt.Errorf("decoding to node: %w", err)
+	}
+
+	// Filter unknown nodes and check for deprecated options.
+	config := &configuration{}
+	filterUnknownNodes(reflect.TypeOf(config), node)
+
+	// If no config remains we can return without error, to allow other loaders to proceed.
+	if node == nil || len(node.Children) == 0 {
+		return nil, nil
+	}
+
+	// Telling parser to look for the label struct tag to allow empty values.
+	err = parser.AddMetadata(config, node, parser.MetadataOpts{TagName: "label"})
+	if err != nil {
+		return nil, fmt.Errorf("adding metadata to node: %w", err)
+	}
+
+	err = parser.Fill(config, node, parser.FillerOpts{})
+	if err != nil {
+		return nil, fmt.Errorf("filling configuration: %w", err)
+	}
+
+	return config, nil
+}
+
+// filterUnknownNodes removes from the node tree all nodes that do not correspond to any field in the given type.
 func filterUnknownNodes(fType reflect.Type, node *parser.Node) bool {
 	var children []*parser.Node
 	for _, child := range node.Children {
@@ -127,6 +202,7 @@ func filterUnknownNodes(fType reflect.Type, node *parser.Node) bool {
 	return len(node.Children) > 0
 }
 
+// hasKnownNodes checks whether the given node corresponds to a known field in the given type.
 func hasKnownNodes(rootType reflect.Type, node *parser.Node) bool {
 	rType := rootType
 	if rootType.Kind() == reflect.Pointer {
@@ -177,7 +253,7 @@ func findTypedField(rType reflect.Type, node *parser.Node) (reflect.StructField,
 	return reflect.StructField{}, false
 }
 
-// configuration holds the static configuration removed/deprecated options.
+// configuration holds the install configuration removed/deprecated options.
 type configuration struct {
 	Core         *core          `json:"core,omitempty" toml:"core,omitempty" yaml:"core,omitempty" label:"allowEmpty" file:"allowEmpty"`
 	Experimental *experimental  `json:"experimental,omitempty" toml:"experimental,omitempty" yaml:"experimental,omitempty" label:"allowEmpty" file:"allowEmpty"`
@@ -194,8 +270,8 @@ func (c *configuration) deprecationNotice(logger zerolog.Logger) bool {
 	var incompatible bool
 	if c.Pilot != nil {
 		incompatible = true
-		logger.Error().Msg("Pilot configuration has been removed in v3, please remove all Pilot-related static configuration for Traefik to start." +
-			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#pilot")
+		logger.Error().Msg("Pilot configuration has been removed in v3, please remove all Pilot-related install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#pilot")
 	}
 
 	incompatibleCore := c.Core.deprecationNotice(logger)
@@ -213,7 +289,7 @@ func (c *core) deprecationNotice(logger zerolog.Logger) bool {
 	if c != nil && c.DefaultRuleSyntax != "" {
 		logger.Error().Msg("`Core.DefaultRuleSyntax` option has been deprecated in v3.4, and will be removed in the next major version." +
 			" Please consider migrating all router rules to v3 syntax." +
-			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v3/#rule-syntax")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#rule-syntax")
 	}
 
 	return false
@@ -242,14 +318,14 @@ func (p *providers) deprecationNotice(logger zerolog.Logger) bool {
 
 	if p.Marathon != nil {
 		incompatible = true
-		logger.Error().Msg("Marathon provider has been removed in v3, please remove all Marathon-related static configuration for Traefik to start." +
-			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#marathon-provider")
+		logger.Error().Msg("Marathon provider has been removed in v3, please remove all Marathon-related install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#marathon-provider")
 	}
 
 	if p.Rancher != nil {
 		incompatible = true
-		logger.Error().Msg("Rancher provider has been removed in v3, please remove all Rancher-related static configuration for Traefik to start." +
-			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#rancher-v1-provider")
+		logger.Error().Msg("Rancher provider has been removed in v3, please remove all Rancher-related install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#rancher-v1-provider")
 	}
 
 	dockerIncompatible := p.Docker.deprecationNotice(logger)
@@ -291,14 +367,14 @@ func (d *docker) deprecationNotice(logger zerolog.Logger) bool {
 	if d.SwarmMode != nil {
 		incompatible = true
 		logger.Error().Msg("Docker provider `swarmMode` option has been removed in v3, please use the Swarm Provider instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#docker-docker-swarm")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#docker-docker-swarm")
 	}
 
 	if d.TLS != nil && d.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("Docker provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tlscaoptional")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tlscaoptional")
 	}
 
 	return incompatible
@@ -318,7 +394,7 @@ func (s *swarm) deprecationNotice(logger zerolog.Logger) bool {
 	if s.TLS != nil && s.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("Swarm provider `tls.CAOptional` option does not exist, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start.")
+			" Please remove all occurrences from the install configuration for Traefik to start.")
 	}
 
 	return incompatible
@@ -338,8 +414,8 @@ func (e *etcd) deprecationNotice(logger zerolog.Logger) bool {
 	if e.TLS != nil && e.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("ETCD provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tlscaoptional_3")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tlscaoptional_3")
 	}
 
 	return incompatible
@@ -359,8 +435,8 @@ func (r *redis) deprecationNotice(logger zerolog.Logger) bool {
 	if r.TLS != nil && r.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("Redis provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tlscaoptional_4")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tlscaoptional_4")
 	}
 
 	return incompatible
@@ -381,14 +457,14 @@ func (c *consul) deprecationNotice(logger zerolog.Logger) bool {
 	if c.Namespace != nil {
 		incompatible = true
 		logger.Error().Msg("Consul provider `namespace` option has been removed, please use the `namespaces` option instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#consul-provider")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#consul-provider")
 	}
 
 	if c.TLS != nil && c.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("Consul provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tlscaoptional_1")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tlscaoptional_1")
 	}
 
 	return incompatible
@@ -413,14 +489,14 @@ func (c *consulCatalog) deprecationNotice(logger zerolog.Logger) bool {
 	if c.Namespace != nil {
 		incompatible = true
 		logger.Error().Msg("ConsulCatalog provider `namespace` option has been removed, please use the `namespaces` option instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#consulcatalog-provider")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#consulcatalog-provider")
 	}
 
 	if c.Endpoint != nil && c.Endpoint.TLS != nil && c.Endpoint.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("ConsulCatalog provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#endpointtlscaoptional")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#endpointtlscaoptional")
 	}
 
 	return incompatible
@@ -441,14 +517,14 @@ func (n *nomad) deprecationNotice(logger zerolog.Logger) bool {
 	if n.Namespace != nil {
 		incompatible = true
 		logger.Error().Msg("Nomad provider `namespace` option has been removed, please use the `namespaces` option instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#nomad-provider")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#nomad-provider")
 	}
 
 	if n.Endpoint != nil && n.Endpoint.TLS != nil && n.Endpoint.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("Nomad provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#endpointtlscaoptional_1")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#endpointtlscaoptional_1")
 	}
 
 	return incompatible
@@ -468,8 +544,8 @@ func (h *http) deprecationNotice(logger zerolog.Logger) bool {
 	if h.TLS != nil && h.TLS.CAOptional != nil {
 		incompatible = true
 		logger.Error().Msg("HTTP provider `tls.CAOptional` option has been removed in v3, as TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634)." +
-			"Please remove all occurrences from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tlscaoptional_2")
+			" Please remove all occurrences from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tlscaoptional_2")
 	}
 
 	return incompatible
@@ -486,14 +562,15 @@ func (i *ingress) deprecationNotice(logger zerolog.Logger) {
 
 	if i.DisableIngressClassLookup != nil {
 		logger.Error().Msg("Kubernetes Ingress provider `disableIngressClassLookup` option has been deprecated in v3.1, and will be removed in the next major version." +
-			"Please use the `disableClusterScopeResources` option instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v3/#ingressclasslookup")
+			" Please use the `disableClusterScopeResources` option instead." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#ingressclasslookup")
 	}
 }
 
 type experimental struct {
-	HTTP3             *bool `json:"http3,omitempty" toml:"http3,omitempty" yaml:"http3,omitempty"`
-	KubernetesGateway *bool `json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty"`
+	HTTP3                  *bool `json:"http3,omitempty" toml:"http3,omitempty" yaml:"http3,omitempty"`
+	KubernetesGateway      *bool `json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty"`
+	KubernetesIngressNGINX *bool `json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty"`
 }
 
 func (e *experimental) deprecationNotice(logger zerolog.Logger) bool {
@@ -503,16 +580,22 @@ func (e *experimental) deprecationNotice(logger zerolog.Logger) bool {
 
 	if e.HTTP3 != nil {
 		logger.Error().Msg("HTTP3 is not an experimental feature in v3 and the associated enablement has been removed." +
-			"Please remove its usage from the static configuration for Traefik to start." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3-details/#http3")
+			" Please remove its usage from the install configuration for Traefik to start." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3-details/#http3")
 
 		return true
 	}
 
 	if e.KubernetesGateway != nil {
 		logger.Error().Msg("KubernetesGateway provider is not an experimental feature starting with v3.1." +
-			"Please remove its usage from the static configuration." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v3/#gateway-api-kubernetesgateway-provider")
+			" Please remove its usage from the install configuration." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#gateway-api-kubernetesgateway-provider")
+	}
+
+	if e.KubernetesIngressNGINX != nil {
+		logger.Error().Msg("KubernetesIngressNGINX provider is not an experimental feature starting with v3.6.2." +
+			" Please remove its usage from the install configuration." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#ingress-nginx-provider")
 	}
 
 	return false
@@ -539,57 +622,57 @@ func (t *tracing) deprecationNotice(logger zerolog.Logger) bool {
 	if t.SpanNameLimit != nil {
 		incompatible = true
 		logger.Error().Msg("SpanNameLimit option for Tracing has been removed in v3, as Span names are now of a fixed length." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.GlobalAttributes != nil {
 		log.Warn().Msgf("tracing.globalAttributes option is now deprecated, please use tracing.resourceAttributes instead.")
 
 		logger.Error().Msg("`tracing.globalAttributes` option has been deprecated in v3.3, and will be removed in the next major version." +
-			"Please use the `tracing.resourceAttributes` option instead." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v3/#tracing-global-attributes")
+			" Please use the `tracing.resourceAttributes` option instead." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#tracing-global-attributes")
 	}
 
 	if t.Jaeger != nil {
 		incompatible = true
-		logger.Error().Msg("Jaeger Tracing backend has been removed in v3, please remove all Jaeger-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Jaeger Tracing backend has been removed in v3, please remove all Jaeger-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.Zipkin != nil {
 		incompatible = true
-		logger.Error().Msg("Zipkin Tracing backend has been removed in v3, please remove all Zipkin-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Zipkin Tracing backend has been removed in v3, please remove all Zipkin-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.Datadog != nil {
 		incompatible = true
-		logger.Error().Msg("Datadog Tracing backend has been removed in v3, please remove all Datadog-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Datadog Tracing backend has been removed in v3, please remove all Datadog-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.Instana != nil {
 		incompatible = true
-		logger.Error().Msg("Instana Tracing backend has been removed in v3, please remove all Instana-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Instana Tracing backend has been removed in v3, please remove all Instana-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.Haystack != nil {
 		incompatible = true
-		logger.Error().Msg("Haystack Tracing backend has been removed in v3, please remove all Haystack-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Haystack Tracing backend has been removed in v3, please remove all Haystack-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	if t.Elastic != nil {
 		incompatible = true
-		logger.Error().Msg("Elastic Tracing backend has been removed in v3, please remove all Elastic-related Tracing static configuration for Traefik to start." +
-			"In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
-			"For more information please read the migration guide: https://doc.traefik.io/traefik/v3.5/migration/v2-to-v3/#tracing")
+		logger.Error().Msg("Elastic Tracing backend has been removed in v3, please remove all Elastic-related Tracing install configuration for Traefik to start." +
+			" In v3, Open Telemetry replaces specific tracing backend implementations, and an collector/exporter can be used to export metrics in a vendor specific format." +
+			" For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v2-to-v3/#tracing")
 	}
 
 	return incompatible
diff --git a/pkg/cli/fixtures/traefik_deprecated.toml b/pkg/cli/fixtures/traefik_deprecated.toml
index 21fa1d1c1..6ac4fdb69 100644
--- a/pkg/cli/fixtures/traefik_deprecated.toml
+++ b/pkg/cli/fixtures/traefik_deprecated.toml
@@ -3,3 +3,6 @@
 [entrypoints.test.http.tls]
 
 [providers.marathon]
+
+[experimental]
+  futureUnknownFlag = true
diff --git a/pkg/cli/fixtures/traefik_multiple_deprecated.toml b/pkg/cli/fixtures/traefik_multiple_deprecated.toml
index 0847e9da3..8ab616205 100644
--- a/pkg/cli/fixtures/traefik_multiple_deprecated.toml
+++ b/pkg/cli/fixtures/traefik_multiple_deprecated.toml
@@ -6,3 +6,6 @@
 
 [pilot]
   token="xxx"
+
+[experimental]
+  futureUnknownFlag = true
diff --git a/pkg/cli/fixtures/traefik_no_deprecated.toml b/pkg/cli/fixtures/traefik_no_deprecated.toml
index 282d2f873..44cb175d7 100644
--- a/pkg/cli/fixtures/traefik_no_deprecated.toml
+++ b/pkg/cli/fixtures/traefik_no_deprecated.toml
@@ -1,3 +1,6 @@
 [accesslog]
 
 [entrypoints.test.http.tls]
+
+[experimental]
+  futureUnknownFlag = true
diff --git a/pkg/config/dynamic/http_config.go b/pkg/config/dynamic/http_config.go
index 96e16f7b4..97b08f5d6 100644
--- a/pkg/config/dynamic/http_config.go
+++ b/pkg/config/dynamic/http_config.go
@@ -44,20 +44,22 @@ type HTTPConfiguration struct {
 
 // Model holds model configuration.
 type Model struct {
-	Middlewares       []string                  `json:"middlewares,omitempty" toml:"middlewares,omitempty" yaml:"middlewares,omitempty" export:"true"`
-	TLS               *RouterTLSConfig          `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
-	Observability     RouterObservabilityConfig `json:"observability,omitempty" toml:"observability,omitempty" yaml:"observability,omitempty" export:"true"`
-	DefaultRuleSyntax string                    `json:"-" toml:"-" yaml:"-" label:"-" file:"-" kv:"-" export:"true"`
+	Middlewares                 []string                           `json:"middlewares,omitempty" toml:"middlewares,omitempty" yaml:"middlewares,omitempty" export:"true"`
+	TLS                         *RouterTLSConfig                   `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
+	Observability               RouterObservabilityConfig          `json:"observability,omitempty" toml:"observability,omitempty" yaml:"observability,omitempty" export:"true"`
+	DeniedEncodedPathCharacters *RouterDeniedEncodedPathCharacters `json:"-" toml:"-" yaml:"-" label:"-" file:"-" kv:"-" export:"true"`
+	DefaultRuleSyntax           string                             `json:"-" toml:"-" yaml:"-" label:"-" file:"-" kv:"-" export:"true"`
 }
 
 // +k8s:deepcopy-gen=true
 
 // Service holds a service configuration (can only be of one type at the same time).
 type Service struct {
-	LoadBalancer *ServersLoadBalancer `json:"loadBalancer,omitempty" toml:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty" export:"true"`
-	Weighted     *WeightedRoundRobin  `json:"weighted,omitempty" toml:"weighted,omitempty" yaml:"weighted,omitempty" label:"-" export:"true"`
-	Mirroring    *Mirroring           `json:"mirroring,omitempty" toml:"mirroring,omitempty" yaml:"mirroring,omitempty" label:"-" export:"true"`
-	Failover     *Failover            `json:"failover,omitempty" toml:"failover,omitempty" yaml:"failover,omitempty" label:"-" export:"true"`
+	LoadBalancer        *ServersLoadBalancer `json:"loadBalancer,omitempty" toml:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty" export:"true"`
+	HighestRandomWeight *HighestRandomWeight `json:"highestRandomWeight,omitempty" toml:"highestRandomWeight,omitempty" yaml:"highestRandomWeight,omitempty" label:"-" export:"true"`
+	Weighted            *WeightedRoundRobin  `json:"weighted,omitempty" toml:"weighted,omitempty" yaml:"weighted,omitempty" label:"-" export:"true"`
+	Mirroring           *Mirroring           `json:"mirroring,omitempty" toml:"mirroring,omitempty" yaml:"mirroring,omitempty" label:"-" export:"true"`
+	Failover            *Failover            `json:"failover,omitempty" toml:"failover,omitempty" yaml:"failover,omitempty" label:"-" export:"true"`
 }
 
 // +k8s:deepcopy-gen=true
@@ -68,12 +70,60 @@ type Router struct {
 	Middlewares []string `json:"middlewares,omitempty" toml:"middlewares,omitempty" yaml:"middlewares,omitempty" export:"true"`
 	Service     string   `json:"service,omitempty" toml:"service,omitempty" yaml:"service,omitempty" export:"true"`
 	Rule        string   `json:"rule,omitempty" toml:"rule,omitempty" yaml:"rule,omitempty"`
+	ParentRefs  []string `json:"parentRefs,omitempty" toml:"parentRefs,omitempty" yaml:"parentRefs,omitempty" label:"-" export:"true"`
 	// Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
-	RuleSyntax    string                     `json:"ruleSyntax,omitempty" toml:"ruleSyntax,omitempty" yaml:"ruleSyntax,omitempty" export:"true"`
-	Priority      int                        `json:"priority,omitempty" toml:"priority,omitempty,omitzero" yaml:"priority,omitempty" export:"true"`
-	TLS           *RouterTLSConfig           `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
-	Observability *RouterObservabilityConfig `json:"observability,omitempty" toml:"observability,omitempty" yaml:"observability,omitempty" export:"true"`
-	DefaultRule   bool                       `json:"-" toml:"-" yaml:"-" label:"-" file:"-"`
+	RuleSyntax                  string                             `json:"ruleSyntax,omitempty" toml:"ruleSyntax,omitempty" yaml:"ruleSyntax,omitempty" export:"true"`
+	Priority                    int                                `json:"priority,omitempty" toml:"priority,omitempty,omitzero" yaml:"priority,omitempty" export:"true"`
+	TLS                         *RouterTLSConfig                   `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
+	Observability               *RouterObservabilityConfig         `json:"observability,omitempty" toml:"observability,omitempty" yaml:"observability,omitempty" export:"true"`
+	DefaultRule                 bool                               `json:"-" toml:"-" yaml:"-" label:"-" file:"-"`
+	DeniedEncodedPathCharacters *RouterDeniedEncodedPathCharacters `json:"-" toml:"-" yaml:"-" label:"-" file:"-" kv:"-"`
+}
+
+// +k8s:deepcopy-gen=true
+
+// RouterDeniedEncodedPathCharacters configures which encoded characters are allowed in the request path.
+type RouterDeniedEncodedPathCharacters struct {
+	AllowEncodedSlash         bool `description:"Defines whether requests with encoded slash characters in the path are allowed." json:"allowEncodedSlash,omitempty" toml:"allowEncodedSlash,omitempty" yaml:"allowEncodedSlash,omitempty" export:"true"`
+	AllowEncodedBackSlash     bool `description:"Defines whether requests with encoded back slash characters in the path are allowed." json:"allowEncodedBackSlash,omitempty" toml:"allowEncodedBackSlash,omitempty" yaml:"allowEncodedBackSlash,omitempty" export:"true"`
+	AllowEncodedNullCharacter bool `description:"Defines whether requests with encoded null characters in the path are allowed." json:"allowEncodedNullCharacter,omitempty" toml:"allowEncodedNullCharacter,omitempty" yaml:"allowEncodedNullCharacter,omitempty" export:"true"`
+	AllowEncodedSemicolon     bool `description:"Defines whether requests with encoded semicolon characters in the path are allowed." json:"allowEncodedSemicolon,omitempty" toml:"allowEncodedSemicolon,omitempty" yaml:"allowEncodedSemicolon,omitempty" export:"true"`
+	AllowEncodedPercent       bool `description:"Defines whether requests with encoded percent characters in the path are allowed." json:"allowEncodedPercent,omitempty" toml:"allowEncodedPercent,omitempty" yaml:"allowEncodedPercent,omitempty" export:"true"`
+	AllowEncodedQuestionMark  bool `description:"Defines whether requests with encoded question mark characters in the path are allowed." json:"allowEncodedQuestionMark,omitempty" toml:"allowEncodedQuestionMark,omitempty" yaml:"allowEncodedQuestionMark,omitempty" export:"true"`
+	AllowEncodedHash          bool `description:"Defines whether requests with encoded hash characters in the path are allowed." json:"allowEncodedHash,omitempty" toml:"allowEncodedHash,omitempty" yaml:"allowEncodedHash,omitempty" export:"true"`
+}
+
+// Map returns a map of unallowed encoded characters.
+func (r *RouterDeniedEncodedPathCharacters) Map() map[string]struct{} {
+	characters := make(map[string]struct{})
+
+	if !r.AllowEncodedSlash {
+		characters["%2F"] = struct{}{}
+		characters["%2f"] = struct{}{}
+	}
+	if !r.AllowEncodedBackSlash {
+		characters["%5C"] = struct{}{}
+		characters["%5c"] = struct{}{}
+	}
+	if !r.AllowEncodedNullCharacter {
+		characters["%00"] = struct{}{}
+	}
+	if !r.AllowEncodedSemicolon {
+		characters["%3B"] = struct{}{}
+		characters["%3b"] = struct{}{}
+	}
+	if !r.AllowEncodedPercent {
+		characters["%25"] = struct{}{}
+	}
+	if !r.AllowEncodedQuestionMark {
+		characters["%3F"] = struct{}{}
+		characters["%3f"] = struct{}{}
+	}
+	if !r.AllowEncodedHash {
+		characters["%23"] = struct{}{}
+	}
+
+	return characters
 }
 
 // +k8s:deepcopy-gen=true
@@ -158,11 +208,28 @@ type WeightedRoundRobin struct {
 
 // +k8s:deepcopy-gen=true
 
+// HighestRandomWeight is a weighted sticky load-balancer of services.
+type HighestRandomWeight struct {
+	Services []HRWService `json:"services,omitempty" toml:"services,omitempty" yaml:"services,omitempty" export:"true"`
+	// HealthCheck enables automatic self-healthcheck for this service, i.e.
+	// whenever one of its children is reported as down, this service becomes aware of it,
+	// and takes it into account (i.e. it ignores the down child) when running the
+	// load-balancing algorithm. In addition, if the parent of this service also has
+	// HealthCheck enabled, this service reports to its parent any status change.
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty" toml:"healthCheck,omitempty" yaml:"healthCheck,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
+}
+
+// +k8s:deepcopy-gen=true
+
 // WRRService is a reference to a service load-balanced with weighted round-robin.
 type WRRService struct {
 	Name   string `json:"name,omitempty" toml:"name,omitempty" yaml:"name,omitempty" export:"true"`
 	Weight *int   `json:"weight,omitempty" toml:"weight,omitempty" yaml:"weight,omitempty" export:"true"`
 
+	// Headers defines the HTTP headers that should be added to the request when calling the service.
+	// This is required by the Knative implementation which expects specific headers to be sent.
+	Headers map[string]string `json:"-" toml:"-" yaml:"-" label:"-" file:"-"`
+
 	// Status defines an HTTP status code that should be returned when calling the service.
 	// This is required by the Gateway API implementation which expects specific HTTP status to be returned.
 	Status *int `json:"-" toml:"-" yaml:"-" label:"-" file:"-"`
@@ -179,6 +246,20 @@ func (w *WRRService) SetDefaults() {
 
 // +k8s:deepcopy-gen=true
 
+// HRWService is a reference to a service load-balanced with highest random weight.
+type HRWService struct {
+	Name   string `json:"name,omitempty" toml:"name,omitempty" yaml:"name,omitempty" export:"true"`
+	Weight *int   `json:"weight,omitempty" toml:"weight,omitempty" yaml:"weight,omitempty" export:"true"`
+}
+
+// SetDefaults Default values for a HRWService.
+func (w *HRWService) SetDefaults() {
+	defaultWeight := 1
+	w.Weight = &defaultWeight
+}
+
+// +k8s:deepcopy-gen=true
+
 type GRPCStatus struct {
 	Code codes.Code `json:"code,omitempty" toml:"code,omitempty" yaml:"code,omitempty" export:"true"`
 	Msg  string     `json:"msg,omitempty" toml:"msg,omitempty" yaml:"msg,omitempty" export:"true"`
@@ -232,6 +313,10 @@ const (
 	BalancerStrategyWRR BalancerStrategy = "wrr"
 	// BalancerStrategyP2C is the power of two choices strategy.
 	BalancerStrategyP2C BalancerStrategy = "p2c"
+	// BalancerStrategyHRW is the highest random weight strategy.
+	BalancerStrategyHRW BalancerStrategy = "hrw"
+	// BalancerStrategyLeastTime is the least-time strategy.
+	BalancerStrategyLeastTime BalancerStrategy = "leasttime"
 )
 
 // +k8s:deepcopy-gen=true
@@ -245,10 +330,12 @@ type ServersLoadBalancer struct {
 	// children servers of this load-balancer. To propagate status changes (e.g. all
 	// servers of this service are down) upwards, HealthCheck must also be enabled on
 	// the parent(s) of this service.
-	HealthCheck        *ServerHealthCheck  `json:"healthCheck,omitempty" toml:"healthCheck,omitempty" yaml:"healthCheck,omitempty" export:"true"`
-	PassHostHeader     *bool               `json:"passHostHeader" toml:"passHostHeader" yaml:"passHostHeader" export:"true"`
-	ResponseForwarding *ResponseForwarding `json:"responseForwarding,omitempty" toml:"responseForwarding,omitempty" yaml:"responseForwarding,omitempty" export:"true"`
-	ServersTransport   string              `json:"serversTransport,omitempty" toml:"serversTransport,omitempty" yaml:"serversTransport,omitempty" export:"true"`
+	HealthCheck *ServerHealthCheck `json:"healthCheck,omitempty" toml:"healthCheck,omitempty" yaml:"healthCheck,omitempty" export:"true"`
+	// PassiveHealthCheck enables passive health checks for children servers of this load-balancer.
+	PassiveHealthCheck *PassiveServerHealthCheck `json:"passiveHealthCheck,omitempty" toml:"passiveHealthCheck,omitempty" yaml:"passiveHealthCheck,omitempty" export:"true"`
+	PassHostHeader     *bool                     `json:"passHostHeader" toml:"passHostHeader" yaml:"passHostHeader" export:"true"`
+	ResponseForwarding *ResponseForwarding       `json:"responseForwarding,omitempty" toml:"responseForwarding,omitempty" yaml:"responseForwarding,omitempty" export:"true"`
+	ServersTransport   string                    `json:"serversTransport,omitempty" toml:"serversTransport,omitempty" yaml:"serversTransport,omitempty" export:"true"`
 }
 
 // Mergeable tells if the given service is mergeable.
@@ -337,6 +424,20 @@ func (h *ServerHealthCheck) SetDefaults() {
 
 // +k8s:deepcopy-gen=true
 
+type PassiveServerHealthCheck struct {
+	// FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
+	FailureWindow ptypes.Duration `json:"failureWindow,omitempty" toml:"failureWindow,omitempty" yaml:"failureWindow,omitempty" export:"true"`
+	// MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
+	MaxFailedAttempts int `json:"maxFailedAttempts,omitempty" toml:"maxFailedAttempts,omitempty" yaml:"maxFailedAttempts,omitempty" export:"true"`
+}
+
+func (p *PassiveServerHealthCheck) SetDefaults() {
+	p.FailureWindow = ptypes.Duration(10 * time.Second)
+	p.MaxFailedAttempts = 1
+}
+
+// +k8s:deepcopy-gen=true
+
 // HealthCheck controls healthcheck awareness and propagation at the services level.
 type HealthCheck struct{}
 
diff --git a/pkg/config/dynamic/http_config_test.go b/pkg/config/dynamic/http_config_test.go
new file mode 100644
index 000000000..c8cda437d
--- /dev/null
+++ b/pkg/config/dynamic/http_config_test.go
@@ -0,0 +1,165 @@
+package dynamic
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncodedCharactersMap(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   RouterDeniedEncodedPathCharacters
+		expected map[string]struct{}
+	}{
+		{
+			name: "Handles empty configuration",
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+		{
+			name: "Exclude encoded slash when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedSlash: true,
+			},
+			expected: map[string]struct{}{
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+
+		{
+			name: "Exclude encoded backslash when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedBackSlash: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+
+		{
+			name: "Exclude encoded null character when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedNullCharacter: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+		{
+			name: "Exclude encoded semicolon when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedSemicolon: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+		{
+			name: "Exclude encoded percent when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedPercent: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%3F": {},
+				"%3f": {},
+				"%23": {},
+			},
+		},
+		{
+			name: "Exclude encoded question mark when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedQuestionMark: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%23": {},
+			},
+		},
+		{
+			name: "Exclude encoded hash when allowed",
+			config: RouterDeniedEncodedPathCharacters{
+				AllowEncodedHash: true,
+			},
+			expected: map[string]struct{}{
+				"%2F": {},
+				"%2f": {},
+				"%5C": {},
+				"%5c": {},
+				"%00": {},
+				"%3B": {},
+				"%3b": {},
+				"%25": {},
+				"%3F": {},
+				"%3f": {},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			result := test.config.Map()
+			require.Equal(t, test.expected, result)
+		})
+	}
+}
diff --git a/pkg/config/dynamic/middlewares.go b/pkg/config/dynamic/middlewares.go
index 02f371948..fa10c302b 100644
--- a/pkg/config/dynamic/middlewares.go
+++ b/pkg/config/dynamic/middlewares.go
@@ -77,7 +77,7 @@ type ContentType struct {
 
 // AddPrefix holds the add prefix middleware configuration.
 // This middleware updates the path of a request before forwarding it.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/addprefix/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/addprefix/
 type AddPrefix struct {
 	// Prefix is the string to add before the current path in the requested URL.
 	// It should include a leading slash (/).
@@ -89,7 +89,7 @@ type AddPrefix struct {
 
 // BasicAuth holds the basic auth middleware configuration.
 // This middleware restricts access to your services to known users.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/basicauth/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/basicauth/
 type BasicAuth struct {
 	// Users is an array of authorized users.
 	// Each user must be declared using the name:hashed-password format.
@@ -104,7 +104,7 @@ type BasicAuth struct {
 	// Default: false.
 	RemoveHeader bool `json:"removeHeader,omitempty" toml:"removeHeader,omitempty" yaml:"removeHeader,omitempty" export:"true"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/basicauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/basicauth/#headerfield
 	HeaderField string `json:"headerField,omitempty" toml:"headerField,omitempty" yaml:"headerField,omitempty" export:"true"`
 }
 
@@ -112,7 +112,7 @@ type BasicAuth struct {
 
 // Buffering holds the buffering middleware configuration.
 // This middleware retries or limits the size of requests that can be forwarded to backends.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#maxrequestbodybytes
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#maxrequestbodybytes
 type Buffering struct {
 	// MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
 	// If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
@@ -130,7 +130,7 @@ type Buffering struct {
 	MemResponseBodyBytes int64 `json:"memResponseBodyBytes,omitempty" toml:"memResponseBodyBytes,omitempty" yaml:"memResponseBodyBytes,omitempty" export:"true"`
 	// RetryExpression defines the retry conditions.
 	// It is a logical combination of functions with operators AND (&&) and OR (||).
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#retryexpression
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/buffering/#retryexpression
 	RetryExpression string `json:"retryExpression,omitempty" toml:"retryExpression,omitempty" yaml:"retryExpression,omitempty" export:"true"`
 }
 
@@ -147,7 +147,7 @@ type Chain struct {
 
 // CircuitBreaker holds the circuit breaker middleware configuration.
 // This middleware protects the system from stacking requests to unhealthy services, resulting in cascading failures.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/circuitbreaker/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/circuitbreaker/
 type CircuitBreaker struct {
 	// Expression defines the expression that, once matched, opens the circuit breaker and applies the fallback mechanism instead of calling the services.
 	Expression string `json:"expression,omitempty" toml:"expression,omitempty" yaml:"expression,omitempty" export:"true"`
@@ -197,7 +197,7 @@ func (c *Compress) SetDefaults() {
 
 // DigestAuth holds the digest auth middleware configuration.
 // This middleware restricts access to your services to known users.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/digestauth/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/digestauth/
 type DigestAuth struct {
 	// Users defines the authorized users.
 	// Each user should be declared using the name:realm:encoded-password format.
@@ -210,7 +210,7 @@ type DigestAuth struct {
 	// Default: traefik.
 	Realm string `json:"realm,omitempty" toml:"realm,omitempty" yaml:"realm,omitempty"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/basicauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/basicauth/#headerfield
 	HeaderField string `json:"headerField,omitempty" toml:"headerField,omitempty" yaml:"headerField,omitempty" export:"true"`
 }
 
@@ -241,7 +241,7 @@ type ErrorPage struct {
 
 // ForwardAuth holds the forward auth middleware configuration.
 // This middleware delegates the request authentication to a Service.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/forwardauth/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/forwardauth/
 type ForwardAuth struct {
 	// Address defines the authentication server address.
 	Address string `json:"address,omitempty" toml:"address,omitempty" yaml:"address,omitempty"`
@@ -252,7 +252,7 @@ type ForwardAuth struct {
 	// AuthResponseHeaders defines the list of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers.
 	AuthResponseHeaders []string `json:"authResponseHeaders,omitempty" toml:"authResponseHeaders,omitempty" yaml:"authResponseHeaders,omitempty" export:"true"`
 	// AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/forwardauth/#authresponseheadersregex
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/forwardauth/#authresponseheadersregex
 	AuthResponseHeadersRegex string `json:"authResponseHeadersRegex,omitempty" toml:"authResponseHeadersRegex,omitempty" yaml:"authResponseHeadersRegex,omitempty" export:"true"`
 	// AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
 	// If not set or empty then all request headers are passed.
@@ -260,7 +260,7 @@ type ForwardAuth struct {
 	// AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.
 	AddAuthCookiesToResponse []string `json:"addAuthCookiesToResponse,omitempty" toml:"addAuthCookiesToResponse,omitempty" yaml:"addAuthCookiesToResponse,omitempty" export:"true"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/forwardauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/forwardauth/#headerfield
 	HeaderField string `json:"headerField,omitempty" toml:"headerField,omitempty" yaml:"headerField,omitempty" export:"true"`
 	// ForwardBody defines whether to send the request body to the authentication server.
 	ForwardBody bool `json:"forwardBody,omitempty" toml:"forwardBody,omitempty" yaml:"forwardBody,omitempty" export:"true"`
@@ -295,7 +295,7 @@ type ClientTLS struct {
 
 // Headers holds the headers middleware configuration.
 // This middleware manages the requests and responses headers.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/headers/#customrequestheaders
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/headers/#customrequestheaders
 type Headers struct {
 	// CustomRequestHeaders defines the header names and values to apply to the request.
 	CustomRequestHeaders map[string]string `json:"customRequestHeaders,omitempty" toml:"customRequestHeaders,omitempty" yaml:"customRequestHeaders,omitempty" export:"true"`
@@ -425,7 +425,7 @@ func (h *Headers) HasSecureHeadersDefined() bool {
 // +k8s:deepcopy-gen=true
 
 // IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/#ipstrategy
 type IPStrategy struct {
 	// Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).
 	// +kubebuilder:validation:Minimum=0
@@ -480,7 +480,7 @@ func (s *IPStrategy) Get() (ip.Strategy, error) {
 
 // IPWhiteList holds the IP whitelist middleware configuration.
 // This middleware limits allowed requests based on the client IP.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipwhitelist/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipwhitelist/
 // Deprecated: please use IPAllowList instead.
 type IPWhiteList struct {
 	// SourceRange defines the set of allowed IPs (or ranges of allowed IPs by using CIDR notation). Required.
@@ -492,7 +492,7 @@ type IPWhiteList struct {
 
 // IPAllowList holds the IP allowlist middleware configuration.
 // This middleware limits allowed requests based on the client IP.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/ipallowlist/
 type IPAllowList struct {
 	// SourceRange defines the set of allowed IPs (or ranges of allowed IPs by using CIDR notation).
 	SourceRange []string    `json:"sourceRange,omitempty" toml:"sourceRange,omitempty" yaml:"sourceRange,omitempty"`
@@ -506,7 +506,7 @@ type IPAllowList struct {
 
 // InFlightReq holds the in-flight request middleware configuration.
 // This middleware limits the number of requests being processed and served concurrently.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/
 type InFlightReq struct {
 	// Amount defines the maximum amount of allowed simultaneous in-flight request.
 	// The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
@@ -515,7 +515,7 @@ type InFlightReq struct {
 	// SourceCriterion defines what criterion is used to group requests as originating from a common source.
 	// If several strategies are defined at the same time, an error will be raised.
 	// If none are set, the default is to use the requestHost.
-	// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/#sourcecriterion
+	// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/inflightreq/#sourcecriterion
 	SourceCriterion *SourceCriterion `json:"sourceCriterion,omitempty" toml:"sourceCriterion,omitempty" yaml:"sourceCriterion,omitempty" export:"true"`
 }
 
@@ -523,7 +523,7 @@ type InFlightReq struct {
 
 // PassTLSClientCert holds the pass TLS client cert middleware configuration.
 // This middleware adds the selected data from the passed client TLS certificate to a header.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/passtlsclientcert/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/passtlsclientcert/
 type PassTLSClientCert struct {
 	// PEM sets the X-Forwarded-Tls-Client-Cert header with the certificate.
 	PEM bool `json:"pem,omitempty" toml:"pem,omitempty" yaml:"pem,omitempty" export:"true"`
@@ -635,7 +635,7 @@ func (r *Redis) SetDefaults() {
 
 // RedirectRegex holds the redirect regex middleware configuration.
 // This middleware redirects a request using regex matching and replacement.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectregex/#regex
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectregex/#regex
 type RedirectRegex struct {
 	// Regex defines the regex used to match and capture elements from the request URL.
 	Regex string `json:"regex,omitempty" toml:"regex,omitempty" yaml:"regex,omitempty"`
@@ -649,21 +649,26 @@ type RedirectRegex struct {
 
 // RedirectScheme holds the redirect scheme middleware configuration.
 // This middleware redirects requests from a scheme/port to another.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectscheme/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/redirectscheme/
 type RedirectScheme struct {
 	// Scheme defines the scheme of the new URL.
 	Scheme string `json:"scheme,omitempty" toml:"scheme,omitempty" yaml:"scheme,omitempty" export:"true"`
 	// Port defines the port of the new URL.
 	Port string `json:"port,omitempty" toml:"port,omitempty" yaml:"port,omitempty" export:"true"`
-	// Permanent defines whether the redirection is permanent (308).
+	// Permanent defines whether the redirection is permanent.
+	// For HTTP GET requests a 301 is returned, otherwise a 308 is returned.
 	Permanent bool `json:"permanent,omitempty" toml:"permanent,omitempty" yaml:"permanent,omitempty" export:"true"`
+	// ForcePermanentRedirect is an internal field (not exposed in configuration).
+	// When set to true, this forces the use of permanent redirects 308, regardless of the request method.
+	// Used by the provider ingress-ngin.
+	ForcePermanentRedirect bool `json:"-" toml:"-" yaml:"-" label:"-"`
 }
 
 // +k8s:deepcopy-gen=true
 
 // ReplacePath holds the replace path middleware configuration.
 // This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepath/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepath/
 type ReplacePath struct {
 	// Path defines the path to use as replacement in the request URL.
 	Path string `json:"path,omitempty" toml:"path,omitempty" yaml:"path,omitempty" export:"true"`
@@ -673,7 +678,7 @@ type ReplacePath struct {
 
 // ReplacePathRegex holds the replace path regex middleware configuration.
 // This middleware replaces the path of a URL using regex matching and replacement.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepathregex/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/replacepathregex/
 type ReplacePathRegex struct {
 	// Regex defines the regular expression used to match and capture the path from the request URL.
 	Regex string `json:"regex,omitempty" toml:"regex,omitempty" yaml:"regex,omitempty" export:"true"`
@@ -686,7 +691,7 @@ type ReplacePathRegex struct {
 // Retry holds the retry middleware configuration.
 // This middleware reissues requests a given number of times to a backend server if that server does not reply.
 // As soon as the server answers, the middleware stops retrying, regardless of the response status.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/retry/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/retry/
 type Retry struct {
 	// Attempts defines how many times the request should be retried.
 	Attempts int `json:"attempts,omitempty" toml:"attempts,omitempty" yaml:"attempts,omitempty" export:"true"`
@@ -702,7 +707,7 @@ type Retry struct {
 
 // StripPrefix holds the strip prefix middleware configuration.
 // This middleware removes the specified prefixes from the URL path.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefix/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefix/
 type StripPrefix struct {
 	// Prefixes defines the prefixes to strip from the request URL.
 	Prefixes []string `json:"prefixes,omitempty" toml:"prefixes,omitempty" yaml:"prefixes,omitempty" export:"true"`
@@ -717,7 +722,7 @@ type StripPrefix struct {
 
 // StripPrefixRegex holds the strip prefix regex middleware configuration.
 // This middleware removes the matching prefixes from the URL path.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefixregex/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/http/stripprefixregex/
 type StripPrefixRegex struct {
 	// Regex defines the regular expression to match the path prefix from the request URL.
 	Regex []string `json:"regex,omitempty" toml:"regex,omitempty" yaml:"regex,omitempty" export:"true"`
diff --git a/pkg/config/dynamic/tcp_config.go b/pkg/config/dynamic/tcp_config.go
index 207c90045..a68be77b9 100644
--- a/pkg/config/dynamic/tcp_config.go
+++ b/pkg/config/dynamic/tcp_config.go
@@ -39,7 +39,8 @@ type TCPService struct {
 
 // TCPWeightedRoundRobin is a weighted round robin tcp load-balancer of services.
 type TCPWeightedRoundRobin struct {
-	Services []TCPWRRService `json:"services,omitempty" toml:"services,omitempty" yaml:"services,omitempty" export:"true"`
+	Services    []TCPWRRService `json:"services,omitempty" toml:"services,omitempty" yaml:"services,omitempty" export:"true"`
+	HealthCheck *HealthCheck    `json:"healthCheck,omitempty" toml:"healthCheck,omitempty" yaml:"healthCheck,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
 }
 
 // +k8s:deepcopy-gen=true
@@ -86,7 +87,6 @@ type RouterTCPTLSConfig struct {
 type TCPServersLoadBalancer struct {
 	Servers          []TCPServer `json:"servers,omitempty" toml:"servers,omitempty" yaml:"servers,omitempty" label-slice-as-struct:"server" export:"true"`
 	ServersTransport string      `json:"serversTransport,omitempty" toml:"serversTransport,omitempty" yaml:"serversTransport,omitempty" export:"true"`
-
 	// ProxyProtocol holds the PROXY Protocol configuration.
 	// Deprecated: use ServersTransport to configure ProxyProtocol instead.
 	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty" toml:"proxyProtocol,omitempty" yaml:"proxyProtocol,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
@@ -96,7 +96,8 @@ type TCPServersLoadBalancer struct {
 	// connection. It is a duration in milliseconds, defaulting to 100. A negative value
 	// means an infinite deadline (i.e. the reading capability is never closed).
 	// Deprecated: use ServersTransport to configure the TerminationDelay instead.
-	TerminationDelay *int `json:"terminationDelay,omitempty" toml:"terminationDelay,omitempty" yaml:"terminationDelay,omitempty" export:"true"`
+	TerminationDelay *int                  `json:"terminationDelay,omitempty" toml:"terminationDelay,omitempty" yaml:"terminationDelay,omitempty" export:"true"`
+	HealthCheck      *TCPServerHealthCheck `json:"healthCheck,omitempty" toml:"healthCheck,omitempty" yaml:"healthCheck,omitempty" label:"allowEmpty" file:"allowEmpty" kv:"allowEmpty" export:"true"`
 }
 
 // Mergeable tells if the given service is mergeable.
@@ -128,7 +129,7 @@ type TCPServer struct {
 // +k8s:deepcopy-gen=true
 
 // ProxyProtocol holds the PROXY Protocol configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/routing/services/#proxy-protocol
+// More info: https://doc.traefik.io/traefik/v3.6/routing/services/#proxy-protocol
 type ProxyProtocol struct {
 	// Version defines the PROXY Protocol version to use.
 	// +kubebuilder:validation:Minimum=1
@@ -176,3 +177,21 @@ type TLSClientConfig struct {
 	PeerCertURI        string                  `description:"Defines the URI used to match against SAN URI during the peer certificate verification." json:"peerCertURI,omitempty" toml:"peerCertURI,omitempty" yaml:"peerCertURI,omitempty" export:"true"`
 	Spiffe             *Spiffe                 `description:"Defines the SPIFFE TLS configuration." json:"spiffe,omitempty" toml:"spiffe,omitempty" yaml:"spiffe,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 }
+
+// +k8s:deepcopy-gen=true
+
+// TCPServerHealthCheck holds the HealthCheck configuration.
+type TCPServerHealthCheck struct {
+	Port              int              `json:"port,omitempty" toml:"port,omitempty,omitzero" yaml:"port,omitempty" export:"true"`
+	Send              string           `json:"send,omitempty" toml:"send,omitempty" yaml:"send,omitempty" export:"true"`
+	Expect            string           `json:"expect,omitempty" toml:"expect,omitempty" yaml:"expect,omitempty" export:"true"`
+	Interval          ptypes.Duration  `json:"interval,omitempty" toml:"interval,omitempty" yaml:"interval,omitempty" export:"true"`
+	UnhealthyInterval *ptypes.Duration `json:"unhealthyInterval,omitempty" toml:"unhealthyInterval,omitempty" yaml:"unhealthyInterval,omitempty" export:"true"`
+	Timeout           ptypes.Duration  `json:"timeout,omitempty" toml:"timeout,omitempty" yaml:"timeout,omitempty" export:"true"`
+}
+
+// SetDefaults sets the default values for a TCPServerHealthCheck.
+func (t *TCPServerHealthCheck) SetDefaults() {
+	t.Interval = DefaultHealthCheckInterval
+	t.Timeout = DefaultHealthCheckTimeout
+}
diff --git a/pkg/config/dynamic/tcp_middlewares.go b/pkg/config/dynamic/tcp_middlewares.go
index 3d9624d08..1f20e8ca2 100644
--- a/pkg/config/dynamic/tcp_middlewares.go
+++ b/pkg/config/dynamic/tcp_middlewares.go
@@ -15,7 +15,7 @@ type TCPMiddleware struct {
 // TCPInFlightConn holds the TCP InFlightConn middleware configuration.
 // This middleware prevents services from being overwhelmed with high load,
 // by limiting the number of allowed simultaneous connections for one IP.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/tcp/inflightconn/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/tcp/inflightconn/
 type TCPInFlightConn struct {
 	// Amount defines the maximum amount of allowed simultaneous connections.
 	// The middleware closes the connection if there are already amount connections opened.
@@ -36,7 +36,7 @@ type TCPIPWhiteList struct {
 
 // TCPIPAllowList holds the TCP IPAllowList middleware configuration.
 // This middleware limits allowed requests based on the client IP.
-// More info: https://doc.traefik.io/traefik/v3.5/middlewares/tcp/ipallowlist/
+// More info: https://doc.traefik.io/traefik/v3.6/middlewares/tcp/ipallowlist/
 type TCPIPAllowList struct {
 	// SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).
 	SourceRange []string `json:"sourceRange,omitempty" toml:"sourceRange,omitempty" yaml:"sourceRange,omitempty"`
diff --git a/pkg/config/dynamic/zz_generated.deepcopy.go b/pkg/config/dynamic/zz_generated.deepcopy.go
index fb4cea3e9..6074f0998 100644
--- a/pkg/config/dynamic/zz_generated.deepcopy.go
+++ b/pkg/config/dynamic/zz_generated.deepcopy.go
@@ -4,7 +4,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -449,6 +449,27 @@ func (in *GrpcWeb) DeepCopy() *GrpcWeb {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HRWService) DeepCopyInto(out *HRWService) {
+	*out = *in
+	if in.Weight != nil {
+		in, out := &in.Weight, &out.Weight
+		*out = new(int)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HRWService.
+func (in *HRWService) DeepCopy() *HRWService {
+	if in == nil {
+		return nil
+	}
+	out := new(HRWService)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HTTPConfiguration) DeepCopyInto(out *HTTPConfiguration) {
 	*out = *in
@@ -688,6 +709,34 @@ func (in *HealthCheck) DeepCopy() *HealthCheck {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HighestRandomWeight) DeepCopyInto(out *HighestRandomWeight) {
+	*out = *in
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make([]HRWService, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HighestRandomWeight.
+func (in *HighestRandomWeight) DeepCopy() *HighestRandomWeight {
+	if in == nil {
+		return nil
+	}
+	out := new(HighestRandomWeight)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IPAllowList) DeepCopyInto(out *IPAllowList) {
 	*out = *in
@@ -1037,6 +1086,11 @@ func (in *Model) DeepCopyInto(out *Model) {
 		(*in).DeepCopyInto(*out)
 	}
 	in.Observability.DeepCopyInto(&out.Observability)
+	if in.DeniedEncodedPathCharacters != nil {
+		in, out := &in.DeniedEncodedPathCharacters, &out.DeniedEncodedPathCharacters
+		*out = new(RouterDeniedEncodedPathCharacters)
+		**out = **in
+	}
 	return
 }
 
@@ -1071,6 +1125,22 @@ func (in *PassTLSClientCert) DeepCopy() *PassTLSClientCert {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PassiveServerHealthCheck) DeepCopyInto(out *PassiveServerHealthCheck) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PassiveServerHealthCheck.
+func (in *PassiveServerHealthCheck) DeepCopy() *PassiveServerHealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(PassiveServerHealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProxyProtocol) DeepCopyInto(out *ProxyProtocol) {
 	*out = *in
@@ -1304,6 +1374,11 @@ func (in *Router) DeepCopyInto(out *Router) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.ParentRefs != nil {
+		in, out := &in.ParentRefs, &out.ParentRefs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.TLS != nil {
 		in, out := &in.TLS, &out.TLS
 		*out = new(RouterTLSConfig)
@@ -1314,6 +1389,11 @@ func (in *Router) DeepCopyInto(out *Router) {
 		*out = new(RouterObservabilityConfig)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DeniedEncodedPathCharacters != nil {
+		in, out := &in.DeniedEncodedPathCharacters, &out.DeniedEncodedPathCharacters
+		*out = new(RouterDeniedEncodedPathCharacters)
+		**out = **in
+	}
 	return
 }
 
@@ -1327,6 +1407,22 @@ func (in *Router) DeepCopy() *Router {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RouterDeniedEncodedPathCharacters) DeepCopyInto(out *RouterDeniedEncodedPathCharacters) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouterDeniedEncodedPathCharacters.
+func (in *RouterDeniedEncodedPathCharacters) DeepCopy() *RouterDeniedEncodedPathCharacters {
+	if in == nil {
+		return nil
+	}
+	out := new(RouterDeniedEncodedPathCharacters)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RouterObservabilityConfig) DeepCopyInto(out *RouterObservabilityConfig) {
 	*out = *in
@@ -1478,6 +1574,11 @@ func (in *ServersLoadBalancer) DeepCopyInto(out *ServersLoadBalancer) {
 		*out = new(ServerHealthCheck)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.PassiveHealthCheck != nil {
+		in, out := &in.PassiveHealthCheck, &out.PassiveHealthCheck
+		*out = new(PassiveServerHealthCheck)
+		**out = **in
+	}
 	if in.PassHostHeader != nil {
 		in, out := &in.PassHostHeader, &out.PassHostHeader
 		*out = new(bool)
@@ -1545,6 +1646,11 @@ func (in *Service) DeepCopyInto(out *Service) {
 		*out = new(ServersLoadBalancer)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.HighestRandomWeight != nil {
+		in, out := &in.HighestRandomWeight, &out.HighestRandomWeight
+		*out = new(HighestRandomWeight)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Weighted != nil {
 		in, out := &in.Weighted, &out.Weighted
 		*out = new(WeightedRoundRobin)
@@ -1926,6 +2032,27 @@ func (in *TCPServer) DeepCopy() *TCPServer {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPServerHealthCheck) DeepCopyInto(out *TCPServerHealthCheck) {
+	*out = *in
+	if in.UnhealthyInterval != nil {
+		in, out := &in.UnhealthyInterval, &out.UnhealthyInterval
+		*out = new(paersertypes.Duration)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPServerHealthCheck.
+func (in *TCPServerHealthCheck) DeepCopy() *TCPServerHealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPServerHealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TCPServersLoadBalancer) DeepCopyInto(out *TCPServersLoadBalancer) {
 	*out = *in
@@ -1944,6 +2071,11 @@ func (in *TCPServersLoadBalancer) DeepCopyInto(out *TCPServersLoadBalancer) {
 		*out = new(int)
 		**out = **in
 	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(TCPServerHealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -2040,6 +2172,11 @@ func (in *TCPWeightedRoundRobin) DeepCopyInto(out *TCPWeightedRoundRobin) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		**out = **in
+	}
 	return
 }
 
@@ -2416,6 +2553,13 @@ func (in *WRRService) DeepCopyInto(out *WRRService) {
 		*out = new(int)
 		**out = **in
 	}
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	if in.Status != nil {
 		in, out := &in.Status, &out.Status
 		*out = new(int)
diff --git a/pkg/config/runtime/runtime_http.go b/pkg/config/runtime/runtime_http.go
index 69d7e540f..f8f33fcec 100644
--- a/pkg/config/runtime/runtime_http.go
+++ b/pkg/config/runtime/runtime_http.go
@@ -43,7 +43,8 @@ func (c *Configuration) GetRoutersByEntryPoints(ctx context.Context, entryPoints
 			entryPointsRouters[entryPointName][rtName] = rt
 		}
 
-		if entryPointsCount == 0 {
+		// Root routers must have at least one entry point.
+		if entryPointsCount == 0 && rt.ParentRefs == nil {
 			rt.AddError(errors.New("no valid entryPoint for this router"), true)
 			logger.Error().Msg("No valid entryPoint for this router")
 		}
@@ -80,6 +81,11 @@ type RouterInfo struct {
 	// It is the caller's responsibility to set the initial status.
 	Status string   `json:"status,omitempty"`
 	Using  []string `json:"using,omitempty"` // Effective entry points used by that router.
+
+	// ChildRefs contains the names of child routers.
+	// This field is only filled during multi-layer routing computation of parentRefs,
+	// and used when building the runtime configuration.
+	ChildRefs []string `json:"-"`
 }
 
 // AddError adds err to r.Err, if it does not already exist.
diff --git a/pkg/config/runtime/runtime_tcp.go b/pkg/config/runtime/runtime_tcp.go
index b8bc08981..07473b51e 100644
--- a/pkg/config/runtime/runtime_tcp.go
+++ b/pkg/config/runtime/runtime_tcp.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"slices"
+	"sync"
 
 	"github.com/rs/zerolog/log"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
@@ -87,6 +88,9 @@ type TCPServiceInfo struct {
 	// It is the caller's responsibility to set the initial status.
 	Status string   `json:"status,omitempty"`
 	UsedBy []string `json:"usedBy,omitempty"` // list of routers using that service
+
+	serverStatusMu sync.RWMutex
+	serverStatus   map[string]string // keyed by server address
 }
 
 // AddError adds err to s.Err, if it does not already exist.
@@ -110,6 +114,33 @@ func (s *TCPServiceInfo) AddError(err error, critical bool) {
 	}
 }
 
+// UpdateServerStatus sets the status of the server in the TCPServiceInfo.
+func (s *TCPServiceInfo) UpdateServerStatus(server, status string) {
+	s.serverStatusMu.Lock()
+	defer s.serverStatusMu.Unlock()
+
+	if s.serverStatus == nil {
+		s.serverStatus = make(map[string]string)
+	}
+	s.serverStatus[server] = status
+}
+
+// GetAllStatus returns all the statuses of all the servers in TCPServiceInfo.
+func (s *TCPServiceInfo) GetAllStatus() map[string]string {
+	s.serverStatusMu.RLock()
+	defer s.serverStatusMu.RUnlock()
+
+	if len(s.serverStatus) == 0 {
+		return nil
+	}
+
+	allStatus := make(map[string]string, len(s.serverStatus))
+	for k, v := range s.serverStatus {
+		allStatus[k] = v
+	}
+	return allStatus
+}
+
 // TCPMiddlewareInfo holds information about a currently running middleware.
 type TCPMiddlewareInfo struct {
 	*dynamic.TCPMiddleware // dynamic configuration
diff --git a/pkg/config/static/entrypoints.go b/pkg/config/static/entrypoints.go
index ed1eb008b..f76ce08dc 100644
--- a/pkg/config/static/entrypoints.go
+++ b/pkg/config/static/entrypoints.go
@@ -65,12 +65,13 @@ func (ep *EntryPoint) SetDefaults() {
 
 // HTTPConfig is the HTTP configuration of an entry point.
 type HTTPConfig struct {
-	Redirections          *Redirections `description:"Set of redirection" json:"redirections,omitempty" toml:"redirections,omitempty" yaml:"redirections,omitempty" export:"true"`
-	Middlewares           []string      `description:"Default middlewares for the routers linked to the entry point." json:"middlewares,omitempty" toml:"middlewares,omitempty" yaml:"middlewares,omitempty" export:"true"`
-	TLS                   *TLSConfig    `description:"Default TLS configuration for the routers linked to the entry point." json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
-	EncodeQuerySemicolons bool          `description:"Defines whether request query semicolons should be URLEncoded." json:"encodeQuerySemicolons,omitempty" toml:"encodeQuerySemicolons,omitempty" yaml:"encodeQuerySemicolons,omitempty"`
-	SanitizePath          *bool         `description:"Defines whether to enable request path sanitization (removal of /./, /../ and multiple slash sequences)." json:"sanitizePath,omitempty" toml:"sanitizePath,omitempty" yaml:"sanitizePath,omitempty" export:"true"`
-	MaxHeaderBytes        int           `description:"Maximum size of request headers in bytes." json:"maxHeaderBytes,omitempty" toml:"maxHeaderBytes,omitempty" yaml:"maxHeaderBytes,omitempty" export:"true"`
+	Redirections          *Redirections      `description:"Set of redirection" json:"redirections,omitempty" toml:"redirections,omitempty" yaml:"redirections,omitempty" export:"true"`
+	Middlewares           []string           `description:"Default middlewares for the routers linked to the entry point." json:"middlewares,omitempty" toml:"middlewares,omitempty" yaml:"middlewares,omitempty" export:"true"`
+	TLS                   *TLSConfig         `description:"Default TLS configuration for the routers linked to the entry point." json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
+	EncodedCharacters     *EncodedCharacters `description:"Defines which encoded characters are allowed in the request path." json:"encodedCharacters,omitempty" toml:"encodedCharacters,omitempty" yaml:"encodedCharacters,omitempty" export:"true"`
+	EncodeQuerySemicolons bool               `description:"Defines whether request query semicolons should be URLEncoded." json:"encodeQuerySemicolons,omitempty" toml:"encodeQuerySemicolons,omitempty" yaml:"encodeQuerySemicolons,omitempty" export:"true"`
+	SanitizePath          *bool              `description:"Defines whether to enable request path sanitization (removal of /./, /../ and multiple slash sequences)." json:"sanitizePath,omitempty" toml:"sanitizePath,omitempty" yaml:"sanitizePath,omitempty" export:"true"`
+	MaxHeaderBytes        int                `description:"Maximum size of request headers in bytes." json:"maxHeaderBytes,omitempty" toml:"maxHeaderBytes,omitempty" yaml:"maxHeaderBytes,omitempty" export:"true"`
 }
 
 // SetDefaults sets the default values.
@@ -80,14 +81,39 @@ func (c *HTTPConfig) SetDefaults() {
 	c.MaxHeaderBytes = http.DefaultMaxHeaderBytes
 }
 
+// EncodedCharacters configures which encoded characters are allowed in the request path.
+type EncodedCharacters struct {
+	AllowEncodedSlash         bool `description:"Defines whether requests with encoded slash characters in the path are allowed." json:"allowEncodedSlash,omitempty" toml:"allowEncodedSlash,omitempty" yaml:"allowEncodedSlash,omitempty" export:"true"`
+	AllowEncodedBackSlash     bool `description:"Defines whether requests with encoded back slash characters in the path are allowed." json:"allowEncodedBackSlash,omitempty" toml:"allowEncodedBackSlash,omitempty" yaml:"allowEncodedBackSlash,omitempty" export:"true"`
+	AllowEncodedNullCharacter bool `description:"Defines whether requests with encoded null characters in the path are allowed." json:"allowEncodedNullCharacter,omitempty" toml:"allowEncodedNullCharacter,omitempty" yaml:"allowEncodedNullCharacter,omitempty" export:"true"`
+	AllowEncodedSemicolon     bool `description:"Defines whether requests with encoded semicolon characters in the path are allowed." json:"allowEncodedSemicolon,omitempty" toml:"allowEncodedSemicolon,omitempty" yaml:"allowEncodedSemicolon,omitempty" export:"true"`
+	AllowEncodedPercent       bool `description:"Defines whether requests with encoded percent characters in the path are allowed." json:"allowEncodedPercent,omitempty" toml:"allowEncodedPercent,omitempty" yaml:"allowEncodedPercent,omitempty" export:"true"`
+	AllowEncodedQuestionMark  bool `description:"Defines whether requests with encoded question mark characters in the path are allowed." json:"allowEncodedQuestionMark,omitempty" toml:"allowEncodedQuestionMark,omitempty" yaml:"allowEncodedQuestionMark,omitempty" export:"true"`
+	AllowEncodedHash          bool `description:"Defines whether requests with encoded hash characters in the path are allowed." json:"allowEncodedHash,omitempty" toml:"allowEncodedHash,omitempty" yaml:"allowEncodedHash,omitempty" export:"true"`
+}
+
+func (ec *EncodedCharacters) SetDefaults() {
+	ec.AllowEncodedSlash = true
+	ec.AllowEncodedBackSlash = true
+	ec.AllowEncodedNullCharacter = true
+	ec.AllowEncodedSemicolon = true
+	ec.AllowEncodedPercent = true
+	ec.AllowEncodedQuestionMark = true
+	ec.AllowEncodedHash = true
+}
+
 // HTTP2Config is the HTTP2 configuration of an entry point.
 type HTTP2Config struct {
-	MaxConcurrentStreams int32 `description:"Specifies the number of concurrent streams per connection that each client is allowed to initiate." json:"maxConcurrentStreams,omitempty" toml:"maxConcurrentStreams,omitempty" yaml:"maxConcurrentStreams,omitempty" export:"true"`
+	MaxConcurrentStreams      int32 `description:"Specifies the number of concurrent streams per connection that each client is allowed to initiate." json:"maxConcurrentStreams,omitempty" toml:"maxConcurrentStreams,omitempty" yaml:"maxConcurrentStreams,omitempty" export:"true"`
+	MaxDecoderHeaderTableSize int32 `description:"Specifies the maximum size of the HTTP2 HPACK header table on the decoding (receiving from client) side." json:"maxDecoderHeaderTableSize,omitempty" toml:"maxDecoderHeaderTableSize,omitempty" yaml:"maxDecoderHeaderTableSize,omitempty" export:"true"`
+	MaxEncoderHeaderTableSize int32 `description:"Specifies the maximum size of the HTTP2 HPACK header table on the encoding (sending to client) side." json:"maxEncoderHeaderTableSize,omitempty" toml:"maxEncoderHeaderTableSize,omitempty" yaml:"maxEncoderHeaderTableSize,omitempty" export:"true"`
 }
 
 // SetDefaults sets the default values.
 func (c *HTTP2Config) SetDefaults() {
-	c.MaxConcurrentStreams = 250 // https://cs.opensource.google/go/x/net/+/cd36cc07:http2/server.go;l=58
+	c.MaxConcurrentStreams = 250       // https://cs.opensource.google/go/x/net/+/cd36cc07:http2/server.go;l=58
+	c.MaxDecoderHeaderTableSize = 4096 // https://cs.opensource.google/go/x/net/+/0e478a2a:http2/server.go;l=105
+	c.MaxEncoderHeaderTableSize = 4096 // https://cs.opensource.google/go/x/net/+/0e478a2a:http2/server.go;l=111
 }
 
 // HTTP3Config is the HTTP3 configuration of an entry point.
diff --git a/pkg/config/static/experimental.go b/pkg/config/static/experimental.go
index dba89fec8..32f131c14 100644
--- a/pkg/config/static/experimental.go
+++ b/pkg/config/static/experimental.go
@@ -4,13 +4,15 @@ import "github.com/traefik/traefik/v3/pkg/plugins"
 
 // Experimental experimental Traefik features.
 type Experimental struct {
-	Plugins                map[string]plugins.Descriptor      `description:"Plugins configuration." json:"plugins,omitempty" toml:"plugins,omitempty" yaml:"plugins,omitempty" export:"true"`
-	LocalPlugins           map[string]plugins.LocalDescriptor `description:"Local plugins configuration." json:"localPlugins,omitempty" toml:"localPlugins,omitempty" yaml:"localPlugins,omitempty" export:"true"`
-	AbortOnPluginFailure   bool                               `description:"Defines whether all plugins must be loaded successfully for Traefik to start." json:"abortOnPluginFailure,omitempty" toml:"abortOnPluginFailure,omitempty" yaml:"abortOnPluginFailure,omitempty" export:"true"`
-	FastProxy              *FastProxyConfig                   `description:"Enables the FastProxy implementation." json:"fastProxy,omitempty" toml:"fastProxy,omitempty" yaml:"fastProxy,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
-	OTLPLogs               bool                               `description:"Enables the OpenTelemetry logs integration." json:"otlplogs,omitempty" toml:"otlplogs,omitempty" yaml:"otlplogs,omitempty" export:"true"`
-	KubernetesIngressNGINX bool                               `description:"Allow the Kubernetes Ingress NGINX provider usage." json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty" export:"true"`
+	Plugins              map[string]plugins.Descriptor      `description:"Plugins configuration." json:"plugins,omitempty" toml:"plugins,omitempty" yaml:"plugins,omitempty" export:"true"`
+	LocalPlugins         map[string]plugins.LocalDescriptor `description:"Local plugins configuration." json:"localPlugins,omitempty" toml:"localPlugins,omitempty" yaml:"localPlugins,omitempty" export:"true"`
+	AbortOnPluginFailure bool                               `description:"Defines whether all plugins must be loaded successfully for Traefik to start." json:"abortOnPluginFailure,omitempty" toml:"abortOnPluginFailure,omitempty" yaml:"abortOnPluginFailure,omitempty" export:"true"`
+	FastProxy            *FastProxyConfig                   `description:"Enables the FastProxy implementation." json:"fastProxy,omitempty" toml:"fastProxy,omitempty" yaml:"fastProxy,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
+	OTLPLogs             bool                               `description:"Enables the OpenTelemetry logs integration." json:"otlplogs,omitempty" toml:"otlplogs,omitempty" yaml:"otlplogs,omitempty" export:"true"`
+	Knative              bool                               `description:"Allow the Knative provider usage." json:"knative,omitempty" toml:"knative,omitempty" yaml:"knative,omitempty" export:"true"`
 
+	// Deprecated: KubernetesIngressNGINX provider is not an experimental feature starting with v3.6.2. Please remove its usage from the static configuration.
+	KubernetesIngressNGINX bool `description:"Allow the Kubernetes Ingress NGINX provider usage." json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty" export:"true"`
 	// Deprecated: KubernetesGateway provider is not an experimental feature starting with v3.1. Please remove its usage from the static configuration.
 	KubernetesGateway bool `description:"(Deprecated) Allow the Kubernetes gateway api provider usage." json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty" export:"true"`
 }
diff --git a/pkg/config/static/static_config.go b/pkg/config/static/static_config.go
index e64118963..49ced1695 100644
--- a/pkg/config/static/static_config.go
+++ b/pkg/config/static/static_config.go
@@ -24,6 +24,7 @@ import (
 	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/gateway"
 	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/ingress"
 	ingressnginx "github.com/traefik/traefik/v3/pkg/provider/kubernetes/ingress-nginx"
+	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/knative"
 	"github.com/traefik/traefik/v3/pkg/provider/kv/consul"
 	"github.com/traefik/traefik/v3/pkg/provider/kv/etcd"
 	"github.com/traefik/traefik/v3/pkg/provider/kv/redis"
@@ -240,6 +241,7 @@ type Providers struct {
 	KubernetesIngressNGINX *ingressnginx.Provider         `description:"Enables Kubernetes Ingress NGINX provider." json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 	KubernetesCRD          *crd.Provider                  `description:"Enables Kubernetes CRD provider." json:"kubernetesCRD,omitempty" toml:"kubernetesCRD,omitempty" yaml:"kubernetesCRD,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 	KubernetesGateway      *gateway.Provider              `description:"Enables Kubernetes Gateway API provider." json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
+	Knative                *knative.Provider              `description:"Enables Knative provider." json:"knative,omitempty" toml:"knative,omitempty" yaml:"knative,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 	Rest                   *rest.Provider                 `description:"Enables Rest provider." json:"rest,omitempty" toml:"rest,omitempty" yaml:"rest,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 	ConsulCatalog          *consulcatalog.ProviderBuilder `description:"Enables Consul Catalog provider." json:"consulCatalog,omitempty" toml:"consulCatalog,omitempty" yaml:"consulCatalog,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
 	Nomad                  *nomad.ProviderBuilder         `description:"Enables Nomad provider." json:"nomad,omitempty" toml:"nomad,omitempty" yaml:"nomad,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"`
@@ -313,6 +315,18 @@ func (c *Configuration) SetEffectiveConfiguration() {
 		c.Providers.KubernetesGateway.EntryPoints = entryPoints
 	}
 
+	// Configure Ingress NGINX provider.
+	if c.Providers.KubernetesIngressNGINX != nil {
+		var nonTLSEntryPoints []string
+		for epName, entryPoint := range c.EntryPoints {
+			if entryPoint.HTTP.TLS == nil {
+				nonTLSEntryPoints = append(nonTLSEntryPoints, epName)
+			}
+		}
+
+		c.Providers.KubernetesIngressNGINX.NonTLSEntryPoints = nonTLSEntryPoints
+	}
+
 	// Defines the default rule syntax for the Kubernetes Ingress Provider.
 	// This allows the provider to adapt the matcher syntax to the desired rule syntax version.
 	if c.Core != nil && c.Providers.KubernetesIngress != nil {
@@ -423,15 +437,17 @@ func (c *Configuration) ValidateConfiguration() error {
 	}
 
 	if c.Providers != nil && c.Providers.KubernetesIngressNGINX != nil {
-		if c.Experimental == nil || !c.Experimental.KubernetesIngressNGINX {
-			return errors.New("the experimental KubernetesIngressNGINX feature must be enabled to use the KubernetesIngressNGINX provider")
-		}
-
 		if c.Providers.KubernetesIngressNGINX.WatchNamespace != "" && c.Providers.KubernetesIngressNGINX.WatchNamespaceSelector != "" {
 			return errors.New("watchNamespace and watchNamespaceSelector options are mutually exclusive")
 		}
 	}
 
+	if c.Providers != nil && c.Providers.Knative != nil {
+		if c.Experimental == nil || !c.Experimental.Knative {
+			return errors.New("the experimental Knative feature must be enabled to use the Knative provider")
+		}
+	}
+
 	if c.AccessLog != nil && c.AccessLog.OTLP != nil {
 		if c.Experimental == nil || !c.Experimental.OTLPLogs {
 			return errors.New("the experimental OTLPLogs feature must be enabled to use OTLP access logging")
diff --git a/pkg/config/static/static_config_test.go b/pkg/config/static/static_config_test.go
index a18c7c35e..b7ba5b729 100644
--- a/pkg/config/static/static_config_test.go
+++ b/pkg/config/static/static_config_test.go
@@ -74,7 +74,9 @@ func TestConfiguration_SetEffectiveConfiguration(t *testing.T) {
 						MaxHeaderBytes: 1048576,
 					},
 					HTTP2: &HTTP2Config{
-						MaxConcurrentStreams: 250,
+						MaxConcurrentStreams:      250,
+						MaxDecoderHeaderTableSize: 4096,
+						MaxEncoderHeaderTableSize: 4096,
 					},
 					HTTP3: nil,
 					UDP: &UDPConfig{
@@ -120,7 +122,9 @@ func TestConfiguration_SetEffectiveConfiguration(t *testing.T) {
 						MaxHeaderBytes: 1048576,
 					},
 					HTTP2: &HTTP2Config{
-						MaxConcurrentStreams: 250,
+						MaxConcurrentStreams:      250,
+						MaxDecoderHeaderTableSize: 4096,
+						MaxEncoderHeaderTableSize: 4096,
 					},
 					HTTP3: nil,
 					UDP: &UDPConfig{
@@ -177,7 +181,9 @@ func TestConfiguration_SetEffectiveConfiguration(t *testing.T) {
 						MaxHeaderBytes: 1048576,
 					},
 					HTTP2: &HTTP2Config{
-						MaxConcurrentStreams: 250,
+						MaxConcurrentStreams:      250,
+						MaxDecoderHeaderTableSize: 4096,
+						MaxEncoderHeaderTableSize: 4096,
 					},
 					HTTP3: nil,
 					UDP: &UDPConfig{
@@ -238,7 +244,9 @@ func TestConfiguration_SetEffectiveConfiguration(t *testing.T) {
 						MaxHeaderBytes: 1048576,
 					},
 					HTTP2: &HTTP2Config{
-						MaxConcurrentStreams: 250,
+						MaxConcurrentStreams:      250,
+						MaxDecoderHeaderTableSize: 4096,
+						MaxEncoderHeaderTableSize: 4096,
 					},
 					HTTP3: nil,
 					UDP: &UDPConfig{
diff --git a/pkg/healthcheck/healthcheck.go b/pkg/healthcheck/healthcheck.go
index e2679d73c..e1be3343e 100644
--- a/pkg/healthcheck/healthcheck.go
+++ b/pkg/healthcheck/healthcheck.go
@@ -1,19 +1,24 @@
 package healthcheck
 
 import (
+	"bufio"
 	"context"
 	"errors"
 	"fmt"
 	"net"
 	"net/http"
+	"net/http/httptrace"
 	"net/url"
 	"strconv"
+	"sync"
 	"time"
 
 	gokitmetrics "github.com/go-kit/kit/metrics"
 	"github.com/rs/zerolog/log"
+	ptypes "github.com/traefik/paerser/types"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
 	"github.com/traefik/traefik/v3/pkg/config/runtime"
+	"golang.org/x/sync/singleflight"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
@@ -322,3 +327,160 @@ func (shc *ServiceHealthChecker) checkHealthGRPC(ctx context.Context, serverURL
 
 	return nil
 }
+
+type PassiveServiceHealthChecker struct {
+	serviceName string
+	balancer    StatusSetter
+	metrics     metricsHealthCheck
+
+	maxFailedAttempts    int
+	failureWindow        ptypes.Duration
+	hasActiveHealthCheck bool
+
+	failuresMu sync.RWMutex
+	failures   map[string][]time.Time
+
+	timersGroup singleflight.Group
+	timers      sync.Map
+}
+
+func NewPassiveHealthChecker(serviceName string, balancer StatusSetter, maxFailedAttempts int, failureWindow ptypes.Duration, hasActiveHealthCheck bool, metrics metricsHealthCheck) *PassiveServiceHealthChecker {
+	return &PassiveServiceHealthChecker{
+		serviceName:          serviceName,
+		balancer:             balancer,
+		failures:             make(map[string][]time.Time),
+		maxFailedAttempts:    maxFailedAttempts,
+		failureWindow:        failureWindow,
+		hasActiveHealthCheck: hasActiveHealthCheck,
+		metrics:              metrics,
+	}
+}
+
+func (p *PassiveServiceHealthChecker) WrapHandler(ctx context.Context, next http.Handler, targetURL string) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		var backendCalled bool
+		trace := &httptrace.ClientTrace{
+			WroteHeaders: func() {
+				backendCalled = true
+			},
+			WroteRequest: func(httptrace.WroteRequestInfo) {
+				backendCalled = true
+			},
+		}
+		clientTraceCtx := httptrace.WithClientTrace(req.Context(), trace)
+
+		codeCatcher := &codeCatcher{
+			ResponseWriter: rw,
+		}
+
+		next.ServeHTTP(codeCatcher, req.WithContext(clientTraceCtx))
+
+		if backendCalled && codeCatcher.statusCode < http.StatusInternalServerError {
+			p.failuresMu.Lock()
+			p.failures[targetURL] = nil
+			p.failuresMu.Unlock()
+			return
+		}
+
+		p.failuresMu.Lock()
+		p.failures[targetURL] = append(p.failures[targetURL], time.Now())
+		p.failuresMu.Unlock()
+
+		if p.healthy(targetURL) {
+			return
+		}
+
+		// We need to guarantee that only one goroutine (request) will update the status and create a timer for the target.
+		_, _, _ = p.timersGroup.Do(targetURL, func() (interface{}, error) {
+			// A timer is already running for this target;
+			// it means that the target is already considered unhealthy.
+			if _, ok := p.timers.Load(targetURL); ok {
+				return nil, nil
+			}
+
+			p.balancer.SetStatus(ctx, targetURL, false)
+			p.metrics.ServiceServerUpGauge().With("service", p.serviceName, "url", targetURL).Set(0)
+
+			// If the service has an active health check, the passive health checker should not reset the status.
+			// The active health check will handle the status updates.
+			if p.hasActiveHealthCheck {
+				return nil, nil
+			}
+
+			go func() {
+				timer := time.NewTimer(time.Duration(p.failureWindow))
+				defer timer.Stop()
+
+				p.timers.Store(targetURL, timer)
+
+				select {
+				case <-ctx.Done():
+				case <-timer.C:
+					p.timers.Delete(targetURL)
+
+					p.balancer.SetStatus(ctx, targetURL, true)
+					p.metrics.ServiceServerUpGauge().With("service", p.serviceName, "url", targetURL).Set(1)
+				}
+			}()
+
+			return nil, nil
+		})
+	})
+}
+
+func (p *PassiveServiceHealthChecker) healthy(targetURL string) bool {
+	windowStart := time.Now().Add(-time.Duration(p.failureWindow))
+
+	p.failuresMu.Lock()
+	defer p.failuresMu.Unlock()
+
+	// Filter failures within the sliding window.
+	failures := p.failures[targetURL]
+	for i, t := range failures {
+		if t.After(windowStart) {
+			p.failures[targetURL] = failures[i:]
+			break
+		}
+	}
+
+	// Check if failures exceed maxFailedAttempts.
+	return len(p.failures[targetURL]) < p.maxFailedAttempts
+}
+
+type codeCatcher struct {
+	http.ResponseWriter
+
+	statusCode int
+}
+
+func (c *codeCatcher) WriteHeader(statusCode int) {
+	// Here we allow the overriding of the status code,
+	// for the health check we care about the last status code written.
+	c.statusCode = statusCode
+	c.ResponseWriter.WriteHeader(statusCode)
+}
+
+func (c *codeCatcher) Write(bytes []byte) (int, error) {
+	// At the time of writing, if the status code is not set,
+	// or set to an informational status code (1xx),
+	// we set it to http.StatusOK (200).
+	if c.statusCode < http.StatusOK {
+		c.statusCode = http.StatusOK
+	}
+
+	return c.ResponseWriter.Write(bytes)
+}
+
+func (c *codeCatcher) Flush() {
+	if flusher, ok := c.ResponseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
+func (c *codeCatcher) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if h, ok := c.ResponseWriter.(http.Hijacker); ok {
+		return h.Hijack()
+	}
+
+	return nil, nil, fmt.Errorf("not a hijacker: %T", c.ResponseWriter)
+}
diff --git a/pkg/healthcheck/healthcheck_tcp.go b/pkg/healthcheck/healthcheck_tcp.go
new file mode 100644
index 000000000..4bab5c386
--- /dev/null
+++ b/pkg/healthcheck/healthcheck_tcp.go
@@ -0,0 +1,212 @@
+package healthcheck
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/config/runtime"
+	"github.com/traefik/traefik/v3/pkg/tcp"
+)
+
+// maxPayloadSize is the maximum payload size that can be sent during health checks.
+const maxPayloadSize = 65535
+
+type TCPHealthCheckTarget struct {
+	Address string
+	TLS     bool
+	Dialer  tcp.Dialer
+}
+type ServiceTCPHealthChecker struct {
+	balancer StatusSetter
+	info     *runtime.TCPServiceInfo
+
+	config            *dynamic.TCPServerHealthCheck
+	interval          time.Duration
+	unhealthyInterval time.Duration
+	timeout           time.Duration
+
+	healthyTargets   chan *TCPHealthCheckTarget
+	unhealthyTargets chan *TCPHealthCheckTarget
+
+	serviceName string
+}
+
+func NewServiceTCPHealthChecker(ctx context.Context, config *dynamic.TCPServerHealthCheck, service StatusSetter, info *runtime.TCPServiceInfo, targets []TCPHealthCheckTarget, serviceName string) *ServiceTCPHealthChecker {
+	logger := log.Ctx(ctx)
+	interval := time.Duration(config.Interval)
+	if interval <= 0 {
+		logger.Error().Msg("Health check interval smaller than zero, default value will be used instead.")
+		interval = time.Duration(dynamic.DefaultHealthCheckInterval)
+	}
+
+	// If the unhealthyInterval option is not set, we use the interval option value,
+	// to check the unhealthy targets as often as the healthy ones.
+	var unhealthyInterval time.Duration
+	if config.UnhealthyInterval == nil {
+		unhealthyInterval = interval
+	} else {
+		unhealthyInterval = time.Duration(*config.UnhealthyInterval)
+		if unhealthyInterval <= 0 {
+			logger.Error().Msg("Health check unhealthy interval smaller than zero, default value will be used instead.")
+			unhealthyInterval = time.Duration(dynamic.DefaultHealthCheckInterval)
+		}
+	}
+
+	timeout := time.Duration(config.Timeout)
+	if timeout <= 0 {
+		logger.Error().Msg("Health check timeout smaller than zero, default value will be used instead.")
+		timeout = time.Duration(dynamic.DefaultHealthCheckTimeout)
+	}
+
+	if config.Send != "" && len(config.Send) > maxPayloadSize {
+		logger.Error().Msgf("Health check payload size exceeds maximum allowed size of %d bytes, falling back to connect only check.", maxPayloadSize)
+		config.Send = ""
+	}
+
+	if config.Expect != "" && len(config.Expect) > maxPayloadSize {
+		logger.Error().Msgf("Health check expected response size exceeds maximum allowed size of %d bytes, falling back to close without response.", maxPayloadSize)
+		config.Expect = ""
+	}
+
+	healthyTargets := make(chan *TCPHealthCheckTarget, len(targets))
+	for _, target := range targets {
+		healthyTargets <- &target
+	}
+	unhealthyTargets := make(chan *TCPHealthCheckTarget, len(targets))
+
+	return &ServiceTCPHealthChecker{
+		balancer:          service,
+		info:              info,
+		config:            config,
+		interval:          interval,
+		unhealthyInterval: unhealthyInterval,
+		timeout:           timeout,
+		healthyTargets:    healthyTargets,
+		unhealthyTargets:  unhealthyTargets,
+		serviceName:       serviceName,
+	}
+}
+
+func (thc *ServiceTCPHealthChecker) Launch(ctx context.Context) {
+	go thc.healthcheck(ctx, thc.unhealthyTargets, thc.unhealthyInterval)
+
+	thc.healthcheck(ctx, thc.healthyTargets, thc.interval)
+}
+
+func (thc *ServiceTCPHealthChecker) healthcheck(ctx context.Context, targets chan *TCPHealthCheckTarget, interval time.Duration) {
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+
+		case <-ticker.C:
+			// We collect the targets to check once for all,
+			// to avoid rechecking a target that has been moved during the health check.
+			var targetsToCheck []*TCPHealthCheckTarget
+			hasMoreTargets := true
+			for hasMoreTargets {
+				select {
+				case <-ctx.Done():
+					return
+				case target := <-targets:
+					targetsToCheck = append(targetsToCheck, target)
+				default:
+					hasMoreTargets = false
+				}
+			}
+
+			// Now we can check the targets.
+			for _, target := range targetsToCheck {
+				select {
+				case <-ctx.Done():
+					return
+				default:
+				}
+
+				up := true
+
+				if err := thc.executeHealthCheck(ctx, thc.config, target); err != nil {
+					// The context is canceled when the dynamic configuration is refreshed.
+					if errors.Is(err, context.Canceled) {
+						return
+					}
+
+					log.Ctx(ctx).Warn().
+						Str("targetAddress", target.Address).
+						Err(err).
+						Msg("Health check failed.")
+
+					up = false
+				}
+
+				thc.balancer.SetStatus(ctx, target.Address, up)
+
+				var statusStr string
+				if up {
+					statusStr = runtime.StatusUp
+					thc.healthyTargets <- target
+				} else {
+					statusStr = runtime.StatusDown
+					thc.unhealthyTargets <- target
+				}
+
+				thc.info.UpdateServerStatus(target.Address, statusStr)
+
+				// TODO: add a TCP server up metric (like for HTTP).
+			}
+		}
+	}
+}
+
+func (thc *ServiceTCPHealthChecker) executeHealthCheck(ctx context.Context, config *dynamic.TCPServerHealthCheck, target *TCPHealthCheckTarget) error {
+	addr := target.Address
+	if config.Port != 0 {
+		host, _, err := net.SplitHostPort(target.Address)
+		if err != nil {
+			return fmt.Errorf("parsing address %q: %w", target.Address, err)
+		}
+
+		addr = net.JoinHostPort(host, strconv.Itoa(config.Port))
+	}
+
+	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(time.Duration(config.Timeout)))
+	defer cancel()
+
+	conn, err := target.Dialer.DialContext(ctx, "tcp", addr, nil)
+	if err != nil {
+		return fmt.Errorf("connecting to %s: %w", addr, err)
+	}
+	defer conn.Close()
+
+	if err := conn.SetDeadline(time.Now().Add(thc.timeout)); err != nil {
+		return fmt.Errorf("setting timeout to %s: %w", thc.timeout, err)
+	}
+
+	if config.Send != "" {
+		if _, err = conn.Write([]byte(config.Send)); err != nil {
+			return fmt.Errorf("sending to %s: %w", addr, err)
+		}
+	}
+
+	if config.Expect != "" {
+		buf := make([]byte, len(config.Expect))
+		if _, err = conn.Read(buf); err != nil {
+			return fmt.Errorf("reading from %s: %w", addr, err)
+		}
+
+		if string(buf) != config.Expect {
+			return errors.New("unexpected heath check response")
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/healthcheck/healthcheck_tcp_test.go b/pkg/healthcheck/healthcheck_tcp_test.go
new file mode 100644
index 000000000..70f91e8a8
--- /dev/null
+++ b/pkg/healthcheck/healthcheck_tcp_test.go
@@ -0,0 +1,759 @@
+package healthcheck
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	ptypes "github.com/traefik/paerser/types"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	truntime "github.com/traefik/traefik/v3/pkg/config/runtime"
+	"github.com/traefik/traefik/v3/pkg/tcp"
+)
+
+var localhostCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDJzCCAg+gAwIBAgIUe3vnWg3cTbflL6kz2TyPUxmV8Y4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wIBcNMjUwMzA1MjAwOTM4WhgPMjA1
+NTAyMjYyMDA5MzhaMBYxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Mm4Sp6xzJvFZJWAv/KVmI1krywiuef8Fhlf
+JR2M0caKixjBcNt4U8KwrzIrqL+8nilbps1QuwpQ09+6ztlbUXUL6DqR8ZC+4oCp
+gOZ3yyVX2vhMigkATbQyJrX/WVjWSHD5rIUBP2BrsaYLt1qETnFP9wwQ3YEi7V4l
+c4+jDrZOtJvrv+tRClt9gQJVgkr7Y30X+dx+rsh+ROaA2+/VTDX0qtoqd/4fjhcJ
+OY9VLm0eU66VUMyOTNeUm6ZAXRBp/EonIM1FXOlj82S0pZQbPrvyWWqWoAjtPvLU
+qRzqp/BQJqx3EHz1dP6s+xUjP999B+7jhiHoFhZ/bfVVlx8XkwIDAQABo2swaTAd
+BgNVHQ4EFgQUhJiJ37LW6RODCpBPAApG1zQxFtAwHwYDVR0jBBgwFoAUhJiJ37LW
+6RODCpBPAApG1zQxFtAwDwYDVR0TAQH/BAUwAwEB/zAWBgNVHREEDzANggtleGFt
+cGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAfnDPHllA1TFlQ6zY46tqM20d68bR
+kXeGMKLoaATFPbDea5H8/GM5CU6CPD7RUuEB9CvxvaM0aOInxkgstozG7BOr8hcs
+WS9fMgM0oO5yGiSOv+Qa0Rc0BFb6A1fUJRta5MI5DTdTJLoyoRX/5aocSI34T67x
+ULbkJvVXw6hnx/KZ65apNobfmVQSy7DR8Fo82eB4hSoaLpXyUUTLmctGgrRCoKof
+GVUJfKsDJ4Ts8WIR1np74flSoxksWSHEOYk79AZOPANYgJwPMMiiZKsKm17GBoGu
+DxI0om4eX8GaSSZAtG6TOt3O3v1oCjKNsAC+u585HN0x0MFA33TUzC15NA==
+-----END CERTIFICATE-----`)
+
+var localhostKey = []byte(`-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDgybhKnrHMm8Vk
+lYC/8pWYjWSvLCK55/wWGV8lHYzRxoqLGMFw23hTwrCvMiuov7yeKVumzVC7ClDT
+37rO2VtRdQvoOpHxkL7igKmA5nfLJVfa+EyKCQBNtDImtf9ZWNZIcPmshQE/YGux
+pgu3WoROcU/3DBDdgSLtXiVzj6MOtk60m+u/61EKW32BAlWCSvtjfRf53H6uyH5E
+5oDb79VMNfSq2ip3/h+OFwk5j1UubR5TrpVQzI5M15SbpkBdEGn8SicgzUVc6WPz
+ZLSllBs+u/JZapagCO0+8tSpHOqn8FAmrHcQfPV0/qz7FSM/330H7uOGIegWFn9t
+9VWXHxeTAgMBAAECggEALinfGhv7Iaz/3cdCOKlGBZ1MBxmGTC2TPKqbOpEWAWLH
+wwcjetznmjQKewBPrQkrYEPYGapioPbeYJS61Y4XzeO+vUOCA10ZhoSrytgJ1ANo
+RoTlmxd8I3kVL5QCy8ONxjTFYaOy/OP9We9iypXhRAbLSE4HDKZfmOXTxSbDctql
+Kq7uV3LX1KCfr9C6M8d79a0Rdr4p8IXp8MOg3tXq6n75vZbepRFyAujhg7o/kkTp
+lgv87h89lrK97K+AjqtvCIT3X3VXfA+LYp3AoQFdOluKgyJT221MyHkTeI/7gggt
+Z57lVGD71UJH/LGUJWrraJqXd9uDxZWprD/s66BIAQKBgQD8CtHUJ/VuS7gP0ebN
+688zrmRtENj6Gqi+URm/Pwgr9b7wKKlf9jjhg5F/ue+BgB7/nK6N7yJ4Xx3JJ5ox
+LqsRGLFa4fDBxogF/FN27obD8naOxe2wS1uTjM6LSrvdJ+HjeNEwHYhjuDjTAHj5
+VVEMagZWgkE4jBiFUYefiYLsAQKBgQDkUVdW8cXaYri5xxDW86JNUzI1tUPyd6I+
+AkOHV/V0y2zpwTHVLcETRpdVGpc5TH3J5vWf+5OvSz6RDTGjv7blDb8vB/kVkFmn
+uXTi0dB9P+SYTsm+X3V7hOAFsyVYZ1D9IFsKUyMgxMdF+qgERjdPKx5IdLV/Jf3q
+P9pQ922TkwKBgCKllhyU9Z8Y14+NKi4qeUxAb9uyUjFnUsT+vwxULNpmKL44yLfB
+UCZoAKtPMwZZR2mZ70Dhm5pycNTDFeYm5Ssvesnkf0UT9oTkH9EcjvgGr5eGy9rN
+MSSCWa46MsL/BYVQiWkU1jfnDiCrUvXrbX3IYWCo/TA5yfEhuQQMUiwBAoGADyzo
+5TqEsBNHu/FjSSZAb2tMNw2pSoBxJDX6TxClm/G5d4AD0+uKncFfZaSy0HgpFDZp
+tQx/sHML4ZBC8GNZwLe9MV8SS0Cg9Oj6v+i6Ntj8VLNH7YNix6b5TOevX8TeOTTh
+WDpWZ2Ms65XRfRc9reFrzd0UAzN/QQaleCQ6AEkCgYBe4Ucows7JGbv7fNkz3nb1
+kyH+hk9ecnq/evDKX7UUxKO1wwTi74IYKgcRB2uPLpHKL35gPz+LAfCphCW5rwpR
+lvDhS+Pi/1KCBJxLHMv+V/WrckDRgHFnAhDaBZ+2vI/s09rKDnpjcTzV7x22kL0b
+XIJCEEE8JZ4AXIZ+IcB6LA==
+-----END PRIVATE KEY-----`)
+
+func TestNewServiceTCPHealthChecker(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		config           *dynamic.TCPServerHealthCheck
+		expectedInterval time.Duration
+		expectedTimeout  time.Duration
+	}{
+		{
+			desc:             "default values",
+			config:           &dynamic.TCPServerHealthCheck{},
+			expectedInterval: time.Duration(dynamic.DefaultHealthCheckInterval),
+			expectedTimeout:  time.Duration(dynamic.DefaultHealthCheckTimeout),
+		},
+		{
+			desc: "out of range values",
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(-time.Second),
+				Timeout:  ptypes.Duration(-time.Second),
+			},
+			expectedInterval: time.Duration(dynamic.DefaultHealthCheckInterval),
+			expectedTimeout:  time.Duration(dynamic.DefaultHealthCheckTimeout),
+		},
+		{
+			desc: "custom durations",
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Second * 10),
+				Timeout:  ptypes.Duration(time.Second * 5),
+			},
+			expectedInterval: time.Second * 10,
+			expectedTimeout:  time.Second * 5,
+		},
+		{
+			desc: "interval shorter than timeout",
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Second),
+				Timeout:  ptypes.Duration(time.Second * 5),
+			},
+			expectedInterval: time.Second,
+			expectedTimeout:  time.Second * 5,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			healthChecker := NewServiceTCPHealthChecker(t.Context(), test.config, nil, nil, nil, "")
+			assert.Equal(t, test.expectedInterval, healthChecker.interval)
+			assert.Equal(t, test.expectedTimeout, healthChecker.timeout)
+		})
+	}
+}
+
+func TestServiceTCPHealthChecker_executeHealthCheck_connection(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		address         string
+		config          *dynamic.TCPServerHealthCheck
+		expectedAddress string
+	}{
+		{
+			desc:            "no port override - uses original address",
+			address:         "127.0.0.1:8080",
+			config:          &dynamic.TCPServerHealthCheck{Port: 0},
+			expectedAddress: "127.0.0.1:8080",
+		},
+		{
+			desc:            "port override - uses overridden port",
+			address:         "127.0.0.1:8080",
+			config:          &dynamic.TCPServerHealthCheck{Port: 9090},
+			expectedAddress: "127.0.0.1:9090",
+		},
+		{
+			desc:            "IPv6 address with port override",
+			address:         "[::1]:8080",
+			config:          &dynamic.TCPServerHealthCheck{Port: 9090},
+			expectedAddress: "[::1]:9090",
+		},
+		{
+			desc:            "successful connection without port override",
+			address:         "localhost:3306",
+			config:          &dynamic.TCPServerHealthCheck{Port: 0},
+			expectedAddress: "localhost:3306",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			// Create a mock dialer that records the address it was asked to dial.
+			var gotAddress string
+			mockDialer := &dialerMock{
+				onDial: func(network, addr string) (net.Conn, error) {
+					gotAddress = addr
+					return &connMock{}, nil
+				},
+			}
+
+			targets := []TCPHealthCheckTarget{{
+				Address: test.address,
+				Dialer:  mockDialer,
+			}}
+			healthChecker := NewServiceTCPHealthChecker(t.Context(), test.config, nil, nil, targets, "test")
+
+			// Execute a health check to see what address it tries to connect to.
+			err := healthChecker.executeHealthCheck(t.Context(), test.config, &targets[0])
+			require.NoError(t, err)
+
+			// Verify that the health check attempted to connect to the expected address.
+			assert.Equal(t, test.expectedAddress, gotAddress)
+		})
+	}
+}
+
+func TestServiceTCPHealthChecker_executeHealthCheck_payloadHandling(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		config           *dynamic.TCPServerHealthCheck
+		mockResponse     string
+		expectedSentData string
+		expectedSuccess  bool
+	}{
+		{
+			desc: "successful send and expect",
+			config: &dynamic.TCPServerHealthCheck{
+				Send:   "PING",
+				Expect: "PONG",
+			},
+			mockResponse:     "PONG",
+			expectedSentData: "PING",
+			expectedSuccess:  true,
+		},
+		{
+			desc: "send without expect",
+			config: &dynamic.TCPServerHealthCheck{
+				Send:   "STATUS",
+				Expect: "",
+			},
+			expectedSentData: "STATUS",
+			expectedSuccess:  true,
+		},
+		{
+			desc: "send without expect, ignores response",
+			config: &dynamic.TCPServerHealthCheck{
+				Send: "STATUS",
+			},
+			mockResponse:     strings.Repeat("A", maxPayloadSize+1),
+			expectedSentData: "STATUS",
+			expectedSuccess:  true,
+		},
+		{
+			desc: "expect without send",
+			config: &dynamic.TCPServerHealthCheck{
+				Expect: "READY",
+			},
+			mockResponse:    "READY",
+			expectedSuccess: true,
+		},
+		{
+			desc: "wrong response received",
+			config: &dynamic.TCPServerHealthCheck{
+				Send:   "PING",
+				Expect: "PONG",
+			},
+			mockResponse:     "WRONG",
+			expectedSentData: "PING",
+			expectedSuccess:  false,
+		},
+		{
+			desc: "send payload too large - gets truncated",
+			config: &dynamic.TCPServerHealthCheck{
+				Send:   strings.Repeat("A", maxPayloadSize+1), // Will be truncated to empty
+				Expect: "OK",
+			},
+			mockResponse:    "OK",
+			expectedSuccess: true,
+		},
+		{
+			desc: "expect payload too large - gets truncated",
+			config: &dynamic.TCPServerHealthCheck{
+				Send:   "PING",
+				Expect: strings.Repeat("B", maxPayloadSize+1), // Will be truncated to empty
+			},
+			expectedSentData: "PING",
+			expectedSuccess:  true,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			var sentData []byte
+			mockConn := &connMock{
+				writeFunc: func(data []byte) (int, error) {
+					sentData = append([]byte{}, data...)
+					return len(data), nil
+				},
+				readFunc: func(buf []byte) (int, error) {
+					return copy(buf, test.mockResponse), nil
+				},
+			}
+
+			mockDialer := &dialerMock{
+				onDial: func(network, addr string) (net.Conn, error) {
+					return mockConn, nil
+				},
+			}
+
+			targets := []TCPHealthCheckTarget{{
+				Address: "127.0.0.1:8080",
+				TLS:     false,
+				Dialer:  mockDialer,
+			}}
+
+			healthChecker := NewServiceTCPHealthChecker(t.Context(), test.config, nil, nil, targets, "test")
+
+			err := healthChecker.executeHealthCheck(t.Context(), test.config, &targets[0])
+
+			if test.expectedSuccess {
+				assert.NoError(t, err, "Health check should succeed")
+			} else {
+				assert.Error(t, err, "Health check should fail")
+			}
+
+			assert.Equal(t, test.expectedSentData, string(sentData), "Should send the expected data")
+		})
+	}
+}
+
+func TestServiceTCPHealthChecker_Launch(t *testing.T) {
+	testCases := []struct {
+		desc                  string
+		server                *sequencedTCPServer
+		config                *dynamic.TCPServerHealthCheck
+		expNumRemovedServers  int
+		expNumUpsertedServers int
+		targetStatus          string
+	}{
+		{
+			desc: "connection-only healthy server staying healthy",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true},
+				tcpMockSequence{accept: true},
+				tcpMockSequence{accept: true},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  0,
+			expNumUpsertedServers: 3, // 3 health check sequences
+			targetStatus:          truntime.StatusUp,
+		},
+		{
+			desc: "connection-only healthy server becoming unhealthy",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true},
+				tcpMockSequence{accept: false},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  1,
+			expNumUpsertedServers: 1,
+			targetStatus:          truntime.StatusDown,
+		},
+		{
+			desc: "connection-only server toggling unhealthy to healthy",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: false},
+				tcpMockSequence{accept: true},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  1, // 1 failure call
+			expNumUpsertedServers: 1, // 1 success call
+			targetStatus:          truntime.StatusUp,
+		},
+		{
+			desc: "connection-only server toggling healthy to unhealthy to healthy",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true},
+				tcpMockSequence{accept: false},
+				tcpMockSequence{accept: true},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  1,
+			expNumUpsertedServers: 2,
+			targetStatus:          truntime.StatusUp,
+		},
+		{
+			desc: "send/expect healthy server staying healthy",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true, payloadIn: "PING", payloadOut: "PONG"},
+				tcpMockSequence{accept: true, payloadIn: "PING", payloadOut: "PONG"},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Send:     "PING",
+				Expect:   "PONG",
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  0,
+			expNumUpsertedServers: 2, // 2 successful health checks
+			targetStatus:          truntime.StatusUp,
+		},
+		{
+			desc: "send/expect server with wrong response",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true, payloadIn: "PING", payloadOut: "PONG"},
+				tcpMockSequence{accept: true, payloadIn: "PING", payloadOut: "WRONG"},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Send:     "PING",
+				Expect:   "PONG",
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  1,
+			expNumUpsertedServers: 1,
+			targetStatus:          truntime.StatusDown,
+		},
+		{
+			desc: "TLS healthy server staying healthy",
+			server: newTCPServer(t,
+				true,
+				tcpMockSequence{accept: true, payloadIn: "HELLO", payloadOut: "WORLD"},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Send:     "HELLO",
+				Expect:   "WORLD",
+				Interval: ptypes.Duration(time.Millisecond * 500),
+				Timeout:  ptypes.Duration(time.Millisecond * 2000), // Even longer timeout for TLS handshake
+			},
+			expNumRemovedServers:  0,
+			expNumUpsertedServers: 1, // 1 TLS health check sequence
+			targetStatus:          truntime.StatusUp,
+		},
+		{
+			desc: "send-only healthcheck (no expect)",
+			server: newTCPServer(t,
+				false,
+				tcpMockSequence{accept: true, payloadIn: "STATUS"},
+				tcpMockSequence{accept: true, payloadIn: "STATUS"},
+			),
+			config: &dynamic.TCPServerHealthCheck{
+				Send:     "STATUS",
+				Interval: ptypes.Duration(time.Millisecond * 50),
+				Timeout:  ptypes.Duration(time.Millisecond * 40),
+			},
+			expNumRemovedServers:  0,
+			expNumUpsertedServers: 2,
+			targetStatus:          truntime.StatusUp,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithCancel(log.Logger.WithContext(t.Context()))
+			defer cancel()
+
+			test.server.Start(t)
+
+			dialerManager := tcp.NewDialerManager(nil)
+			dialerManager.Update(map[string]*dynamic.TCPServersTransport{"default@internal": {
+				TLS: &dynamic.TLSClientConfig{
+					InsecureSkipVerify: true,
+					ServerName:         "example.com",
+				},
+			}})
+
+			dialer, err := dialerManager.Build(&dynamic.TCPServersLoadBalancer{}, test.server.TLS)
+			require.NoError(t, err)
+
+			targets := []TCPHealthCheckTarget{
+				{
+					Address: test.server.Addr.String(),
+					TLS:     test.server.TLS,
+					Dialer:  dialer,
+				},
+			}
+
+			lb := &testLoadBalancer{}
+			serviceInfo := &truntime.TCPServiceInfo{}
+
+			service := NewServiceTCPHealthChecker(ctx, test.config, lb, serviceInfo, targets, "serviceName")
+
+			go service.Launch(ctx)
+
+			// How much time to wait for the health check to actually complete.
+			deadline := time.Now().Add(200 * time.Millisecond)
+			// TLS handshake can take much longer.
+			if test.server.TLS {
+				deadline = time.Now().Add(1000 * time.Millisecond)
+			}
+
+			// Wait for all health checks to complete deterministically
+			for i := range test.server.StatusSequence {
+				test.server.Next()
+
+				initialUpserted := lb.numUpsertedServers
+				initialRemoved := lb.numRemovedServers
+
+				for time.Now().Before(deadline) {
+					time.Sleep(5 * time.Millisecond)
+					if lb.numUpsertedServers > initialUpserted || lb.numRemovedServers > initialRemoved {
+						// Stop the health checker immediately after the last expected sequence completes
+						// to prevent extra health checks from firing and modifying the counters.
+						if i == len(test.server.StatusSequence)-1 {
+							cancel()
+						}
+						break
+					}
+				}
+			}
+
+			assert.Equal(t, test.expNumRemovedServers, lb.numRemovedServers, "removed servers")
+			assert.Equal(t, test.expNumUpsertedServers, lb.numUpsertedServers, "upserted servers")
+			assert.Equal(t, map[string]string{test.server.Addr.String(): test.targetStatus}, serviceInfo.GetAllStatus())
+		})
+	}
+}
+
+func TestServiceTCPHealthChecker_differentIntervals(t *testing.T) {
+	// Test that unhealthy servers are checked more frequently than healthy servers
+	// when UnhealthyInterval is set to a lower value than Interval
+	ctx, cancel := context.WithCancel(t.Context())
+	t.Cleanup(cancel)
+
+	// Create a healthy TCP server that always accepts connections
+	healthyServer := newTCPServer(t, false,
+		tcpMockSequence{accept: true}, tcpMockSequence{accept: true}, tcpMockSequence{accept: true},
+		tcpMockSequence{accept: true}, tcpMockSequence{accept: true},
+	)
+	healthyServer.Start(t)
+
+	// Create an unhealthy TCP server that always rejects connections
+	unhealthyServer := newTCPServer(t, false,
+		tcpMockSequence{accept: false}, tcpMockSequence{accept: false}, tcpMockSequence{accept: false},
+		tcpMockSequence{accept: false}, tcpMockSequence{accept: false}, tcpMockSequence{accept: false},
+		tcpMockSequence{accept: false}, tcpMockSequence{accept: false}, tcpMockSequence{accept: false},
+		tcpMockSequence{accept: false},
+	)
+	unhealthyServer.Start(t)
+
+	lb := &testLoadBalancer{RWMutex: &sync.RWMutex{}}
+
+	// Set normal interval to 500ms but unhealthy interval to 50ms
+	// This means unhealthy servers should be checked 10x more frequently
+	config := &dynamic.TCPServerHealthCheck{
+		Interval:          ptypes.Duration(500 * time.Millisecond),
+		UnhealthyInterval: pointer(ptypes.Duration(50 * time.Millisecond)),
+		Timeout:           ptypes.Duration(100 * time.Millisecond),
+	}
+
+	// Set up dialer manager
+	dialerManager := tcp.NewDialerManager(nil)
+	dialerManager.Update(map[string]*dynamic.TCPServersTransport{
+		"default@internal": {
+			DialTimeout:   ptypes.Duration(100 * time.Millisecond),
+			DialKeepAlive: ptypes.Duration(100 * time.Millisecond),
+		},
+	})
+
+	// Get dialer for targets
+	dialer, err := dialerManager.Build(&dynamic.TCPServersLoadBalancer{}, false)
+	require.NoError(t, err)
+
+	targets := []TCPHealthCheckTarget{
+		{Address: healthyServer.Addr.String(), TLS: false, Dialer: dialer},
+		{Address: unhealthyServer.Addr.String(), TLS: false, Dialer: dialer},
+	}
+
+	serviceInfo := &truntime.TCPServiceInfo{}
+	hc := NewServiceTCPHealthChecker(ctx, config, lb, serviceInfo, targets, "test-service")
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+
+	go func() {
+		hc.Launch(ctx)
+		wg.Done()
+	}()
+
+	// Let it run for 2 seconds to see the different check frequencies
+	select {
+	case <-time.After(2 * time.Second):
+		cancel()
+	case <-ctx.Done():
+	}
+
+	wg.Wait()
+
+	lb.Lock()
+	defer lb.Unlock()
+
+	// The unhealthy server should be checked more frequently (50ms interval)
+	// compared to the healthy server (500ms interval), so we should see
+	// significantly more "removed" events than "upserted" events
+	assert.Greater(t, lb.numRemovedServers, lb.numUpsertedServers, "unhealthy servers checked more frequently")
+}
+
+type tcpMockSequence struct {
+	accept     bool
+	payloadIn  string
+	payloadOut string
+}
+
+type sequencedTCPServer struct {
+	Addr           *net.TCPAddr
+	StatusSequence []tcpMockSequence
+	TLS            bool
+	release        chan struct{}
+}
+
+func newTCPServer(t *testing.T, tlsEnabled bool, statusSequence ...tcpMockSequence) *sequencedTCPServer {
+	t.Helper()
+
+	addr, err := net.ResolveTCPAddr("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	listener, err := net.ListenTCP("tcp", addr)
+	require.NoError(t, err)
+
+	tcpAddr, ok := listener.Addr().(*net.TCPAddr)
+	require.True(t, ok)
+
+	listener.Close()
+
+	return &sequencedTCPServer{
+		Addr:           tcpAddr,
+		TLS:            tlsEnabled,
+		StatusSequence: statusSequence,
+		release:        make(chan struct{}),
+	}
+}
+
+func (s *sequencedTCPServer) Next() {
+	s.release <- struct{}{}
+}
+
+func (s *sequencedTCPServer) Start(t *testing.T) {
+	t.Helper()
+
+	go func() {
+		var listener net.Listener
+
+		for _, seq := range s.StatusSequence {
+			<-s.release
+			if listener != nil {
+				listener.Close()
+			}
+
+			if !seq.accept {
+				continue
+			}
+
+			lis, err := net.ListenTCP("tcp", s.Addr)
+			require.NoError(t, err)
+
+			listener = lis
+
+			if s.TLS {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				require.NoError(t, err)
+
+				x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
+				require.NoError(t, err)
+
+				certpool := x509.NewCertPool()
+				certpool.AddCert(x509Cert)
+
+				listener = tls.NewListener(
+					listener,
+					&tls.Config{
+						RootCAs:            certpool,
+						Certificates:       []tls.Certificate{cert},
+						InsecureSkipVerify: true,
+						ServerName:         "example.com",
+						MinVersion:         tls.VersionTLS12,
+						MaxVersion:         tls.VersionTLS12,
+						ClientAuth:         tls.VerifyClientCertIfGiven,
+						ClientCAs:          certpool,
+					},
+				)
+			}
+
+			conn, err := listener.Accept()
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				_ = conn.Close()
+			})
+
+			// For TLS connections, perform handshake first
+			if s.TLS {
+				if tlsConn, ok := conn.(*tls.Conn); ok {
+					if err := tlsConn.Handshake(); err != nil {
+						continue // Skip this sequence on handshake failure
+					}
+				}
+			}
+
+			if seq.payloadIn == "" {
+				continue
+			}
+
+			buf := make([]byte, len(seq.payloadIn))
+			n, err := conn.Read(buf)
+			require.NoError(t, err)
+
+			recv := strings.TrimSpace(string(buf[:n]))
+
+			switch recv {
+			case seq.payloadIn:
+				if _, err := conn.Write([]byte(seq.payloadOut)); err != nil {
+					t.Errorf("failed to write payload: %v", err)
+				}
+			default:
+				if _, err := conn.Write([]byte("FAULT\n")); err != nil {
+					t.Errorf("failed to write payload: %v", err)
+				}
+			}
+		}
+
+		defer close(s.release)
+	}()
+}
+
+type dialerMock struct {
+	onDial func(network, addr string) (net.Conn, error)
+}
+
+func (dm *dialerMock) Dial(network, addr string, _ tcp.ClientConn) (net.Conn, error) {
+	return dm.onDial(network, addr)
+}
+
+func (dm *dialerMock) DialContext(_ context.Context, network, addr string, _ tcp.ClientConn) (net.Conn, error) {
+	return dm.onDial(network, addr)
+}
+
+func (dm *dialerMock) TerminationDelay() time.Duration {
+	return 0
+}
+
+type connMock struct {
+	writeFunc func([]byte) (int, error)
+	readFunc  func([]byte) (int, error)
+}
+
+func (cm *connMock) Read(b []byte) (n int, err error) {
+	if cm.readFunc != nil {
+		return cm.readFunc(b)
+	}
+	return 0, nil
+}
+
+func (cm *connMock) Write(b []byte) (n int, err error) {
+	if cm.writeFunc != nil {
+		return cm.writeFunc(b)
+	}
+	return len(b), nil
+}
+
+func (cm *connMock) Close() error { return nil }
+
+func (cm *connMock) LocalAddr() net.Addr { return &net.TCPAddr{} }
+
+func (cm *connMock) RemoteAddr() net.Addr { return &net.TCPAddr{} }
+
+func (cm *connMock) SetDeadline(_ time.Time) error { return nil }
+
+func (cm *connMock) SetReadDeadline(_ time.Time) error { return nil }
+
+func (cm *connMock) SetWriteDeadline(_ time.Time) error { return nil }
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 056a62a49..cf2bdf2a4 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -66,6 +66,8 @@ func TestNewServiceHealthChecker_durations(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
 			healthChecker := NewServiceHealthChecker(t.Context(), nil, test.config, nil, nil, http.DefaultTransport, nil, "")
 			assert.Equal(t, test.expInterval, healthChecker.interval)
 			assert.Equal(t, test.expTimeout, healthChecker.timeout)
diff --git a/pkg/middlewares/accesslog/field_middleware.go b/pkg/middlewares/accesslog/field_middleware.go
index 4d439bc25..d0e56e920 100644
--- a/pkg/middlewares/accesslog/field_middleware.go
+++ b/pkg/middlewares/accesslog/field_middleware.go
@@ -2,6 +2,7 @@ package accesslog
 
 import (
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/rs/zerolog/log"
@@ -76,3 +77,37 @@ func InitServiceFields(rw http.ResponseWriter, req *http.Request, next http.Hand
 
 	next.ServeHTTP(rw, req)
 }
+
+const separator = " -> "
+
+// ConcatFieldHandler concatenates field values instead of overriding them.
+type ConcatFieldHandler struct {
+	next  http.Handler
+	name  string
+	value string
+}
+
+// NewConcatFieldHandler creates a ConcatField handler that concatenates values.
+func NewConcatFieldHandler(next http.Handler, name, value string) http.Handler {
+	return &ConcatFieldHandler{next: next, name: name, value: value}
+}
+
+func (c *ConcatFieldHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	table := GetLogData(req)
+	if table == nil {
+		c.next.ServeHTTP(rw, req)
+		return
+	}
+
+	// Check if field already exists and concatenate if so
+	if existingValue, exists := table.Core[c.name]; exists && existingValue != nil {
+		if existingStr, ok := existingValue.(string); ok && strings.TrimSpace(existingStr) != "" {
+			table.Core[c.name] = existingStr + separator + c.value
+			c.next.ServeHTTP(rw, req)
+			return
+		}
+	}
+
+	table.Core[c.name] = c.value
+	c.next.ServeHTTP(rw, req)
+}
diff --git a/pkg/middlewares/accesslog/field_middleware_test.go b/pkg/middlewares/accesslog/field_middleware_test.go
new file mode 100644
index 000000000..50a8a3406
--- /dev/null
+++ b/pkg/middlewares/accesslog/field_middleware_test.go
@@ -0,0 +1,96 @@
+package accesslog
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConcatFieldHandler_ServeHTTP(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		existingValue  interface{}
+		newValue       string
+		expectedResult string
+	}{
+		{
+			desc:           "first router - no existing value",
+			existingValue:  nil,
+			newValue:       "router1",
+			expectedResult: "router1",
+		},
+		{
+			desc:           "second router - concatenate with existing string",
+			existingValue:  "router1",
+			newValue:       "router2",
+			expectedResult: "router1 -> router2",
+		},
+		{
+			desc:           "third router - concatenate with existing chain",
+			existingValue:  "router1 -> router2",
+			newValue:       "router3",
+			expectedResult: "router1 -> router2 -> router3",
+		},
+		{
+			desc:           "empty existing value - treat as first",
+			existingValue:  "    ",
+			newValue:       "router1",
+			expectedResult: "router1",
+		},
+		{
+			desc:           "non-string existing value - replace with new value",
+			existingValue:  123,
+			newValue:       "router1",
+			expectedResult: "router1",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			logData := &LogData{
+				Core: CoreLogData{},
+			}
+			if test.existingValue != nil {
+				logData.Core[RouterName] = test.existingValue
+			}
+
+			req := httptest.NewRequest(http.MethodGet, "/test", nil)
+			req = req.WithContext(context.WithValue(req.Context(), DataTableKey, logData))
+
+			handler := NewConcatFieldHandler(nextHandler, RouterName, test.newValue)
+
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+
+			assert.Equal(t, test.expectedResult, logData.Core[RouterName])
+			assert.Equal(t, http.StatusOK, rec.Code)
+		})
+	}
+}
+
+func TestConcatFieldHandler_ServeHTTP_NoLogData(t *testing.T) {
+	nextHandlerCalled := false
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		nextHandlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	handler := NewConcatFieldHandler(nextHandler, RouterName, "router1")
+
+	// Create request without LogData in context.
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	// Verify next handler was called and no panic occurred.
+	assert.True(t, nextHandlerCalled)
+	assert.Equal(t, http.StatusOK, rec.Code)
+}
diff --git a/pkg/middlewares/accesslog/logger_test.go b/pkg/middlewares/accesslog/logger_test.go
index 2da72991e..8062f59eb 100644
--- a/pkg/middlewares/accesslog/logger_test.go
+++ b/pkg/middlewares/accesslog/logger_test.go
@@ -1180,6 +1180,83 @@ func logWriterTestHandlerFunc(rw http.ResponseWriter, r *http.Request) {
 	rw.WriteHeader(testStatus)
 }
 
+func TestConcatFieldHandler_LoggerIntegration(t *testing.T) {
+	logFilePath := filepath.Join(t.TempDir(), "access.log")
+	config := &otypes.AccessLog{FilePath: logFilePath, Format: CommonFormat}
+
+	logger, err := NewHandler(t.Context(), config)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := logger.Close()
+		require.NoError(t, err)
+	})
+
+	req := &http.Request{
+		Header: map[string][]string{
+			"User-Agent": {testUserAgent},
+			"Referer":    {testReferer},
+		},
+		Proto:      testProto,
+		Host:       testHostname,
+		Method:     testMethod,
+		RemoteAddr: fmt.Sprintf("%s:%d", testHostname, testPort),
+		URL: &url.URL{
+			User: url.UserPassword(testUsername, ""),
+			Path: testPath,
+		},
+		Body: io.NopCloser(bytes.NewReader([]byte("testdata"))),
+	}
+
+	chain := alice.New()
+	chain = chain.Append(capture.Wrap)
+
+	// Injection of the observability variables in the request context.
+	chain = chain.Append(func(next http.Handler) (http.Handler, error) {
+		return observability.WithObservabilityHandler(next, observability.Observability{
+			AccessLogsEnabled: true,
+		}), nil
+	})
+
+	chain = chain.Append(logger.AliceConstructor())
+
+	// Simulate multi-layer routing with concatenated router names
+	var handler http.Handler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		logData := GetLogData(r)
+		if logData != nil {
+			logData.Core[ServiceURL] = testServiceName
+			logData.Core[OriginStatus] = testStatus
+			logData.Core[OriginContentSize] = testContentSize
+			logData.Core[RetryAttempts] = testRetryAttempts
+			logData.Core[StartUTC] = testStart.UTC()
+			logData.Core[StartLocal] = testStart.Local()
+		}
+		rw.WriteHeader(testStatus)
+		if _, err := rw.Write([]byte(testContent)); err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+		}
+	})
+
+	// Create chain of ConcatFieldHandlers to simulate multi-layer routing
+	handler = NewConcatFieldHandler(handler, RouterName, "child-router")
+	handler = NewConcatFieldHandler(handler, RouterName, "parent-router")
+	handler = NewConcatFieldHandler(handler, RouterName, "root-router")
+
+	finalHandler, err := chain.Then(handler)
+	require.NoError(t, err)
+
+	recorder := httptest.NewRecorder()
+	finalHandler.ServeHTTP(recorder, req)
+
+	logData, err := os.ReadFile(logFilePath)
+	require.NoError(t, err)
+
+	result, err := ParseAccessLog(string(logData))
+	require.NoError(t, err)
+
+	expectedRouterName := "\"root-router -> parent-router -> child-router\""
+	assert.Equal(t, expectedRouterName, result[RouterName])
+}
+
 func doLoggingWithAbortedStream(t *testing.T, config *otypes.AccessLog) {
 	t.Helper()
 
diff --git a/pkg/middlewares/auth/forward.go b/pkg/middlewares/auth/forward.go
index 4438a486e..dbaddef2c 100644
--- a/pkg/middlewares/auth/forward.go
+++ b/pkg/middlewares/auth/forward.go
@@ -88,6 +88,8 @@ func NewForward(ctx context.Context, next http.Handler, config dynamic.ForwardAu
 
 	if config.MaxBodySize != nil {
 		fa.maxBodySize = *config.MaxBodySize
+	} else if fa.forwardBody {
+		logger.Warn().Msgf("ForwardAuth 'maxBodySize' is not configured with 'forwardBody: true', allowing unlimited request body size which can lead to DoS attacks and memory exhaustion. Please set an appropriate limit.")
 	}
 
 	// Ensure our request client does not follow redirects
@@ -193,7 +195,7 @@ func (fa *forwardAuth) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 
 	forwardResponse, forwardErr := fa.client.Do(forwardReq)
 	if forwardErr != nil {
-		logger.Debug().Err(forwardErr).Msgf("Error calling %s", fa.address)
+		logger.Error().Err(forwardErr).Msgf("Error calling %s", fa.address)
 		observability.SetStatusErrorf(req.Context(), "Error calling %s. Cause: %s", fa.address, forwardErr)
 
 		statusCode := http.StatusInternalServerError
diff --git a/pkg/middlewares/redirect/redirect.go b/pkg/middlewares/redirect/redirect.go
index d8499d1aa..503df4419 100644
--- a/pkg/middlewares/redirect/redirect.go
+++ b/pkg/middlewares/redirect/redirect.go
@@ -18,30 +18,32 @@ const typeName = "Redirect"
 var uriRegexp = regexp.MustCompile(`^(https?):\/\/(\[[\w:.]+\]|[\w\._-]+)?(:\d+)?(.*)$`)
 
 type redirect struct {
-	next        http.Handler
-	regex       *regexp.Regexp
-	replacement string
-	permanent   bool
-	errHandler  utils.ErrorHandler
-	name        string
-	rawURL      func(*http.Request) string
+	next                   http.Handler
+	regex                  *regexp.Regexp
+	replacement            string
+	permanent              bool
+	forcePermanentRedirect bool
+	errHandler             utils.ErrorHandler
+	name                   string
+	rawURL                 func(*http.Request) string
 }
 
 // New creates a Redirect middleware.
-func newRedirect(next http.Handler, regex, replacement string, permanent bool, rawURL func(*http.Request) string, name string) (http.Handler, error) {
+func newRedirect(next http.Handler, regex, replacement string, permanent bool, forcePermanentRedirect bool, rawURL func(*http.Request) string, name string) (http.Handler, error) {
 	re, err := regexp.Compile(regex)
 	if err != nil {
 		return nil, err
 	}
 
 	return &redirect{
-		regex:       re,
-		replacement: replacement,
-		permanent:   permanent,
-		errHandler:  utils.DefaultHandler,
-		next:        next,
-		name:        name,
-		rawURL:      rawURL,
+		regex:                  re,
+		replacement:            replacement,
+		permanent:              permanent,
+		forcePermanentRedirect: forcePermanentRedirect,
+		errHandler:             utils.DefaultHandler,
+		next:                   next,
+		name:                   name,
+		rawURL:                 rawURL,
 	}, nil
 }
 
@@ -69,7 +71,7 @@ func (r *redirect) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	}
 
 	if newURL != oldURL {
-		handler := &moveHandler{location: parsedURL, permanent: r.permanent}
+		handler := &moveHandler{location: parsedURL, permanent: r.permanent, forcePermanentRedirect: r.forcePermanentRedirect}
 		handler.ServeHTTP(rw, req)
 		return
 	}
@@ -82,8 +84,9 @@ func (r *redirect) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 }
 
 type moveHandler struct {
-	location  *url.URL
-	permanent bool
+	location               *url.URL
+	permanent              bool
+	forcePermanentRedirect bool
 }
 
 func (m *moveHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
@@ -100,6 +103,11 @@ func (m *moveHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 			status = http.StatusPermanentRedirect
 		}
 	}
+
+	if m.forcePermanentRedirect {
+		status = http.StatusPermanentRedirect
+	}
+
 	rw.WriteHeader(status)
 	_, err := rw.Write([]byte(http.StatusText(status)))
 	if err != nil {
diff --git a/pkg/middlewares/redirect/redirect_regex.go b/pkg/middlewares/redirect/redirect_regex.go
index f68493205..5846d5c0d 100644
--- a/pkg/middlewares/redirect/redirect_regex.go
+++ b/pkg/middlewares/redirect/redirect_regex.go
@@ -17,7 +17,7 @@ func NewRedirectRegex(ctx context.Context, next http.Handler, conf dynamic.Redir
 	logger.Debug().Msg("Creating middleware")
 	logger.Debug().Msgf("Setting up redirection from %s to %s", conf.Regex, conf.Replacement)
 
-	return newRedirect(next, conf.Regex, conf.Replacement, conf.Permanent, rawURL, name)
+	return newRedirect(next, conf.Regex, conf.Replacement, conf.Permanent, false, rawURL, name)
 }
 
 func rawURL(req *http.Request) string {
diff --git a/pkg/middlewares/redirect/redirect_scheme.go b/pkg/middlewares/redirect/redirect_scheme.go
index b0d8146c7..b1b1e3c3c 100644
--- a/pkg/middlewares/redirect/redirect_scheme.go
+++ b/pkg/middlewares/redirect/redirect_scheme.go
@@ -40,7 +40,7 @@ func NewRedirectScheme(ctx context.Context, next http.Handler, conf dynamic.Redi
 
 	rs := &redirectScheme{name: name}
 
-	handler, err := newRedirect(next, uriPattern, conf.Scheme+"://${2}"+port+"${4}", conf.Permanent, rs.clientRequestURL, name)
+	handler, err := newRedirect(next, uriPattern, conf.Scheme+"://${2}"+port+"${4}", conf.Permanent, conf.ForcePermanentRedirect, rs.clientRequestURL, name)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/middlewares/redirect/redirect_scheme_test.go b/pkg/middlewares/redirect/redirect_scheme_test.go
index aa90bddbc..1e45f5bc7 100644
--- a/pkg/middlewares/redirect/redirect_scheme_test.go
+++ b/pkg/middlewares/redirect/redirect_scheme_test.go
@@ -165,6 +165,27 @@ func TestRedirectSchemeHandler(t *testing.T) {
 			expectedURL:    "https://foo:8443",
 			expectedStatus: http.StatusMovedPermanently,
 		},
+		{
+			desc: "HTTP to HTTPS with explicit 308 status code",
+			config: dynamic.RedirectScheme{
+				Scheme:                 "https",
+				ForcePermanentRedirect: true,
+			},
+			url:            "http://foo",
+			expectedURL:    "https://foo",
+			expectedStatus: http.StatusPermanentRedirect,
+		},
+		{
+			desc:   "HTTP to HTTPS with explicit 308 status code for GET request",
+			method: http.MethodGet,
+			config: dynamic.RedirectScheme{
+				Scheme:                 "https",
+				ForcePermanentRedirect: true,
+			},
+			url:            "http://foo",
+			expectedURL:    "https://foo",
+			expectedStatus: http.StatusPermanentRedirect,
+		},
 		{
 			desc: "to HTTP 80",
 			config: dynamic.RedirectScheme{
diff --git a/pkg/plugins/fixtures/src/testpluginsafe/go.mod b/pkg/plugins/fixtures/src/testpluginsafe/go.mod
new file mode 100644
index 000000000..ffc61e1ba
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginsafe/go.mod
@@ -0,0 +1,3 @@
+module testpluginsafe
+
+go 1.23.0
diff --git a/pkg/plugins/fixtures/src/testpluginsafe/testpluginsafe.go b/pkg/plugins/fixtures/src/testpluginsafe/testpluginsafe.go
new file mode 100644
index 000000000..d9ca33cde
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginsafe/testpluginsafe.go
@@ -0,0 +1,21 @@
+package testpluginsafe
+
+import (
+	"context"
+	"net/http"
+)
+
+type Config struct {
+	Message string
+}
+
+func CreateConfig() *Config {
+	return &Config{Message: "safe plugin"}
+}
+
+func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("X-Test-Plugin", "safe")
+		next.ServeHTTP(rw, req)
+	}), nil
+}
diff --git a/pkg/plugins/fixtures/src/testpluginsyscall/go.mod b/pkg/plugins/fixtures/src/testpluginsyscall/go.mod
new file mode 100644
index 000000000..871d361b1
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginsyscall/go.mod
@@ -0,0 +1,3 @@
+module testpluginsyscall
+
+go 1.23.0 
\ No newline at end of file
diff --git a/pkg/plugins/fixtures/src/testpluginsyscall/testpluginsyscall.go b/pkg/plugins/fixtures/src/testpluginsyscall/testpluginsyscall.go
new file mode 100644
index 000000000..41272fb27
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginsyscall/testpluginsyscall.go
@@ -0,0 +1,29 @@
+package testpluginsyscall
+
+import (
+	"context"
+	"net/http"
+	"syscall"
+	"unsafe"
+)
+
+type Config struct {
+	Message string
+}
+
+func CreateConfig() *Config {
+	return &Config{Message: "syscall plugin"}
+}
+
+func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+	// Use syscall and unsafe to test they're available
+	pid := syscall.Getpid()
+	size := unsafe.Sizeof(int(0))
+
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("X-Test-Plugin", "syscall")
+		rw.Header().Set("X-Test-PID", string(rune(pid)))
+		rw.Header().Set("X-Test-Size", string(rune(size)))
+		next.ServeHTTP(rw, req)
+	}), nil
+}
diff --git a/pkg/plugins/fixtures/src/testpluginunsafe/go.mod b/pkg/plugins/fixtures/src/testpluginunsafe/go.mod
new file mode 100644
index 000000000..ef0bee089
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginunsafe/go.mod
@@ -0,0 +1,3 @@
+module testpluginunsafe
+
+go 1.23.0 
\ No newline at end of file
diff --git a/pkg/plugins/fixtures/src/testpluginunsafe/testpluginunsafe.go b/pkg/plugins/fixtures/src/testpluginunsafe/testpluginunsafe.go
new file mode 100644
index 000000000..1a58901dd
--- /dev/null
+++ b/pkg/plugins/fixtures/src/testpluginunsafe/testpluginunsafe.go
@@ -0,0 +1,26 @@
+package testpluginunsafe
+
+import (
+	"context"
+	"net/http"
+	"unsafe"
+)
+
+type Config struct {
+	Message string
+}
+
+func CreateConfig() *Config {
+	return &Config{Message: "unsafe only plugin"}
+}
+
+func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+	// Use ONLY unsafe to test it's available
+	size := unsafe.Sizeof(int(0))
+
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("X-Test-Plugin", "unsafe-only")
+		rw.Header().Set("X-Test-Unsafe-Size", string(rune(size)))
+		next.ServeHTTP(rw, req)
+	}), nil
+}
diff --git a/pkg/plugins/middlewareyaegi.go b/pkg/plugins/middlewareyaegi.go
index 590938044..41d120158 100644
--- a/pkg/plugins/middlewareyaegi.go
+++ b/pkg/plugins/middlewareyaegi.go
@@ -16,6 +16,7 @@ import (
 	"github.com/traefik/traefik/v3/pkg/observability/logs"
 	"github.com/traefik/yaegi/interp"
 	"github.com/traefik/yaegi/stdlib"
+	"github.com/traefik/yaegi/stdlib/syscall"
 	"github.com/traefik/yaegi/stdlib/unsafe"
 )
 
@@ -135,7 +136,7 @@ func newInterpreter(ctx context.Context, goPath string, manifest *Manifest, sett
 	}
 
 	if manifest.UseUnsafe && !settings.UseUnsafe {
-		return nil, errors.New("this plugin uses unsafe import. If you want to use it, you need to allow useUnsafe in the settings")
+		return nil, errors.New("this plugin uses restricted imports. If you want to use it, you need to allow useUnsafe in the settings")
 	}
 
 	if settings.UseUnsafe && manifest.UseUnsafe {
@@ -143,6 +144,11 @@ func newInterpreter(ctx context.Context, goPath string, manifest *Manifest, sett
 		if err != nil {
 			return nil, fmt.Errorf("failed to load unsafe symbols: %w", err)
 		}
+
+		err = i.Use(syscall.Symbols)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load syscall symbols: %w", err)
+		}
 	}
 
 	err = i.Use(ppSymbols())
diff --git a/pkg/plugins/middlewareyaegi_test.go b/pkg/plugins/middlewareyaegi_test.go
new file mode 100644
index 000000000..f9df8232d
--- /dev/null
+++ b/pkg/plugins/middlewareyaegi_test.go
@@ -0,0 +1,148 @@
+package plugins
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/traefik/yaegi/interp"
+)
+
+// TestNewInterpreter_SyscallErrorCase - Tests the security gate logic
+func TestNewInterpreter_SyscallErrorCase(t *testing.T) {
+	manifest := &Manifest{
+		Import:    "does-not-matter-will-error-before-import",
+		UseUnsafe: true, // Plugin wants unsafe access
+	}
+	settings := Settings{
+		UseUnsafe: false, // But admin doesn't allow it
+	}
+
+	ctx := t.Context()
+	_, err := newInterpreter(ctx, "/tmp", manifest, settings)
+
+	// This proves our security gate logic works
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "restricted imports", "Our error message should be returned")
+}
+
+// TestNewYaegiMiddlewareBuilder_WithSyscallSupport - Tests the ACTUAL production code!
+func TestNewYaegiMiddlewareBuilder_WithSyscallSupport(t *testing.T) {
+	tests := []struct {
+		name           string
+		pluginType     string
+		manifestUnsafe bool
+		settingsUnsafe bool
+		shouldSucceed  bool
+		expectedError  string
+	}{
+		{
+			name:           "Should work with safe plugin when useUnsafe disabled",
+			pluginType:     "safe",
+			manifestUnsafe: false,
+			settingsUnsafe: false,
+			shouldSucceed:  true,
+		},
+		{
+			name:           "Should work with unsafe-only plugin when useUnsafe enabled",
+			pluginType:     "unsafe-only",
+			manifestUnsafe: true,
+			settingsUnsafe: true,
+			shouldSucceed:  true,
+		},
+		{
+			name:           "Should work with unsafe+syscall plugin when useUnsafe enabled",
+			pluginType:     "unsafe+syscall",
+			manifestUnsafe: true,
+			settingsUnsafe: true,
+			shouldSucceed:  true,
+		},
+		{
+			name:           "Should fail when plugin needs unsafe but setting disabled",
+			pluginType:     "unsafe-only",
+			manifestUnsafe: true,
+			settingsUnsafe: false,
+			shouldSucceed:  false,
+			expectedError:  "restricted imports",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			// Set GOPATH to include our fixtures directory
+			goPath := "fixtures"
+
+			// Create interpreter using our ACTUAL newInterpreter function
+			// This will automatically import the real test plugin!
+			interpreter, err := createInterpreterForTesting(ctx, goPath, tc.pluginType, tc.manifestUnsafe, tc.settingsUnsafe)
+
+			if tc.shouldSucceed {
+				require.NoError(t, err)
+				require.NotNil(t, interpreter)
+
+				// Test actual middleware building using newYaegiMiddlewareBuilder
+				// The plugin is already loaded by newInterpreter!
+				basePkg := getPluginPackage(tc.pluginType)
+
+				builder, err := newYaegiMiddlewareBuilder(interpreter, basePkg, basePkg)
+				require.NoError(t, err)
+				require.NotNil(t, builder)
+
+				// Verify that unsafe/syscall functions actually work if the plugin uses them
+				if tc.pluginType != "safe" {
+					verifyMiddlewareWorks(t, builder)
+				}
+			} else {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tc.expectedError)
+			}
+		})
+	}
+}
+
+// Helper that uses the ACTUAL newInterpreter function with real test plugins
+func createInterpreterForTesting(ctx context.Context, goPath, pluginType string, manifestUnsafe, settingsUnsafe bool) (*interp.Interpreter, error) {
+	pluginImport := getPluginPackage(pluginType)
+
+	manifest := &Manifest{
+		Import:    pluginImport,
+		UseUnsafe: manifestUnsafe,
+	}
+	settings := Settings{
+		UseUnsafe: settingsUnsafe,
+	}
+
+	// Call the ACTUAL production newInterpreter function - no workarounds needed!
+	return newInterpreter(ctx, goPath, manifest, settings)
+}
+
+// Helper to get the correct plugin package name based on type
+func getPluginPackage(pluginType string) string {
+	switch pluginType {
+	case "safe":
+		return "testpluginsafe"
+	case "unsafe-only":
+		return "testpluginunsafe"
+	case "unsafe+syscall":
+		return "testpluginsyscall"
+	default:
+		return "testpluginsafe"
+	}
+}
+
+// Helper to verify that unsafe/syscall functions actually work by invoking the middleware
+func verifyMiddlewareWorks(t *testing.T, builder *yaegiMiddlewareBuilder) {
+	t.Helper()
+	// Create a middleware instance - this will call the plugin's New() function
+	// which uses unsafe/syscall, proving they work
+	middleware, err := builder.newMiddleware(map[string]interface{}{
+		"message": "test",
+	}, "test-middleware")
+	require.NoError(t, err, "Should be able to create middleware that uses unsafe/syscall")
+	require.NotNil(t, middleware, "Middleware should not be nil")
+
+	// The fact that we got here without crashing proves unsafe/syscall work!
+}
diff --git a/pkg/plugins/plugins.go b/pkg/plugins/plugins.go
index f7d543154..8157a04c7 100644
--- a/pkg/plugins/plugins.go
+++ b/pkg/plugins/plugins.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/rs/zerolog/log"
+	"golang.org/x/mod/module"
 )
 
 const localGoPath = "./plugins-local/"
@@ -53,24 +54,18 @@ func checkRemotePluginsConfiguration(plugins map[string]Descriptor) error {
 
 	var errs []string
 	for pAlias, descriptor := range plugins {
-		if descriptor.ModuleName == "" {
-			errs = append(errs, fmt.Sprintf("%s: plugin name is missing", pAlias))
+		if err := module.CheckPath(descriptor.ModuleName); err != nil {
+			errs = append(errs, fmt.Sprintf("%s: malformed plugin module name is missing: %s", pAlias, err))
 		}
 
 		if descriptor.Version == "" {
 			errs = append(errs, fmt.Sprintf("%s: plugin version is missing", pAlias))
 		}
 
-		if strings.HasPrefix(descriptor.ModuleName, "/") || strings.HasSuffix(descriptor.ModuleName, "/") {
-			errs = append(errs, fmt.Sprintf("%s: plugin name should not start or end with a /", pAlias))
-			continue
-		}
-
 		if _, ok := uniq[descriptor.ModuleName]; ok {
 			errs = append(errs, fmt.Sprintf("only one version of a plugin is allowed, there is a duplicate of %s", descriptor.ModuleName))
 			continue
 		}
-
 		uniq[descriptor.ModuleName] = struct{}{}
 	}
 
diff --git a/pkg/plugins/plugins_test.go b/pkg/plugins/plugins_test.go
new file mode 100644
index 000000000..0fff67915
--- /dev/null
+++ b/pkg/plugins/plugins_test.go
@@ -0,0 +1,85 @@
+package plugins
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_checkRemotePluginsConfiguration(t *testing.T) {
+	testCases := []struct {
+		name    string
+		plugins map[string]Descriptor
+		wantErr bool
+	}{
+		{
+			name:    "nil plugins configuration returns no error",
+			plugins: nil,
+			wantErr: false,
+		},
+		{
+			name: "malformed module name returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "invalid/module/name", Version: "v1.0.0"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "malformed module name with path traversal returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "github.com/module/../name", Version: "v1.0.0"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "malformed module name with encoded path traversal returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "github.com/module%2F%2E%2E%2Fname", Version: "v1.0.0"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "malformed module name returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "invalid/module/name", Version: "v1.0.0"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing plugin version returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "github.com/module/name", Version: ""},
+			},
+			wantErr: true,
+		},
+		{
+			name: "duplicate plugin module name returns error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "github.com/module/name", Version: "v1.0.0"},
+				"plugin2": {ModuleName: "github.com/module/name", Version: "v1.1.0"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "valid plugins configuration returns no error",
+			plugins: map[string]Descriptor{
+				"plugin1": {ModuleName: "github.com/module/name1", Version: "v1.0.0"},
+				"plugin2": {ModuleName: "github.com/module/name2", Version: "v1.1.0"},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := checkRemotePluginsConfiguration(test.plugins)
+			if test.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/pkg/plugins/types.go b/pkg/plugins/types.go
index 75bb589b3..aa05cc320 100644
--- a/pkg/plugins/types.go
+++ b/pkg/plugins/types.go
@@ -13,7 +13,7 @@ const (
 type Settings struct {
 	Envs      []string `description:"Environment variables to forward to the wasm guest." json:"envs,omitempty" toml:"envs,omitempty" yaml:"envs,omitempty"`
 	Mounts    []string `description:"Directory to mount to the wasm guest." json:"mounts,omitempty" toml:"mounts,omitempty" yaml:"mounts,omitempty"`
-	UseUnsafe bool     `description:"Allow the plugin to use unsafe package." json:"useUnsafe,omitempty" toml:"useUnsafe,omitempty" yaml:"useUnsafe,omitempty"`
+	UseUnsafe bool     `description:"Allow the plugin to use unsafe and syscall packages." json:"useUnsafe,omitempty" toml:"useUnsafe,omitempty" yaml:"useUnsafe,omitempty"`
 }
 
 // Descriptor The static part of a plugin configuration.
diff --git a/pkg/provider/acme/provider.go b/pkg/provider/acme/provider.go
index c818ac7d2..f8ab4ca1f 100644
--- a/pkg/provider/acme/provider.go
+++ b/pkg/provider/acme/provider.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/challenge/http01"
+	"github.com/go-acme/lego/v4/challenge/tlsalpn01"
 	"github.com/go-acme/lego/v4/lego"
 	"github.com/go-acme/lego/v4/providers/dns"
 	"github.com/go-acme/lego/v4/registration"
@@ -46,6 +47,7 @@ type Configuration struct {
 	PreferredChain       string   `description:"Preferred chain to use." json:"preferredChain,omitempty" toml:"preferredChain,omitempty" yaml:"preferredChain,omitempty" export:"true"`
 	Profile              string   `description:"Certificate profile to use." json:"profile,omitempty" toml:"profile,omitempty" yaml:"profile,omitempty" export:"true"`
 	EmailAddresses       []string `description:"CSR email addresses to use." json:"emailAddresses,omitempty" toml:"emailAddresses,omitempty" yaml:"emailAddresses,omitempty"`
+	DisableCommonName    bool     `description:"Disable the common name in the CSR." json:"disableCommonName,omitempty" toml:"disableCommonName,omitempty" yaml:"disableCommonName,omitempty" export:"true"`
 	Storage              string   `description:"Storage to use." json:"storage,omitempty" toml:"storage,omitempty" yaml:"storage,omitempty" export:"true"`
 	KeyType              string   `description:"KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'." json:"keyType,omitempty" toml:"keyType,omitempty" yaml:"keyType,omitempty" export:"true"`
 	EAB                  *EAB     `description:"External Account Binding to use." json:"eab,omitempty" toml:"eab,omitempty" yaml:"eab,omitempty"`
@@ -118,7 +120,9 @@ type HTTPChallenge struct {
 }
 
 // TLSChallenge contains TLS challenge configuration.
-type TLSChallenge struct{}
+type TLSChallenge struct {
+	Delay ptypes.Duration `description:"Delay between the creation of the challenge and the validation." json:"delay,omitempty" toml:"delay,omitempty" yaml:"delay,omitempty" export:"true"`
+}
 
 // Provider holds configurations of the provider.
 type Provider struct {
@@ -293,6 +297,7 @@ func (p *Provider) getClient() (*lego.Client, error) {
 	config.CADirURL = caServer
 	config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
 	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
+	config.Certificate.DisableCommonName = p.DisableCommonName
 
 	config.HTTPClient, err = p.createHTTPClient()
 	if err != nil {
@@ -372,7 +377,7 @@ func (p *Provider) getClient() (*lego.Client, error) {
 	if p.TLSChallenge != nil {
 		logger.Debug().Msg("Using TLS Challenge provider.")
 
-		err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider)
+		err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider, tlsalpn01.SetDelay(time.Duration(p.TLSChallenge.Delay)))
 		if err != nil {
 			return nil, err
 		}
@@ -916,11 +921,11 @@ func (p *Provider) renewCertificates(ctx context.Context, renewPeriod time.Durat
 	for _, cert := range certificates {
 		client, err := p.getClient()
 		if err != nil {
-			logger.Info().Err(err).Msgf("Error renewing certificate from LE : %+v", cert.Domain)
+			logger.Info().Err(err).Msgf("Error renewing ACME certificate: %+v", cert.Domain)
 			continue
 		}
 
-		logger.Info().Msgf("Renewing certificate from LE : %+v", cert.Domain)
+		logger.Info().Msgf("Renewing ACME certificate: %+v", cert.Domain)
 
 		res := certificate.Resource{
 			Domain:      cert.Domain.Main,
@@ -930,12 +935,14 @@ func (p *Provider) renewCertificates(ctx context.Context, renewPeriod time.Durat
 
 		opts := &certificate.RenewOptions{
 			Bundle:         true,
+			EmailAddresses: p.EmailAddresses,
+			Profile:        p.Profile,
 			PreferredChain: p.PreferredChain,
 		}
 
 		renewedCert, err := client.Certificate.RenewWithOptions(res, opts)
 		if err != nil {
-			logger.Error().Err(err).Msgf("Error renewing certificate from LE: %v", cert.Domain)
+			logger.Error().Err(err).Msgf("Error renewing ACME certificate: %v", cert.Domain)
 			continue
 		}
 
diff --git a/pkg/provider/aggregator/aggregator.go b/pkg/provider/aggregator/aggregator.go
index fb2b1a6dc..95bb0b220 100644
--- a/pkg/provider/aggregator/aggregator.go
+++ b/pkg/provider/aggregator/aggregator.go
@@ -2,6 +2,7 @@ package aggregator
 
 import (
 	"context"
+	"fmt"
 	"time"
 
 	"github.com/rs/zerolog/log"
@@ -100,6 +101,10 @@ func NewProviderAggregator(conf static.Providers) *ProviderAggregator {
 		p.quietAddProvider(conf.KubernetesCRD)
 	}
 
+	if conf.Knative != nil {
+		p.quietAddProvider(conf.Knative)
+	}
+
 	if conf.KubernetesGateway != nil {
 		p.quietAddProvider(conf.KubernetesGateway)
 	}
@@ -203,8 +208,16 @@ func (p *ProviderAggregator) launchProvider(configurationChan chan<- dynamic.Mes
 		log.Debug().Err(err).Msgf("Cannot marshal the provider configuration %T", prd)
 	}
 
-	log.Info().Msgf("Starting provider %T", prd)
-	log.Debug().RawJSON("config", []byte(jsonConf)).Msgf("%T provider configuration", prd)
+	// Check if provider has namespace information.
+	var namespaceInfo string
+	if namespaceProvider, ok := prd.(provider.NamespacedProvider); ok {
+		if namespace := namespaceProvider.Namespace(); namespace != "" {
+			namespaceInfo = fmt.Sprintf(" (namespace: %s)", namespace)
+		}
+	}
+
+	log.Info().Msgf("Starting provider %T%s", prd, namespaceInfo)
+	log.Debug().RawJSON("config", []byte(jsonConf)).Msgf("%T provider configuration%s", prd, namespaceInfo)
 
 	if err := maybeThrottledProvide(prd, p.providersThrottleDuration)(configurationChan, pool); err != nil {
 		log.Error().Err(err).Msgf("Cannot start the provider %T", prd)
diff --git a/pkg/provider/aggregator/aggregator_test.go b/pkg/provider/aggregator/aggregator_test.go
index 895dc6539..8bb609eb4 100644
--- a/pkg/provider/aggregator/aggregator_test.go
+++ b/pkg/provider/aggregator/aggregator_test.go
@@ -1,9 +1,13 @@
 package aggregator
 
 import (
+	"bytes"
 	"testing"
 	"time"
 
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
 	"github.com/traefik/traefik/v3/pkg/provider"
@@ -40,6 +44,34 @@ func TestProviderAggregator_Provide(t *testing.T) {
 	require.NoError(t, <-errCh)
 }
 
+func TestLaunchNamespacedProvider(t *testing.T) {
+	// Capture log output
+	var buf bytes.Buffer
+
+	originalLogger := log.Logger
+	log.Logger = zerolog.New(&buf).Level(zerolog.InfoLevel)
+
+	providerWithNamespace := &mockNamespacedProvider{namespace: "test-namespace"}
+
+	aggregator := ProviderAggregator{
+		internalProvider: providerWithNamespace,
+	}
+
+	cfgCh := make(chan dynamic.Message)
+	pool := safe.NewPool(t.Context())
+
+	t.Cleanup(func() {
+		pool.Stop()
+		log.Logger = originalLogger
+	})
+
+	err := aggregator.Provide(cfgCh, pool)
+	require.NoError(t, err)
+
+	output := buf.String()
+	assert.Contains(t, output, "Starting provider *aggregator.mockNamespacedProvider (namespace: test-namespace)")
+}
+
 // requireReceivedMessageFromProviders makes sure the given providers have emitted a message on the given message channel.
 // Providers order is not enforced.
 func requireReceivedMessageFromProviders(t *testing.T, cfgCh <-chan dynamic.Message, names []string) {
@@ -76,3 +108,20 @@ func (p *providerMock) Provide(configurationChan chan<- dynamic.Message, pool *s
 
 	return nil
 }
+
+// mockNamespacedProvider is a mock implementation of NamespacedProvider for testing.
+type mockNamespacedProvider struct {
+	namespace string
+}
+
+func (m *mockNamespacedProvider) Namespace() string {
+	return m.namespace
+}
+
+func (m *mockNamespacedProvider) Provide(_ chan<- dynamic.Message, _ *safe.Pool) error {
+	return nil
+}
+
+func (m *mockNamespacedProvider) Init() error {
+	return nil
+}
diff --git a/pkg/provider/consulcatalog/consul_catalog.go b/pkg/provider/consulcatalog/consul_catalog.go
index abdc8648e..ec3fb64da 100644
--- a/pkg/provider/consulcatalog/consul_catalog.go
+++ b/pkg/provider/consulcatalog/consul_catalog.go
@@ -647,3 +647,8 @@ func repeatSend(ctx context.Context, interval time.Duration, c chan<- struct{})
 		}
 	}
 }
+
+// Namespace returns the namespace of the ConsulCatalog provider.
+func (p *Provider) Namespace() string {
+	return p.namespace
+}
diff --git a/pkg/provider/docker/builder_test.go b/pkg/provider/docker/builder_test.go
index c0b4f1d7f..4d001c8ce 100644
--- a/pkg/provider/docker/builder_test.go
+++ b/pkg/provider/docker/builder_test.go
@@ -12,6 +12,7 @@ func containerJSON(ops ...func(*containertypes.InspectResponse)) containertypes.
 		ContainerJSONBase: &containertypes.ContainerJSONBase{
 			Name:       "fake",
 			HostConfig: &containertypes.HostConfig{},
+			State:      &containertypes.State{},
 		},
 		Config: &containertypes.Config{},
 		NetworkSettings: &containertypes.NetworkSettings{
diff --git a/pkg/provider/docker/config.go b/pkg/provider/docker/config.go
index 0b322715a..26238e552 100644
--- a/pkg/provider/docker/config.go
+++ b/pkg/provider/docker/config.go
@@ -138,6 +138,11 @@ func (p *DynConfBuilder) buildTCPServiceConfiguration(ctx context.Context, conta
 		}
 	}
 
+	// Keep an empty server load-balancer for non-running containers.
+	if container.Status != "" && container.Status != containertypes.StateRunning {
+		return nil
+	}
+	// Keep an empty server load-balancer for unhealthy containers.
 	if container.Health != "" && container.Health != containertypes.Healthy {
 		return nil
 	}
@@ -162,6 +167,11 @@ func (p *DynConfBuilder) buildUDPServiceConfiguration(ctx context.Context, conta
 		}
 	}
 
+	// Keep an empty server load-balancer for non-running containers.
+	if container.Status != "" && container.Status != containertypes.StateRunning {
+		return nil
+	}
+	// Keep an empty server load-balancer for unhealthy containers.
 	if container.Health != "" && container.Health != containertypes.Healthy {
 		return nil
 	}
@@ -188,6 +198,11 @@ func (p *DynConfBuilder) buildServiceConfiguration(ctx context.Context, containe
 		}
 	}
 
+	// Keep an empty server load-balancer for non-running containers.
+	if container.Status != "" && container.Status != containertypes.StateRunning {
+		return nil
+	}
+	// Keep an empty server load-balancer for unhealthy containers.
 	if container.Health != "" && container.Health != containertypes.Healthy {
 		return nil
 	}
@@ -220,6 +235,19 @@ func (p *DynConfBuilder) keepContainer(ctx context.Context, container dockerData
 		return false
 	}
 
+	// AllowNonRunning has precedence over AllowEmptyServices.
+	// If AllowNonRunning is true, we don't care about the container health/status,
+	// and we need to quit before checking it.
+	// Only configurable with the Docker provider.
+	if container.ExtraConf.AllowNonRunning {
+		return true
+	}
+
+	if container.Status != "" && container.Status != containertypes.StateRunning {
+		logger.Debug().Msg("Filtering non running container")
+		return false
+	}
+
 	if !p.AllowEmptyServices && container.Health != "" && container.Health != containertypes.Healthy {
 		logger.Debug().Msg("Filtering unhealthy or starting container")
 		return false
diff --git a/pkg/provider/docker/config_test.go b/pkg/provider/docker/config_test.go
index e54b980c3..33b8e390a 100644
--- a/pkg/provider/docker/config_test.go
+++ b/pkg/provider/docker/config_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 	ptypes "github.com/traefik/paerser/types"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/provider"
 	"github.com/traefik/traefik/v3/pkg/tls"
 	"github.com/traefik/traefik/v3/pkg/types"
 )
@@ -3935,6 +3936,464 @@ func TestDynConfBuilder_build(t *testing.T) {
 	}
 }
 
+func TestDynConfBuilder_build_allowNonRunning(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		containers []dockerData
+		expected   *dynamic.Configuration
+	}{
+		{
+			desc: "exited container with allowNonRunning=true should create router and service without servers",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "exited",
+					Health:      "",
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"Test": {
+							Service:     "Test",
+							Rule:        "Host(`Test`)",
+							DefaultRule: true,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"Test": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								PassHostHeader: pointer(true),
+								Strategy:       "wrr",
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "exited container with allowNonRunning=false should not create anything",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "exited",
+					Health:      "",
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: false,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers:           map[string]*dynamic.Router{},
+					Middlewares:       map[string]*dynamic.Middleware{},
+					Services:          map[string]*dynamic.Service{},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "running container with allowNonRunning=true should work normally with servers",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "running",
+					Health:      "",
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"Test": {
+							Service:     "Test",
+							Rule:        "Host(`Test`)",
+							DefaultRule: true,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"Test": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Servers: []dynamic.Server{
+									{
+										URL: "http://127.0.0.1:80",
+									},
+								},
+								PassHostHeader: pointer(true),
+								Strategy:       "wrr",
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "created container with allowNonRunning=true should create router and service without servers)",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "created",
+					Health:      "",
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"Test": {
+							Service:     "Test",
+							Rule:        "Host(`Test`)",
+							DefaultRule: true,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"Test": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								PassHostHeader: pointer(true),
+								Strategy:       "wrr",
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "dead container with allowNonRunning=true should create router and service without servers)",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "dead",
+					Health:      "",
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"Test": {
+							Service:     "Test",
+							Rule:        "Host(`Test`)",
+							DefaultRule: true,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"Test": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								PassHostHeader: pointer(true),
+								Strategy:       "wrr",
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "exited container with TCP configuration and allowNonRunning=true should create TCP service without servers",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "exited",
+					Health:      "",
+					Labels: map[string]string{
+						"traefik.tcp.routers.Test.rule": "HostSNI(`test.localhost`)",
+					},
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/tcp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers: map[string]*dynamic.TCPRouter{
+						"Test": {
+							Service: "Test",
+							Rule:    "HostSNI(`test.localhost`)",
+						},
+					},
+					Middlewares: map[string]*dynamic.TCPMiddleware{},
+					Services: map[string]*dynamic.TCPService{
+						"Test": {
+							LoadBalancer: &dynamic.TCPServersLoadBalancer{},
+						},
+					},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers:           map[string]*dynamic.Router{},
+					Middlewares:       map[string]*dynamic.Middleware{},
+					Services:          map[string]*dynamic.Service{},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+		{
+			desc: "exited container with UDP configuration and allowNonRunning=true should create UDP service without servers",
+			containers: []dockerData{
+				{
+					ServiceName: "Test",
+					Name:        "Test",
+					Status:      "exited",
+					Health:      "",
+					Labels: map[string]string{
+						"traefik.udp.routers.Test.entrypoints": "udp",
+					},
+					ExtraConf: configuration{
+						Enable:          true,
+						AllowNonRunning: true,
+					},
+					NetworkSettings: networkSettings{
+						NetworkMode: "bridge",
+						Ports: nat.PortMap{
+							"80/udp": []nat.PortBinding{},
+						},
+						Networks: map[string]*networkData{
+							"bridge": {
+								Name: "bridge",
+								Addr: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				UDP: &dynamic.UDPConfiguration{
+					Routers: map[string]*dynamic.UDPRouter{
+						"Test": {
+							Service:     "Test",
+							EntryPoints: []string{"udp"},
+						},
+					},
+					Services: map[string]*dynamic.UDPService{
+						"Test": {
+							LoadBalancer: &dynamic.UDPServersLoadBalancer{},
+						},
+					},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers:           map[string]*dynamic.Router{},
+					Middlewares:       map[string]*dynamic.Middleware{},
+					Services:          map[string]*dynamic.Service{},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Stores: map[string]tls.Store{},
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			defaultRuleTpl, err := provider.MakeDefaultRuleTemplate(DefaultTemplateRule, nil)
+			require.NoError(t, err)
+
+			p := Shared{
+				ExposedByDefault: true,
+				DefaultRule:      DefaultTemplateRule,
+				defaultRuleTpl:   defaultRuleTpl,
+			}
+
+			builder := NewDynConfBuilder(p, nil, false)
+			configuration := builder.build(t.Context(), test.containers)
+
+			assert.Equal(t, test.expected, configuration)
+		})
+	}
+}
+
 func TestDynConfBuilder_getIPPort_docker(t *testing.T) {
 	type expected struct {
 		ip    string
diff --git a/pkg/provider/docker/data.go b/pkg/provider/docker/data.go
index 4c42d396e..22dde04e7 100644
--- a/pkg/provider/docker/data.go
+++ b/pkg/provider/docker/data.go
@@ -10,6 +10,7 @@ type dockerData struct {
 	ID              string
 	ServiceName     string
 	Name            string
+	Status          string
 	Labels          map[string]string // List of labels set to container or service
 	NetworkSettings networkSettings
 	Health          string
diff --git a/pkg/provider/docker/pdocker.go b/pkg/provider/docker/pdocker.go
index 5e88be51b..dbd609f9f 100644
--- a/pkg/provider/docker/pdocker.go
+++ b/pkg/provider/docker/pdocker.go
@@ -21,9 +21,6 @@ import (
 	"github.com/traefik/traefik/v3/pkg/safe"
 )
 
-// DockerAPIVersion is a constant holding the version of the Provider API traefik will use.
-const DockerAPIVersion = "1.24"
-
 const dockerName = "docker"
 
 var _ provider.Provider = (*Provider)(nil)
@@ -61,7 +58,6 @@ func (p *Provider) Init() error {
 }
 
 func (p *Provider) createClient(ctx context.Context) (*client.Client, error) {
-	p.ClientConfig.apiVersion = DockerAPIVersion
 	return createClient(ctx, p.ClientConfig)
 }
 
@@ -172,7 +168,9 @@ func (p *Provider) Provide(configurationChan chan<- dynamic.Message, pool *safe.
 }
 
 func (p *Provider) listContainers(ctx context.Context, dockerClient client.ContainerAPIClient) ([]dockerData, error) {
-	containerList, err := dockerClient.ContainerList(ctx, container.ListOptions{})
+	containerList, err := dockerClient.ContainerList(ctx, container.ListOptions{
+		All: true,
+	})
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/provider/docker/pswarm.go b/pkg/provider/docker/pswarm.go
index bcb7ded48..f596b9e67 100644
--- a/pkg/provider/docker/pswarm.go
+++ b/pkg/provider/docker/pswarm.go
@@ -22,9 +22,6 @@ import (
 	"github.com/traefik/traefik/v3/pkg/safe"
 )
 
-// SwarmAPIVersion is a constant holding the version of the Provider API traefik will use.
-const SwarmAPIVersion = "1.24"
-
 const swarmName = "swarm"
 
 var _ provider.Provider = (*SwarmProvider)(nil)
@@ -58,7 +55,6 @@ func (p *SwarmProvider) Init() error {
 }
 
 func (p *SwarmProvider) createClient(ctx context.Context) (*client.Client, error) {
-	p.ClientConfig.apiVersion = SwarmAPIVersion
 	return createClient(ctx, p.ClientConfig)
 }
 
diff --git a/pkg/provider/docker/shared.go b/pkg/provider/docker/shared.go
index 931c61905..bd3c06269 100644
--- a/pkg/provider/docker/shared.go
+++ b/pkg/provider/docker/shared.go
@@ -53,9 +53,9 @@ func inspectContainers(ctx context.Context, dockerClient client.ContainerAPIClie
 		return dockerData{}
 	}
 
-	// This condition is here to avoid to have empty IP https://github.com/traefik/traefik/issues/2459
-	// We register only container which are running
-	if containerInspected.ContainerJSONBase != nil && containerInspected.ContainerJSONBase.State != nil && containerInspected.ContainerJSONBase.State.Running {
+	// Always parse all containers (running and stopped)
+	// The allowNonRunning filtering will be applied later in service configuration
+	if containerInspected.ContainerJSONBase != nil && containerInspected.ContainerJSONBase.State != nil {
 		return parseContainer(containerInspected)
 	}
 
@@ -71,6 +71,7 @@ func parseContainer(container containertypes.InspectResponse) dockerData {
 		dData.ID = container.ContainerJSONBase.ID
 		dData.Name = container.ContainerJSONBase.Name
 		dData.ServiceName = dData.Name // Default ServiceName to be the container's Name.
+		dData.Status = container.ContainerJSONBase.State.Status
 
 		if container.ContainerJSONBase.HostConfig != nil {
 			dData.NetworkSettings.NetworkMode = container.ContainerJSONBase.HostConfig.NetworkMode
@@ -109,8 +110,6 @@ func parseContainer(container containertypes.InspectResponse) dockerData {
 }
 
 type ClientConfig struct {
-	apiVersion string
-
 	Username          string           `description:"Username for Basic HTTP authentication." json:"username,omitempty" toml:"username,omitempty" yaml:"username,omitempty"`
 	Password          string           `description:"Password for Basic HTTP authentication." json:"password,omitempty" toml:"password,omitempty" yaml:"password,omitempty"`
 	Endpoint          string           `description:"Docker server endpoint. Can be a TCP or a Unix socket endpoint." json:"endpoint,omitempty" toml:"endpoint,omitempty" yaml:"endpoint,omitempty"`
@@ -132,8 +131,9 @@ func createClient(ctx context.Context, cfg ClientConfig) (*client.Client, error)
 	}
 
 	opts = append(opts,
-		client.WithHTTPHeaders(httpHeaders),
-		client.WithVersion(cfg.apiVersion))
+		client.FromEnv,
+		client.WithAPIVersionNegotiation(),
+		client.WithHTTPHeaders(httpHeaders))
 
 	return client.NewClientWithOpts(opts...)
 }
diff --git a/pkg/provider/docker/shared_labels.go b/pkg/provider/docker/shared_labels.go
index 6eab7143d..7d3bed8c1 100644
--- a/pkg/provider/docker/shared_labels.go
+++ b/pkg/provider/docker/shared_labels.go
@@ -16,17 +16,24 @@ const (
 // configuration contains information from the labels that are globals (not related to the dynamic configuration)
 // or specific to the provider.
 type configuration struct {
-	Enable  bool
-	Network string
-	LBSwarm bool
+	Enable          bool
+	Network         string
+	LBSwarm         bool
+	AllowNonRunning bool
 }
 
 type labelConfiguration struct {
 	Enable bool
-	Docker *specificConfiguration
+	Docker *dockerSpecificConfiguration
 	Swarm  *specificConfiguration
 }
 
+type dockerSpecificConfiguration struct {
+	Network         *string
+	LBSwarm         bool
+	AllowNonRunning bool
+}
+
 type specificConfiguration struct {
 	Network *string
 	LBSwarm bool
@@ -43,9 +50,15 @@ func (p *Shared) extractDockerLabels(container dockerData) (configuration, error
 		network = *conf.Docker.Network
 	}
 
+	var allowNonRunning bool
+	if conf.Docker != nil {
+		allowNonRunning = conf.Docker.AllowNonRunning
+	}
+
 	return configuration{
-		Enable:  conf.Enable,
-		Network: network,
+		Enable:          conf.Enable,
+		Network:         network,
+		AllowNonRunning: allowNonRunning,
 	}, nil
 }
 
diff --git a/pkg/provider/ecs/ecs.go b/pkg/provider/ecs/ecs.go
index 084b9b9ca..1204387d7 100644
--- a/pkg/provider/ecs/ecs.go
+++ b/pkg/provider/ecs/ecs.go
@@ -317,8 +317,14 @@ func (p *Provider) listInstances(ctx context.Context, client *awsClient) ([]ecsI
 							protocol:      mapping.Protocol,
 						})
 					}
+
+					privateIP := aws.ToString(container.NetworkInterfaces[0].PrivateIpv4Address)
+					if privateIP == "" {
+						privateIP = aws.ToString(container.NetworkInterfaces[0].Ipv6Address)
+					}
+
 					mach = &machine{
-						privateIP:    aws.ToString(container.NetworkInterfaces[0].PrivateIpv4Address),
+						privateIP:    privateIP,
 						ports:        ports,
 						state:        ec2types.InstanceStateName(strings.ToLower(aws.ToString(task.LastStatus))),
 						healthStatus: task.HealthStatus,
diff --git a/pkg/provider/kubernetes/crd/client_test.go b/pkg/provider/kubernetes/crd/client_test.go
index 5d71b6a78..5d1c9aba7 100644
--- a/pkg/provider/kubernetes/crd/client_test.go
+++ b/pkg/provider/kubernetes/crd/client_test.go
@@ -29,8 +29,8 @@ func TestClientIgnoresHelmOwnedSecrets(t *testing.T) {
 		},
 	}
 
-	kubeClient := kubefake.NewSimpleClientset(helmSecret, secret)
-	crdClient := traefikcrdfake.NewSimpleClientset()
+	kubeClient := kubefake.NewClientset(helmSecret, secret)
+	crdClient := traefikcrdfake.NewClientset()
 
 	client := newClientImpl(kubeClient, crdClient)
 
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_allowed.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_allowed.yml
new file mode 100644
index 000000000..9d25cf43c
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_allowed.yml
@@ -0,0 +1,28 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-cross
+  namespace: ns-a
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`cross.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-cross-allowed
+  namespace: ns-b
+spec:
+  parentRefs:
+    - name: parent-cross
+      namespace: ns-a
+  routes:
+    - match: Path(`/cross`)
+      kind: Rule
+      services:
+        - name: cross-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_denied.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_denied.yml
new file mode 100644
index 000000000..0ca584e74
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_cross_namespace_denied.yml
@@ -0,0 +1,28 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-cross
+  namespace: ns-a
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`cross.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-cross-denied
+  namespace: ns-b
+spec:
+  parentRefs:
+    - name: parent-cross
+      namespace: ns-a
+  routes:
+    - match: Path(`/denied`)
+      kind: Rule
+      services:
+        - name: cross-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_default_namespace.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_default_namespace.yml
new file mode 100644
index 000000000..aa82b47ca
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_default_namespace.yml
@@ -0,0 +1,27 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-default
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`default.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-same
+  namespace: default
+spec:
+  parentRefs:
+    - name: parent-default
+  routes:
+    - match: Path(`/same`)
+      kind: Rule
+      services:
+        - name: same-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_missing_parent.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_missing_parent.yml
new file mode 100644
index 000000000..c35ac69e8
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_missing_parent.yml
@@ -0,0 +1,16 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-missing-parent
+  namespace: default
+spec:
+  parentRefs:
+    - name: non-existent-parent
+      namespace: default
+  routes:
+    - match: Path(`/missing`)
+      kind: Rule
+      services:
+        - name: child-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_multiple_parents.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_multiple_parents.yml
new file mode 100644
index 000000000..e4f099b0d
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_multiple_parents.yml
@@ -0,0 +1,42 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-a
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`a.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-b
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`b.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-multi-parents
+  namespace: default
+spec:
+  parentRefs:
+    - name: parent-a
+      namespace: default
+    - name: parent-b
+      namespace: default
+  routes:
+    - match: Path(`/shared`)
+      kind: Rule
+      services:
+        - name: shared-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_services.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_services.yml
new file mode 100644
index 000000000..0523ea401
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_services.yml
@@ -0,0 +1,139 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: child-service
+  namespace: default
+spec:
+  ports:
+    - name: web
+      port: 9000
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: child-service-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: child-service
+addressType: IPv4
+ports:
+  - name: web
+    port: 9000
+endpoints:
+  - addresses:
+      - 10.10.2.1
+      - 10.10.2.2
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: users-service
+  namespace: default
+spec:
+  ports:
+    - name: web
+      port: 9000
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: users-service-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: users-service
+addressType: IPv4
+ports:
+  - name: web
+    port: 9000
+endpoints:
+  - addresses:
+      - 10.10.5.1
+      - 10.10.5.2
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: shared-service
+  namespace: default
+spec:
+  ports:
+    - name: web
+      port: 9000
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: shared-service-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: shared-service
+addressType: IPv4
+ports:
+  - name: web
+    port: 9000
+endpoints:
+  - addresses:
+      - 10.10.8.1
+      - 10.10.8.2
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cross-service
+  namespace: ns-b
+spec:
+  ports:
+    - name: web
+      port: 9000
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: cross-service-abc
+  namespace: ns-b
+  labels:
+    kubernetes.io/service-name: cross-service
+addressType: IPv4
+ports:
+  - name: web
+    port: 9000
+endpoints:
+  - addresses:
+      - 10.10.11.1
+      - 10.10.11.2
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: same-service
+  namespace: default
+spec:
+  ports:
+    - name: web
+      port: 9000
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: same-service-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: same-service
+addressType: IPv4
+ports:
+  - name: web
+    port: 9000
+endpoints:
+  - addresses:
+      - 10.10.14.1
+      - 10.10.14.2
+    conditions:
+      ready: true
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_multiple_routes.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_multiple_routes.yml
new file mode 100644
index 000000000..4d91e32a6
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_multiple_routes.yml
@@ -0,0 +1,30 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-multi
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`api.example.com`) && PathPrefix(`/v1`)
+      kind: Rule
+    - match: Host(`api.example.com`) && PathPrefix(`/v2`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-multi-routes
+  namespace: default
+spec:
+  parentRefs:
+    - name: parent-multi
+      namespace: default
+  routes:
+    - match: Path(`/users`)
+      kind: Rule
+      services:
+        - name: users-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_single_route.yml b/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_single_route.yml
new file mode 100644
index 000000000..073776252
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/parent_refs_single_parent_single_route.yml
@@ -0,0 +1,28 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: parent-single
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`parent.example.com`)
+      kind: Rule
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: child-single
+  namespace: default
+spec:
+  parentRefs:
+    - name: parent-single
+      namespace: default
+  routes:
+    - match: Path(`/api`)
+      kind: Rule
+      services:
+        - name: child-service
+          port: 9000
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/with_highest_random_weight.yml b/pkg/provider/kubernetes/crd/fixtures/with_highest_random_weight.yml
new file mode 100644
index 000000000..f6684c03e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/with_highest_random_weight.yml
@@ -0,0 +1,107 @@
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: whoami1-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: whoami1
+
+addressType: IPv4
+ports:
+  - name: web
+    port: 8080
+endpoints:
+  - addresses:
+      - 10.10.0.1
+      - 10.10.0.2
+    conditions:
+      ready: true
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami1
+  namespace: default
+
+spec:
+  ports:
+    - name: web
+      port: 8080
+  selector:
+    app: traefiklabs
+    task: whoami1
+
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: whoami2-abc
+  namespace: default
+  labels:
+    kubernetes.io/service-name: whoami2
+
+addressType: IPv4
+ports:
+  - name: web
+    port: 8080
+endpoints:
+  - addresses:
+      - 10.10.0.3
+      - 10.10.0.4
+    conditions:
+      ready: true
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami2
+  namespace: default
+
+spec:
+  ports:
+    - name: web
+      port: 8080
+  selector:
+    app: traefiklabs
+    task: whoami2
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: hrw1
+  namespace: default
+
+spec:
+  highestRandomWeight:
+    services:
+      - name: whoami1
+        kind: Service
+        port: 8080
+        weight: 10
+      - name: whoami2
+        kind: Service
+        port: 8080
+        weight: 20
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.route
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/foo`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: hrw1
+      kind: TraefikService
\ No newline at end of file
diff --git a/pkg/provider/kubernetes/crd/fixtures/with_leasttime_strategy.yml b/pkg/provider/kubernetes/crd/fixtures/with_leasttime_strategy.yml
new file mode 100644
index 000000000..4f47fd4bb
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/fixtures/with_leasttime_strategy.yml
@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.route
+  namespace: default
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/leasttime`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami2
+      port: 8080
+      strategy: leasttime
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/internal/internal.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/internal/internal.go
new file mode 100644
index 000000000..945a4ae8e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/internal/internal.go
@@ -0,0 +1,70 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	fmt "fmt"
+	sync "sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/basicauth.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/basicauth.go
new file mode 100644
index 000000000..d903414dc
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/basicauth.go
@@ -0,0 +1,74 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// BasicAuthApplyConfiguration represents a declarative configuration of the BasicAuth type for use
+// with apply.
+type BasicAuthApplyConfiguration struct {
+	Secret       *string `json:"secret,omitempty"`
+	Realm        *string `json:"realm,omitempty"`
+	RemoveHeader *bool   `json:"removeHeader,omitempty"`
+	HeaderField  *string `json:"headerField,omitempty"`
+}
+
+// BasicAuthApplyConfiguration constructs a declarative configuration of the BasicAuth type for use with
+// apply.
+func BasicAuth() *BasicAuthApplyConfiguration {
+	return &BasicAuthApplyConfiguration{}
+}
+
+// WithSecret sets the Secret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Secret field is set to the value of the last call.
+func (b *BasicAuthApplyConfiguration) WithSecret(value string) *BasicAuthApplyConfiguration {
+	b.Secret = &value
+	return b
+}
+
+// WithRealm sets the Realm field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Realm field is set to the value of the last call.
+func (b *BasicAuthApplyConfiguration) WithRealm(value string) *BasicAuthApplyConfiguration {
+	b.Realm = &value
+	return b
+}
+
+// WithRemoveHeader sets the RemoveHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RemoveHeader field is set to the value of the last call.
+func (b *BasicAuthApplyConfiguration) WithRemoveHeader(value bool) *BasicAuthApplyConfiguration {
+	b.RemoveHeader = &value
+	return b
+}
+
+// WithHeaderField sets the HeaderField field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HeaderField field is set to the value of the last call.
+func (b *BasicAuthApplyConfiguration) WithHeaderField(value string) *BasicAuthApplyConfiguration {
+	b.HeaderField = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/certificate.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/certificate.go
new file mode 100644
index 000000000..33f85d146
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/certificate.go
@@ -0,0 +1,47 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// CertificateApplyConfiguration represents a declarative configuration of the Certificate type for use
+// with apply.
+type CertificateApplyConfiguration struct {
+	SecretName *string `json:"secretName,omitempty"`
+}
+
+// CertificateApplyConfiguration constructs a declarative configuration of the Certificate type for use with
+// apply.
+func Certificate() *CertificateApplyConfiguration {
+	return &CertificateApplyConfiguration{}
+}
+
+// WithSecretName sets the SecretName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SecretName field is set to the value of the last call.
+func (b *CertificateApplyConfiguration) WithSecretName(value string) *CertificateApplyConfiguration {
+	b.SecretName = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/chain.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/chain.go
new file mode 100644
index 000000000..221da3315
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/chain.go
@@ -0,0 +1,52 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ChainApplyConfiguration represents a declarative configuration of the Chain type for use
+// with apply.
+type ChainApplyConfiguration struct {
+	Middlewares []MiddlewareRefApplyConfiguration `json:"middlewares,omitempty"`
+}
+
+// ChainApplyConfiguration constructs a declarative configuration of the Chain type for use with
+// apply.
+func Chain() *ChainApplyConfiguration {
+	return &ChainApplyConfiguration{}
+}
+
+// WithMiddlewares adds the given value to the Middlewares field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Middlewares field.
+func (b *ChainApplyConfiguration) WithMiddlewares(values ...*MiddlewareRefApplyConfiguration) *ChainApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithMiddlewares")
+		}
+		b.Middlewares = append(b.Middlewares, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/circuitbreaker.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/circuitbreaker.go
new file mode 100644
index 000000000..551041f0f
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/circuitbreaker.go
@@ -0,0 +1,87 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// CircuitBreakerApplyConfiguration represents a declarative configuration of the CircuitBreaker type for use
+// with apply.
+type CircuitBreakerApplyConfiguration struct {
+	Expression       *string             `json:"expression,omitempty"`
+	CheckPeriod      *intstr.IntOrString `json:"checkPeriod,omitempty"`
+	FallbackDuration *intstr.IntOrString `json:"fallbackDuration,omitempty"`
+	RecoveryDuration *intstr.IntOrString `json:"recoveryDuration,omitempty"`
+	ResponseCode     *int                `json:"responseCode,omitempty"`
+}
+
+// CircuitBreakerApplyConfiguration constructs a declarative configuration of the CircuitBreaker type for use with
+// apply.
+func CircuitBreaker() *CircuitBreakerApplyConfiguration {
+	return &CircuitBreakerApplyConfiguration{}
+}
+
+// WithExpression sets the Expression field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Expression field is set to the value of the last call.
+func (b *CircuitBreakerApplyConfiguration) WithExpression(value string) *CircuitBreakerApplyConfiguration {
+	b.Expression = &value
+	return b
+}
+
+// WithCheckPeriod sets the CheckPeriod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CheckPeriod field is set to the value of the last call.
+func (b *CircuitBreakerApplyConfiguration) WithCheckPeriod(value intstr.IntOrString) *CircuitBreakerApplyConfiguration {
+	b.CheckPeriod = &value
+	return b
+}
+
+// WithFallbackDuration sets the FallbackDuration field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FallbackDuration field is set to the value of the last call.
+func (b *CircuitBreakerApplyConfiguration) WithFallbackDuration(value intstr.IntOrString) *CircuitBreakerApplyConfiguration {
+	b.FallbackDuration = &value
+	return b
+}
+
+// WithRecoveryDuration sets the RecoveryDuration field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RecoveryDuration field is set to the value of the last call.
+func (b *CircuitBreakerApplyConfiguration) WithRecoveryDuration(value intstr.IntOrString) *CircuitBreakerApplyConfiguration {
+	b.RecoveryDuration = &value
+	return b
+}
+
+// WithResponseCode sets the ResponseCode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseCode field is set to the value of the last call.
+func (b *CircuitBreakerApplyConfiguration) WithResponseCode(value int) *CircuitBreakerApplyConfiguration {
+	b.ResponseCode = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clientauth.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clientauth.go
new file mode 100644
index 000000000..6227ffdc7
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clientauth.go
@@ -0,0 +1,58 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ClientAuthApplyConfiguration represents a declarative configuration of the ClientAuth type for use
+// with apply.
+type ClientAuthApplyConfiguration struct {
+	SecretNames    []string `json:"secretNames,omitempty"`
+	ClientAuthType *string  `json:"clientAuthType,omitempty"`
+}
+
+// ClientAuthApplyConfiguration constructs a declarative configuration of the ClientAuth type for use with
+// apply.
+func ClientAuth() *ClientAuthApplyConfiguration {
+	return &ClientAuthApplyConfiguration{}
+}
+
+// WithSecretNames adds the given value to the SecretNames field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SecretNames field.
+func (b *ClientAuthApplyConfiguration) WithSecretNames(values ...string) *ClientAuthApplyConfiguration {
+	for i := range values {
+		b.SecretNames = append(b.SecretNames, values[i])
+	}
+	return b
+}
+
+// WithClientAuthType sets the ClientAuthType field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ClientAuthType field is set to the value of the last call.
+func (b *ClientAuthApplyConfiguration) WithClientAuthType(value string) *ClientAuthApplyConfiguration {
+	b.ClientAuthType = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttls.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttls.go
new file mode 100644
index 000000000..dd5f3c2bc
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttls.go
@@ -0,0 +1,65 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ClientTLSApplyConfiguration represents a declarative configuration of the ClientTLS type for use
+// with apply.
+type ClientTLSApplyConfiguration struct {
+	CASecret           *string `json:"caSecret,omitempty"`
+	CertSecret         *string `json:"certSecret,omitempty"`
+	InsecureSkipVerify *bool   `json:"insecureSkipVerify,omitempty"`
+}
+
+// ClientTLSApplyConfiguration constructs a declarative configuration of the ClientTLS type for use with
+// apply.
+func ClientTLS() *ClientTLSApplyConfiguration {
+	return &ClientTLSApplyConfiguration{}
+}
+
+// WithCASecret sets the CASecret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CASecret field is set to the value of the last call.
+func (b *ClientTLSApplyConfiguration) WithCASecret(value string) *ClientTLSApplyConfiguration {
+	b.CASecret = &value
+	return b
+}
+
+// WithCertSecret sets the CertSecret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CertSecret field is set to the value of the last call.
+func (b *ClientTLSApplyConfiguration) WithCertSecret(value string) *ClientTLSApplyConfiguration {
+	b.CertSecret = &value
+	return b
+}
+
+// WithInsecureSkipVerify sets the InsecureSkipVerify field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InsecureSkipVerify field is set to the value of the last call.
+func (b *ClientTLSApplyConfiguration) WithInsecureSkipVerify(value bool) *ClientTLSApplyConfiguration {
+	b.InsecureSkipVerify = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttlswithcaoptional.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttlswithcaoptional.go
new file mode 100644
index 000000000..d5e4e90ef
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/clienttlswithcaoptional.go
@@ -0,0 +1,72 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ClientTLSWithCAOptionalApplyConfiguration represents a declarative configuration of the ClientTLSWithCAOptional type for use
+// with apply.
+type ClientTLSWithCAOptionalApplyConfiguration struct {
+	ClientTLSApplyConfiguration `json:",inline"`
+	CAOptional                  *bool `json:"caOptional,omitempty"`
+}
+
+// ClientTLSWithCAOptionalApplyConfiguration constructs a declarative configuration of the ClientTLSWithCAOptional type for use with
+// apply.
+func ClientTLSWithCAOptional() *ClientTLSWithCAOptionalApplyConfiguration {
+	return &ClientTLSWithCAOptionalApplyConfiguration{}
+}
+
+// WithCASecret sets the CASecret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CASecret field is set to the value of the last call.
+func (b *ClientTLSWithCAOptionalApplyConfiguration) WithCASecret(value string) *ClientTLSWithCAOptionalApplyConfiguration {
+	b.ClientTLSApplyConfiguration.CASecret = &value
+	return b
+}
+
+// WithCertSecret sets the CertSecret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CertSecret field is set to the value of the last call.
+func (b *ClientTLSWithCAOptionalApplyConfiguration) WithCertSecret(value string) *ClientTLSWithCAOptionalApplyConfiguration {
+	b.ClientTLSApplyConfiguration.CertSecret = &value
+	return b
+}
+
+// WithInsecureSkipVerify sets the InsecureSkipVerify field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InsecureSkipVerify field is set to the value of the last call.
+func (b *ClientTLSWithCAOptionalApplyConfiguration) WithInsecureSkipVerify(value bool) *ClientTLSWithCAOptionalApplyConfiguration {
+	b.ClientTLSApplyConfiguration.InsecureSkipVerify = &value
+	return b
+}
+
+// WithCAOptional sets the CAOptional field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CAOptional field is set to the value of the last call.
+func (b *ClientTLSWithCAOptionalApplyConfiguration) WithCAOptional(value bool) *ClientTLSWithCAOptionalApplyConfiguration {
+	b.CAOptional = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/compress.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/compress.go
new file mode 100644
index 000000000..5e5eea00c
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/compress.go
@@ -0,0 +1,89 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// CompressApplyConfiguration represents a declarative configuration of the Compress type for use
+// with apply.
+type CompressApplyConfiguration struct {
+	ExcludedContentTypes []string `json:"excludedContentTypes,omitempty"`
+	IncludedContentTypes []string `json:"includedContentTypes,omitempty"`
+	MinResponseBodyBytes *int     `json:"minResponseBodyBytes,omitempty"`
+	Encodings            []string `json:"encodings,omitempty"`
+	DefaultEncoding      *string  `json:"defaultEncoding,omitempty"`
+}
+
+// CompressApplyConfiguration constructs a declarative configuration of the Compress type for use with
+// apply.
+func Compress() *CompressApplyConfiguration {
+	return &CompressApplyConfiguration{}
+}
+
+// WithExcludedContentTypes adds the given value to the ExcludedContentTypes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ExcludedContentTypes field.
+func (b *CompressApplyConfiguration) WithExcludedContentTypes(values ...string) *CompressApplyConfiguration {
+	for i := range values {
+		b.ExcludedContentTypes = append(b.ExcludedContentTypes, values[i])
+	}
+	return b
+}
+
+// WithIncludedContentTypes adds the given value to the IncludedContentTypes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the IncludedContentTypes field.
+func (b *CompressApplyConfiguration) WithIncludedContentTypes(values ...string) *CompressApplyConfiguration {
+	for i := range values {
+		b.IncludedContentTypes = append(b.IncludedContentTypes, values[i])
+	}
+	return b
+}
+
+// WithMinResponseBodyBytes sets the MinResponseBodyBytes field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinResponseBodyBytes field is set to the value of the last call.
+func (b *CompressApplyConfiguration) WithMinResponseBodyBytes(value int) *CompressApplyConfiguration {
+	b.MinResponseBodyBytes = &value
+	return b
+}
+
+// WithEncodings adds the given value to the Encodings field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Encodings field.
+func (b *CompressApplyConfiguration) WithEncodings(values ...string) *CompressApplyConfiguration {
+	for i := range values {
+		b.Encodings = append(b.Encodings, values[i])
+	}
+	return b
+}
+
+// WithDefaultEncoding sets the DefaultEncoding field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultEncoding field is set to the value of the last call.
+func (b *CompressApplyConfiguration) WithDefaultEncoding(value string) *CompressApplyConfiguration {
+	b.DefaultEncoding = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/digestauth.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/digestauth.go
new file mode 100644
index 000000000..70bf9b3b9
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/digestauth.go
@@ -0,0 +1,74 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// DigestAuthApplyConfiguration represents a declarative configuration of the DigestAuth type for use
+// with apply.
+type DigestAuthApplyConfiguration struct {
+	Secret       *string `json:"secret,omitempty"`
+	RemoveHeader *bool   `json:"removeHeader,omitempty"`
+	Realm        *string `json:"realm,omitempty"`
+	HeaderField  *string `json:"headerField,omitempty"`
+}
+
+// DigestAuthApplyConfiguration constructs a declarative configuration of the DigestAuth type for use with
+// apply.
+func DigestAuth() *DigestAuthApplyConfiguration {
+	return &DigestAuthApplyConfiguration{}
+}
+
+// WithSecret sets the Secret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Secret field is set to the value of the last call.
+func (b *DigestAuthApplyConfiguration) WithSecret(value string) *DigestAuthApplyConfiguration {
+	b.Secret = &value
+	return b
+}
+
+// WithRemoveHeader sets the RemoveHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RemoveHeader field is set to the value of the last call.
+func (b *DigestAuthApplyConfiguration) WithRemoveHeader(value bool) *DigestAuthApplyConfiguration {
+	b.RemoveHeader = &value
+	return b
+}
+
+// WithRealm sets the Realm field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Realm field is set to the value of the last call.
+func (b *DigestAuthApplyConfiguration) WithRealm(value string) *DigestAuthApplyConfiguration {
+	b.Realm = &value
+	return b
+}
+
+// WithHeaderField sets the HeaderField field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HeaderField field is set to the value of the last call.
+func (b *DigestAuthApplyConfiguration) WithHeaderField(value string) *DigestAuthApplyConfiguration {
+	b.HeaderField = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/errorpage.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/errorpage.go
new file mode 100644
index 000000000..3273eb655
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/errorpage.go
@@ -0,0 +1,82 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ErrorPageApplyConfiguration represents a declarative configuration of the ErrorPage type for use
+// with apply.
+type ErrorPageApplyConfiguration struct {
+	Status         []string                   `json:"status,omitempty"`
+	StatusRewrites map[string]int             `json:"statusRewrites,omitempty"`
+	Service        *ServiceApplyConfiguration `json:"service,omitempty"`
+	Query          *string                    `json:"query,omitempty"`
+}
+
+// ErrorPageApplyConfiguration constructs a declarative configuration of the ErrorPage type for use with
+// apply.
+func ErrorPage() *ErrorPageApplyConfiguration {
+	return &ErrorPageApplyConfiguration{}
+}
+
+// WithStatus adds the given value to the Status field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Status field.
+func (b *ErrorPageApplyConfiguration) WithStatus(values ...string) *ErrorPageApplyConfiguration {
+	for i := range values {
+		b.Status = append(b.Status, values[i])
+	}
+	return b
+}
+
+// WithStatusRewrites puts the entries into the StatusRewrites field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the StatusRewrites field,
+// overwriting an existing map entries in StatusRewrites field with the same key.
+func (b *ErrorPageApplyConfiguration) WithStatusRewrites(entries map[string]int) *ErrorPageApplyConfiguration {
+	if b.StatusRewrites == nil && len(entries) > 0 {
+		b.StatusRewrites = make(map[string]int, len(entries))
+	}
+	for k, v := range entries {
+		b.StatusRewrites[k] = v
+	}
+	return b
+}
+
+// WithService sets the Service field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Service field is set to the value of the last call.
+func (b *ErrorPageApplyConfiguration) WithService(value *ServiceApplyConfiguration) *ErrorPageApplyConfiguration {
+	b.Service = value
+	return b
+}
+
+// WithQuery sets the Query field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Query field is set to the value of the last call.
+func (b *ErrorPageApplyConfiguration) WithQuery(value string) *ErrorPageApplyConfiguration {
+	b.Query = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardauth.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardauth.go
new file mode 100644
index 000000000..ab9d603b3
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardauth.go
@@ -0,0 +1,152 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ForwardAuthApplyConfiguration represents a declarative configuration of the ForwardAuth type for use
+// with apply.
+type ForwardAuthApplyConfiguration struct {
+	Address                  *string                                    `json:"address,omitempty"`
+	TrustForwardHeader       *bool                                      `json:"trustForwardHeader,omitempty"`
+	AuthResponseHeaders      []string                                   `json:"authResponseHeaders,omitempty"`
+	AuthResponseHeadersRegex *string                                    `json:"authResponseHeadersRegex,omitempty"`
+	AuthRequestHeaders       []string                                   `json:"authRequestHeaders,omitempty"`
+	TLS                      *ClientTLSWithCAOptionalApplyConfiguration `json:"tls,omitempty"`
+	AddAuthCookiesToResponse []string                                   `json:"addAuthCookiesToResponse,omitempty"`
+	HeaderField              *string                                    `json:"headerField,omitempty"`
+	ForwardBody              *bool                                      `json:"forwardBody,omitempty"`
+	MaxBodySize              *int64                                     `json:"maxBodySize,omitempty"`
+	PreserveLocationHeader   *bool                                      `json:"preserveLocationHeader,omitempty"`
+	PreserveRequestMethod    *bool                                      `json:"preserveRequestMethod,omitempty"`
+}
+
+// ForwardAuthApplyConfiguration constructs a declarative configuration of the ForwardAuth type for use with
+// apply.
+func ForwardAuth() *ForwardAuthApplyConfiguration {
+	return &ForwardAuthApplyConfiguration{}
+}
+
+// WithAddress sets the Address field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Address field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithAddress(value string) *ForwardAuthApplyConfiguration {
+	b.Address = &value
+	return b
+}
+
+// WithTrustForwardHeader sets the TrustForwardHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TrustForwardHeader field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithTrustForwardHeader(value bool) *ForwardAuthApplyConfiguration {
+	b.TrustForwardHeader = &value
+	return b
+}
+
+// WithAuthResponseHeaders adds the given value to the AuthResponseHeaders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AuthResponseHeaders field.
+func (b *ForwardAuthApplyConfiguration) WithAuthResponseHeaders(values ...string) *ForwardAuthApplyConfiguration {
+	for i := range values {
+		b.AuthResponseHeaders = append(b.AuthResponseHeaders, values[i])
+	}
+	return b
+}
+
+// WithAuthResponseHeadersRegex sets the AuthResponseHeadersRegex field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AuthResponseHeadersRegex field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithAuthResponseHeadersRegex(value string) *ForwardAuthApplyConfiguration {
+	b.AuthResponseHeadersRegex = &value
+	return b
+}
+
+// WithAuthRequestHeaders adds the given value to the AuthRequestHeaders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AuthRequestHeaders field.
+func (b *ForwardAuthApplyConfiguration) WithAuthRequestHeaders(values ...string) *ForwardAuthApplyConfiguration {
+	for i := range values {
+		b.AuthRequestHeaders = append(b.AuthRequestHeaders, values[i])
+	}
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithTLS(value *ClientTLSWithCAOptionalApplyConfiguration) *ForwardAuthApplyConfiguration {
+	b.TLS = value
+	return b
+}
+
+// WithAddAuthCookiesToResponse adds the given value to the AddAuthCookiesToResponse field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AddAuthCookiesToResponse field.
+func (b *ForwardAuthApplyConfiguration) WithAddAuthCookiesToResponse(values ...string) *ForwardAuthApplyConfiguration {
+	for i := range values {
+		b.AddAuthCookiesToResponse = append(b.AddAuthCookiesToResponse, values[i])
+	}
+	return b
+}
+
+// WithHeaderField sets the HeaderField field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HeaderField field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithHeaderField(value string) *ForwardAuthApplyConfiguration {
+	b.HeaderField = &value
+	return b
+}
+
+// WithForwardBody sets the ForwardBody field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ForwardBody field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithForwardBody(value bool) *ForwardAuthApplyConfiguration {
+	b.ForwardBody = &value
+	return b
+}
+
+// WithMaxBodySize sets the MaxBodySize field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxBodySize field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithMaxBodySize(value int64) *ForwardAuthApplyConfiguration {
+	b.MaxBodySize = &value
+	return b
+}
+
+// WithPreserveLocationHeader sets the PreserveLocationHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreserveLocationHeader field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithPreserveLocationHeader(value bool) *ForwardAuthApplyConfiguration {
+	b.PreserveLocationHeader = &value
+	return b
+}
+
+// WithPreserveRequestMethod sets the PreserveRequestMethod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreserveRequestMethod field is set to the value of the last call.
+func (b *ForwardAuthApplyConfiguration) WithPreserveRequestMethod(value bool) *ForwardAuthApplyConfiguration {
+	b.PreserveRequestMethod = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardingtimeouts.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardingtimeouts.go
new file mode 100644
index 000000000..b24bb3501
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/forwardingtimeouts.go
@@ -0,0 +1,87 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ForwardingTimeoutsApplyConfiguration represents a declarative configuration of the ForwardingTimeouts type for use
+// with apply.
+type ForwardingTimeoutsApplyConfiguration struct {
+	DialTimeout           *intstr.IntOrString `json:"dialTimeout,omitempty"`
+	ResponseHeaderTimeout *intstr.IntOrString `json:"responseHeaderTimeout,omitempty"`
+	IdleConnTimeout       *intstr.IntOrString `json:"idleConnTimeout,omitempty"`
+	ReadIdleTimeout       *intstr.IntOrString `json:"readIdleTimeout,omitempty"`
+	PingTimeout           *intstr.IntOrString `json:"pingTimeout,omitempty"`
+}
+
+// ForwardingTimeoutsApplyConfiguration constructs a declarative configuration of the ForwardingTimeouts type for use with
+// apply.
+func ForwardingTimeouts() *ForwardingTimeoutsApplyConfiguration {
+	return &ForwardingTimeoutsApplyConfiguration{}
+}
+
+// WithDialTimeout sets the DialTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DialTimeout field is set to the value of the last call.
+func (b *ForwardingTimeoutsApplyConfiguration) WithDialTimeout(value intstr.IntOrString) *ForwardingTimeoutsApplyConfiguration {
+	b.DialTimeout = &value
+	return b
+}
+
+// WithResponseHeaderTimeout sets the ResponseHeaderTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseHeaderTimeout field is set to the value of the last call.
+func (b *ForwardingTimeoutsApplyConfiguration) WithResponseHeaderTimeout(value intstr.IntOrString) *ForwardingTimeoutsApplyConfiguration {
+	b.ResponseHeaderTimeout = &value
+	return b
+}
+
+// WithIdleConnTimeout sets the IdleConnTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the IdleConnTimeout field is set to the value of the last call.
+func (b *ForwardingTimeoutsApplyConfiguration) WithIdleConnTimeout(value intstr.IntOrString) *ForwardingTimeoutsApplyConfiguration {
+	b.IdleConnTimeout = &value
+	return b
+}
+
+// WithReadIdleTimeout sets the ReadIdleTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ReadIdleTimeout field is set to the value of the last call.
+func (b *ForwardingTimeoutsApplyConfiguration) WithReadIdleTimeout(value intstr.IntOrString) *ForwardingTimeoutsApplyConfiguration {
+	b.ReadIdleTimeout = &value
+	return b
+}
+
+// WithPingTimeout sets the PingTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PingTimeout field is set to the value of the last call.
+func (b *ForwardingTimeoutsApplyConfiguration) WithPingTimeout(value intstr.IntOrString) *ForwardingTimeoutsApplyConfiguration {
+	b.PingTimeout = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/highestrandomweight.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/highestrandomweight.go
new file mode 100644
index 000000000..f96acf722
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/highestrandomweight.go
@@ -0,0 +1,52 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// HighestRandomWeightApplyConfiguration represents a declarative configuration of the HighestRandomWeight type for use
+// with apply.
+type HighestRandomWeightApplyConfiguration struct {
+	Services []ServiceApplyConfiguration `json:"services,omitempty"`
+}
+
+// HighestRandomWeightApplyConfiguration constructs a declarative configuration of the HighestRandomWeight type for use with
+// apply.
+func HighestRandomWeight() *HighestRandomWeightApplyConfiguration {
+	return &HighestRandomWeightApplyConfiguration{}
+}
+
+// WithServices adds the given value to the Services field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Services field.
+func (b *HighestRandomWeightApplyConfiguration) WithServices(values ...*ServiceApplyConfiguration) *HighestRandomWeightApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithServices")
+		}
+		b.Services = append(b.Services, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroute.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroute.go
new file mode 100644
index 000000000..500cb6192
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroute.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// IngressRouteApplyConfiguration represents a declarative configuration of the IngressRoute type for use
+// with apply.
+type IngressRouteApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *IngressRouteSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// IngressRoute constructs a declarative configuration of the IngressRoute type for use with
+// apply.
+func IngressRoute(name, namespace string) *IngressRouteApplyConfiguration {
+	b := &IngressRouteApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("IngressRoute")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b IngressRouteApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithKind(value string) *IngressRouteApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithAPIVersion(value string) *IngressRouteApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithName(value string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithGenerateName(value string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithNamespace(value string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithUID(value types.UID) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithResourceVersion(value string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithGeneration(value int64) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithCreationTimestamp(value metav1.Time) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *IngressRouteApplyConfiguration) WithLabels(entries map[string]string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *IngressRouteApplyConfiguration) WithAnnotations(entries map[string]string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *IngressRouteApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *IngressRouteApplyConfiguration) WithFinalizers(values ...string) *IngressRouteApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *IngressRouteApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *IngressRouteApplyConfiguration) WithSpec(value *IngressRouteSpecApplyConfiguration) *IngressRouteApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *IngressRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *IngressRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *IngressRouteApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *IngressRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteref.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteref.go
new file mode 100644
index 000000000..aba2dac46
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteref.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// IngressRouteRefApplyConfiguration represents a declarative configuration of the IngressRouteRef type for use
+// with apply.
+type IngressRouteRefApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// IngressRouteRefApplyConfiguration constructs a declarative configuration of the IngressRouteRef type for use with
+// apply.
+func IngressRouteRef() *IngressRouteRefApplyConfiguration {
+	return &IngressRouteRefApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *IngressRouteRefApplyConfiguration) WithName(value string) *IngressRouteRefApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *IngressRouteRefApplyConfiguration) WithNamespace(value string) *IngressRouteRefApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutespec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutespec.go
new file mode 100644
index 000000000..04b0b3e76
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutespec.go
@@ -0,0 +1,86 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// IngressRouteSpecApplyConfiguration represents a declarative configuration of the IngressRouteSpec type for use
+// with apply.
+type IngressRouteSpecApplyConfiguration struct {
+	Routes      []RouteApplyConfiguration           `json:"routes,omitempty"`
+	EntryPoints []string                            `json:"entryPoints,omitempty"`
+	TLS         *TLSApplyConfiguration              `json:"tls,omitempty"`
+	ParentRefs  []IngressRouteRefApplyConfiguration `json:"parentRefs,omitempty"`
+}
+
+// IngressRouteSpecApplyConfiguration constructs a declarative configuration of the IngressRouteSpec type for use with
+// apply.
+func IngressRouteSpec() *IngressRouteSpecApplyConfiguration {
+	return &IngressRouteSpecApplyConfiguration{}
+}
+
+// WithRoutes adds the given value to the Routes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Routes field.
+func (b *IngressRouteSpecApplyConfiguration) WithRoutes(values ...*RouteApplyConfiguration) *IngressRouteSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRoutes")
+		}
+		b.Routes = append(b.Routes, *values[i])
+	}
+	return b
+}
+
+// WithEntryPoints adds the given value to the EntryPoints field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the EntryPoints field.
+func (b *IngressRouteSpecApplyConfiguration) WithEntryPoints(values ...string) *IngressRouteSpecApplyConfiguration {
+	for i := range values {
+		b.EntryPoints = append(b.EntryPoints, values[i])
+	}
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *IngressRouteSpecApplyConfiguration) WithTLS(value *TLSApplyConfiguration) *IngressRouteSpecApplyConfiguration {
+	b.TLS = value
+	return b
+}
+
+// WithParentRefs adds the given value to the ParentRefs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ParentRefs field.
+func (b *IngressRouteSpecApplyConfiguration) WithParentRefs(values ...*IngressRouteRefApplyConfiguration) *IngressRouteSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithParentRefs")
+		}
+		b.ParentRefs = append(b.ParentRefs, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcp.go
new file mode 100644
index 000000000..7a07a2d40
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcp.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// IngressRouteTCPApplyConfiguration represents a declarative configuration of the IngressRouteTCP type for use
+// with apply.
+type IngressRouteTCPApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *IngressRouteTCPSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// IngressRouteTCP constructs a declarative configuration of the IngressRouteTCP type for use with
+// apply.
+func IngressRouteTCP(name, namespace string) *IngressRouteTCPApplyConfiguration {
+	b := &IngressRouteTCPApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("IngressRouteTCP")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b IngressRouteTCPApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithKind(value string) *IngressRouteTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithAPIVersion(value string) *IngressRouteTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithName(value string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithGenerateName(value string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithNamespace(value string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithUID(value types.UID) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithResourceVersion(value string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithGeneration(value int64) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithCreationTimestamp(value metav1.Time) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *IngressRouteTCPApplyConfiguration) WithLabels(entries map[string]string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *IngressRouteTCPApplyConfiguration) WithAnnotations(entries map[string]string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *IngressRouteTCPApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *IngressRouteTCPApplyConfiguration) WithFinalizers(values ...string) *IngressRouteTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *IngressRouteTCPApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *IngressRouteTCPApplyConfiguration) WithSpec(value *IngressRouteTCPSpecApplyConfiguration) *IngressRouteTCPApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *IngressRouteTCPApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *IngressRouteTCPApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *IngressRouteTCPApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *IngressRouteTCPApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcpspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcpspec.go
new file mode 100644
index 000000000..545452619
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressroutetcpspec.go
@@ -0,0 +1,72 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// IngressRouteTCPSpecApplyConfiguration represents a declarative configuration of the IngressRouteTCPSpec type for use
+// with apply.
+type IngressRouteTCPSpecApplyConfiguration struct {
+	Routes      []RouteTCPApplyConfiguration `json:"routes,omitempty"`
+	EntryPoints []string                     `json:"entryPoints,omitempty"`
+	TLS         *TLSTCPApplyConfiguration    `json:"tls,omitempty"`
+}
+
+// IngressRouteTCPSpecApplyConfiguration constructs a declarative configuration of the IngressRouteTCPSpec type for use with
+// apply.
+func IngressRouteTCPSpec() *IngressRouteTCPSpecApplyConfiguration {
+	return &IngressRouteTCPSpecApplyConfiguration{}
+}
+
+// WithRoutes adds the given value to the Routes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Routes field.
+func (b *IngressRouteTCPSpecApplyConfiguration) WithRoutes(values ...*RouteTCPApplyConfiguration) *IngressRouteTCPSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRoutes")
+		}
+		b.Routes = append(b.Routes, *values[i])
+	}
+	return b
+}
+
+// WithEntryPoints adds the given value to the EntryPoints field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the EntryPoints field.
+func (b *IngressRouteTCPSpecApplyConfiguration) WithEntryPoints(values ...string) *IngressRouteTCPSpecApplyConfiguration {
+	for i := range values {
+		b.EntryPoints = append(b.EntryPoints, values[i])
+	}
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *IngressRouteTCPSpecApplyConfiguration) WithTLS(value *TLSTCPApplyConfiguration) *IngressRouteTCPSpecApplyConfiguration {
+	b.TLS = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudp.go
new file mode 100644
index 000000000..487e9c87a
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudp.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// IngressRouteUDPApplyConfiguration represents a declarative configuration of the IngressRouteUDP type for use
+// with apply.
+type IngressRouteUDPApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *IngressRouteUDPSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// IngressRouteUDP constructs a declarative configuration of the IngressRouteUDP type for use with
+// apply.
+func IngressRouteUDP(name, namespace string) *IngressRouteUDPApplyConfiguration {
+	b := &IngressRouteUDPApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("IngressRouteUDP")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b IngressRouteUDPApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithKind(value string) *IngressRouteUDPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithAPIVersion(value string) *IngressRouteUDPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithName(value string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithGenerateName(value string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithNamespace(value string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithUID(value types.UID) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithResourceVersion(value string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithGeneration(value int64) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithCreationTimestamp(value metav1.Time) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *IngressRouteUDPApplyConfiguration) WithLabels(entries map[string]string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *IngressRouteUDPApplyConfiguration) WithAnnotations(entries map[string]string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *IngressRouteUDPApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *IngressRouteUDPApplyConfiguration) WithFinalizers(values ...string) *IngressRouteUDPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *IngressRouteUDPApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *IngressRouteUDPApplyConfiguration) WithSpec(value *IngressRouteUDPSpecApplyConfiguration) *IngressRouteUDPApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *IngressRouteUDPApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *IngressRouteUDPApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *IngressRouteUDPApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *IngressRouteUDPApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudpspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudpspec.go
new file mode 100644
index 000000000..96b317fed
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ingressrouteudpspec.go
@@ -0,0 +1,63 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// IngressRouteUDPSpecApplyConfiguration represents a declarative configuration of the IngressRouteUDPSpec type for use
+// with apply.
+type IngressRouteUDPSpecApplyConfiguration struct {
+	Routes      []RouteUDPApplyConfiguration `json:"routes,omitempty"`
+	EntryPoints []string                     `json:"entryPoints,omitempty"`
+}
+
+// IngressRouteUDPSpecApplyConfiguration constructs a declarative configuration of the IngressRouteUDPSpec type for use with
+// apply.
+func IngressRouteUDPSpec() *IngressRouteUDPSpecApplyConfiguration {
+	return &IngressRouteUDPSpecApplyConfiguration{}
+}
+
+// WithRoutes adds the given value to the Routes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Routes field.
+func (b *IngressRouteUDPSpecApplyConfiguration) WithRoutes(values ...*RouteUDPApplyConfiguration) *IngressRouteUDPSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRoutes")
+		}
+		b.Routes = append(b.Routes, *values[i])
+	}
+	return b
+}
+
+// WithEntryPoints adds the given value to the EntryPoints field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the EntryPoints field.
+func (b *IngressRouteUDPSpecApplyConfiguration) WithEntryPoints(values ...string) *IngressRouteUDPSpecApplyConfiguration {
+	for i := range values {
+		b.EntryPoints = append(b.EntryPoints, values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/loadbalancerspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/loadbalancerspec.go
new file mode 100644
index 000000000..726f425a2
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/loadbalancerspec.go
@@ -0,0 +1,178 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// LoadBalancerSpecApplyConfiguration represents a declarative configuration of the LoadBalancerSpec type for use
+// with apply.
+type LoadBalancerSpecApplyConfiguration struct {
+	Name               *string                                     `json:"name,omitempty"`
+	Kind               *string                                     `json:"kind,omitempty"`
+	Namespace          *string                                     `json:"namespace,omitempty"`
+	Sticky             *dynamic.Sticky                             `json:"sticky,omitempty"`
+	Port               *intstr.IntOrString                         `json:"port,omitempty"`
+	Scheme             *string                                     `json:"scheme,omitempty"`
+	Strategy           *dynamic.BalancerStrategy                   `json:"strategy,omitempty"`
+	PassHostHeader     *bool                                       `json:"passHostHeader,omitempty"`
+	ResponseForwarding *ResponseForwardingApplyConfiguration       `json:"responseForwarding,omitempty"`
+	ServersTransport   *string                                     `json:"serversTransport,omitempty"`
+	Weight             *int                                        `json:"weight,omitempty"`
+	NativeLB           *bool                                       `json:"nativeLB,omitempty"`
+	NodePortLB         *bool                                       `json:"nodePortLB,omitempty"`
+	HealthCheck        *ServerHealthCheckApplyConfiguration        `json:"healthCheck,omitempty"`
+	PassiveHealthCheck *PassiveServerHealthCheckApplyConfiguration `json:"passiveHealthCheck,omitempty"`
+}
+
+// LoadBalancerSpecApplyConfiguration constructs a declarative configuration of the LoadBalancerSpec type for use with
+// apply.
+func LoadBalancerSpec() *LoadBalancerSpecApplyConfiguration {
+	return &LoadBalancerSpecApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithName(value string) *LoadBalancerSpecApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithKind(value string) *LoadBalancerSpecApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithNamespace(value string) *LoadBalancerSpecApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithSticky sets the Sticky field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Sticky field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithSticky(value dynamic.Sticky) *LoadBalancerSpecApplyConfiguration {
+	b.Sticky = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithPort(value intstr.IntOrString) *LoadBalancerSpecApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithScheme sets the Scheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheme field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithScheme(value string) *LoadBalancerSpecApplyConfiguration {
+	b.Scheme = &value
+	return b
+}
+
+// WithStrategy sets the Strategy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Strategy field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithStrategy(value dynamic.BalancerStrategy) *LoadBalancerSpecApplyConfiguration {
+	b.Strategy = &value
+	return b
+}
+
+// WithPassHostHeader sets the PassHostHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassHostHeader field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithPassHostHeader(value bool) *LoadBalancerSpecApplyConfiguration {
+	b.PassHostHeader = &value
+	return b
+}
+
+// WithResponseForwarding sets the ResponseForwarding field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseForwarding field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithResponseForwarding(value *ResponseForwardingApplyConfiguration) *LoadBalancerSpecApplyConfiguration {
+	b.ResponseForwarding = value
+	return b
+}
+
+// WithServersTransport sets the ServersTransport field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServersTransport field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithServersTransport(value string) *LoadBalancerSpecApplyConfiguration {
+	b.ServersTransport = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithWeight(value int) *LoadBalancerSpecApplyConfiguration {
+	b.Weight = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithNativeLB(value bool) *LoadBalancerSpecApplyConfiguration {
+	b.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithNodePortLB(value bool) *LoadBalancerSpecApplyConfiguration {
+	b.NodePortLB = &value
+	return b
+}
+
+// WithHealthCheck sets the HealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HealthCheck field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithHealthCheck(value *ServerHealthCheckApplyConfiguration) *LoadBalancerSpecApplyConfiguration {
+	b.HealthCheck = value
+	return b
+}
+
+// WithPassiveHealthCheck sets the PassiveHealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassiveHealthCheck field is set to the value of the last call.
+func (b *LoadBalancerSpecApplyConfiguration) WithPassiveHealthCheck(value *PassiveServerHealthCheckApplyConfiguration) *LoadBalancerSpecApplyConfiguration {
+	b.PassiveHealthCheck = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middleware.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middleware.go
new file mode 100644
index 000000000..98cbf2853
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middleware.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// MiddlewareApplyConfiguration represents a declarative configuration of the Middleware type for use
+// with apply.
+type MiddlewareApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *MiddlewareSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// Middleware constructs a declarative configuration of the Middleware type for use with
+// apply.
+func Middleware(name, namespace string) *MiddlewareApplyConfiguration {
+	b := &MiddlewareApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Middleware")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b MiddlewareApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithKind(value string) *MiddlewareApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithAPIVersion(value string) *MiddlewareApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithName(value string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithGenerateName(value string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithNamespace(value string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithUID(value types.UID) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithResourceVersion(value string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithGeneration(value int64) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithCreationTimestamp(value metav1.Time) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *MiddlewareApplyConfiguration) WithLabels(entries map[string]string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *MiddlewareApplyConfiguration) WithAnnotations(entries map[string]string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *MiddlewareApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *MiddlewareApplyConfiguration) WithFinalizers(values ...string) *MiddlewareApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *MiddlewareApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *MiddlewareApplyConfiguration) WithSpec(value *MiddlewareSpecApplyConfiguration) *MiddlewareApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *MiddlewareApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *MiddlewareApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *MiddlewareApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *MiddlewareApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewareref.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewareref.go
new file mode 100644
index 000000000..393a71232
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewareref.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// MiddlewareRefApplyConfiguration represents a declarative configuration of the MiddlewareRef type for use
+// with apply.
+type MiddlewareRefApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// MiddlewareRefApplyConfiguration constructs a declarative configuration of the MiddlewareRef type for use with
+// apply.
+func MiddlewareRef() *MiddlewareRefApplyConfiguration {
+	return &MiddlewareRefApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *MiddlewareRefApplyConfiguration) WithName(value string) *MiddlewareRefApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *MiddlewareRefApplyConfiguration) WithNamespace(value string) *MiddlewareRefApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewarespec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewarespec.go
new file mode 100644
index 000000000..4e4a4c063
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewarespec.go
@@ -0,0 +1,274 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+)
+
+// MiddlewareSpecApplyConfiguration represents a declarative configuration of the MiddlewareSpec type for use
+// with apply.
+type MiddlewareSpecApplyConfiguration struct {
+	AddPrefix         *dynamic.AddPrefix                `json:"addPrefix,omitempty"`
+	StripPrefix       *dynamic.StripPrefix              `json:"stripPrefix,omitempty"`
+	StripPrefixRegex  *dynamic.StripPrefixRegex         `json:"stripPrefixRegex,omitempty"`
+	ReplacePath       *dynamic.ReplacePath              `json:"replacePath,omitempty"`
+	ReplacePathRegex  *dynamic.ReplacePathRegex         `json:"replacePathRegex,omitempty"`
+	Chain             *ChainApplyConfiguration          `json:"chain,omitempty"`
+	IPWhiteList       *dynamic.IPWhiteList              `json:"ipWhiteList,omitempty"`
+	IPAllowList       *dynamic.IPAllowList              `json:"ipAllowList,omitempty"`
+	Headers           *dynamic.Headers                  `json:"headers,omitempty"`
+	Errors            *ErrorPageApplyConfiguration      `json:"errors,omitempty"`
+	RateLimit         *RateLimitApplyConfiguration      `json:"rateLimit,omitempty"`
+	RedirectRegex     *dynamic.RedirectRegex            `json:"redirectRegex,omitempty"`
+	RedirectScheme    *dynamic.RedirectScheme           `json:"redirectScheme,omitempty"`
+	BasicAuth         *BasicAuthApplyConfiguration      `json:"basicAuth,omitempty"`
+	DigestAuth        *DigestAuthApplyConfiguration     `json:"digestAuth,omitempty"`
+	ForwardAuth       *ForwardAuthApplyConfiguration    `json:"forwardAuth,omitempty"`
+	InFlightReq       *dynamic.InFlightReq              `json:"inFlightReq,omitempty"`
+	Buffering         *dynamic.Buffering                `json:"buffering,omitempty"`
+	CircuitBreaker    *CircuitBreakerApplyConfiguration `json:"circuitBreaker,omitempty"`
+	Compress          *CompressApplyConfiguration       `json:"compress,omitempty"`
+	PassTLSClientCert *dynamic.PassTLSClientCert        `json:"passTLSClientCert,omitempty"`
+	Retry             *RetryApplyConfiguration          `json:"retry,omitempty"`
+	ContentType       *dynamic.ContentType              `json:"contentType,omitempty"`
+	GrpcWeb           *dynamic.GrpcWeb                  `json:"grpcWeb,omitempty"`
+	Plugin            map[string]v1.JSON                `json:"plugin,omitempty"`
+}
+
+// MiddlewareSpecApplyConfiguration constructs a declarative configuration of the MiddlewareSpec type for use with
+// apply.
+func MiddlewareSpec() *MiddlewareSpecApplyConfiguration {
+	return &MiddlewareSpecApplyConfiguration{}
+}
+
+// WithAddPrefix sets the AddPrefix field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AddPrefix field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithAddPrefix(value dynamic.AddPrefix) *MiddlewareSpecApplyConfiguration {
+	b.AddPrefix = &value
+	return b
+}
+
+// WithStripPrefix sets the StripPrefix field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the StripPrefix field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithStripPrefix(value dynamic.StripPrefix) *MiddlewareSpecApplyConfiguration {
+	b.StripPrefix = &value
+	return b
+}
+
+// WithStripPrefixRegex sets the StripPrefixRegex field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the StripPrefixRegex field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithStripPrefixRegex(value dynamic.StripPrefixRegex) *MiddlewareSpecApplyConfiguration {
+	b.StripPrefixRegex = &value
+	return b
+}
+
+// WithReplacePath sets the ReplacePath field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ReplacePath field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithReplacePath(value dynamic.ReplacePath) *MiddlewareSpecApplyConfiguration {
+	b.ReplacePath = &value
+	return b
+}
+
+// WithReplacePathRegex sets the ReplacePathRegex field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ReplacePathRegex field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithReplacePathRegex(value dynamic.ReplacePathRegex) *MiddlewareSpecApplyConfiguration {
+	b.ReplacePathRegex = &value
+	return b
+}
+
+// WithChain sets the Chain field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Chain field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithChain(value *ChainApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.Chain = value
+	return b
+}
+
+// WithIPWhiteList sets the IPWhiteList field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the IPWhiteList field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithIPWhiteList(value dynamic.IPWhiteList) *MiddlewareSpecApplyConfiguration {
+	b.IPWhiteList = &value
+	return b
+}
+
+// WithIPAllowList sets the IPAllowList field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the IPAllowList field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithIPAllowList(value dynamic.IPAllowList) *MiddlewareSpecApplyConfiguration {
+	b.IPAllowList = &value
+	return b
+}
+
+// WithHeaders sets the Headers field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Headers field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithHeaders(value dynamic.Headers) *MiddlewareSpecApplyConfiguration {
+	b.Headers = &value
+	return b
+}
+
+// WithErrors sets the Errors field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Errors field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithErrors(value *ErrorPageApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.Errors = value
+	return b
+}
+
+// WithRateLimit sets the RateLimit field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RateLimit field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithRateLimit(value *RateLimitApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.RateLimit = value
+	return b
+}
+
+// WithRedirectRegex sets the RedirectRegex field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RedirectRegex field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithRedirectRegex(value dynamic.RedirectRegex) *MiddlewareSpecApplyConfiguration {
+	b.RedirectRegex = &value
+	return b
+}
+
+// WithRedirectScheme sets the RedirectScheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RedirectScheme field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithRedirectScheme(value dynamic.RedirectScheme) *MiddlewareSpecApplyConfiguration {
+	b.RedirectScheme = &value
+	return b
+}
+
+// WithBasicAuth sets the BasicAuth field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BasicAuth field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithBasicAuth(value *BasicAuthApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.BasicAuth = value
+	return b
+}
+
+// WithDigestAuth sets the DigestAuth field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DigestAuth field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithDigestAuth(value *DigestAuthApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.DigestAuth = value
+	return b
+}
+
+// WithForwardAuth sets the ForwardAuth field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ForwardAuth field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithForwardAuth(value *ForwardAuthApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.ForwardAuth = value
+	return b
+}
+
+// WithInFlightReq sets the InFlightReq field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InFlightReq field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithInFlightReq(value dynamic.InFlightReq) *MiddlewareSpecApplyConfiguration {
+	b.InFlightReq = &value
+	return b
+}
+
+// WithBuffering sets the Buffering field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Buffering field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithBuffering(value dynamic.Buffering) *MiddlewareSpecApplyConfiguration {
+	b.Buffering = &value
+	return b
+}
+
+// WithCircuitBreaker sets the CircuitBreaker field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CircuitBreaker field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithCircuitBreaker(value *CircuitBreakerApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.CircuitBreaker = value
+	return b
+}
+
+// WithCompress sets the Compress field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Compress field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithCompress(value *CompressApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.Compress = value
+	return b
+}
+
+// WithPassTLSClientCert sets the PassTLSClientCert field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassTLSClientCert field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithPassTLSClientCert(value dynamic.PassTLSClientCert) *MiddlewareSpecApplyConfiguration {
+	b.PassTLSClientCert = &value
+	return b
+}
+
+// WithRetry sets the Retry field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Retry field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithRetry(value *RetryApplyConfiguration) *MiddlewareSpecApplyConfiguration {
+	b.Retry = value
+	return b
+}
+
+// WithContentType sets the ContentType field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ContentType field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithContentType(value dynamic.ContentType) *MiddlewareSpecApplyConfiguration {
+	b.ContentType = &value
+	return b
+}
+
+// WithGrpcWeb sets the GrpcWeb field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GrpcWeb field is set to the value of the last call.
+func (b *MiddlewareSpecApplyConfiguration) WithGrpcWeb(value dynamic.GrpcWeb) *MiddlewareSpecApplyConfiguration {
+	b.GrpcWeb = &value
+	return b
+}
+
+// WithPlugin puts the entries into the Plugin field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Plugin field,
+// overwriting an existing map entries in Plugin field with the same key.
+func (b *MiddlewareSpecApplyConfiguration) WithPlugin(entries map[string]v1.JSON) *MiddlewareSpecApplyConfiguration {
+	if b.Plugin == nil && len(entries) > 0 {
+		b.Plugin = make(map[string]v1.JSON, len(entries))
+	}
+	for k, v := range entries {
+		b.Plugin[k] = v
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcp.go
new file mode 100644
index 000000000..7a8b92f55
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcp.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// MiddlewareTCPApplyConfiguration represents a declarative configuration of the MiddlewareTCP type for use
+// with apply.
+type MiddlewareTCPApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *MiddlewareTCPSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// MiddlewareTCP constructs a declarative configuration of the MiddlewareTCP type for use with
+// apply.
+func MiddlewareTCP(name, namespace string) *MiddlewareTCPApplyConfiguration {
+	b := &MiddlewareTCPApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("MiddlewareTCP")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b MiddlewareTCPApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithKind(value string) *MiddlewareTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithAPIVersion(value string) *MiddlewareTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithName(value string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithGenerateName(value string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithNamespace(value string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithUID(value types.UID) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithResourceVersion(value string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithGeneration(value int64) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithCreationTimestamp(value metav1.Time) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *MiddlewareTCPApplyConfiguration) WithLabels(entries map[string]string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *MiddlewareTCPApplyConfiguration) WithAnnotations(entries map[string]string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *MiddlewareTCPApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *MiddlewareTCPApplyConfiguration) WithFinalizers(values ...string) *MiddlewareTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *MiddlewareTCPApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *MiddlewareTCPApplyConfiguration) WithSpec(value *MiddlewareTCPSpecApplyConfiguration) *MiddlewareTCPApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *MiddlewareTCPApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *MiddlewareTCPApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *MiddlewareTCPApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *MiddlewareTCPApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcpspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcpspec.go
new file mode 100644
index 000000000..81e751c57
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/middlewaretcpspec.go
@@ -0,0 +1,69 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+// MiddlewareTCPSpecApplyConfiguration represents a declarative configuration of the MiddlewareTCPSpec type for use
+// with apply.
+type MiddlewareTCPSpecApplyConfiguration struct {
+	InFlightConn *dynamic.TCPInFlightConn `json:"inFlightConn,omitempty"`
+	IPWhiteList  *dynamic.TCPIPWhiteList  `json:"ipWhiteList,omitempty"`
+	IPAllowList  *dynamic.TCPIPAllowList  `json:"ipAllowList,omitempty"`
+}
+
+// MiddlewareTCPSpecApplyConfiguration constructs a declarative configuration of the MiddlewareTCPSpec type for use with
+// apply.
+func MiddlewareTCPSpec() *MiddlewareTCPSpecApplyConfiguration {
+	return &MiddlewareTCPSpecApplyConfiguration{}
+}
+
+// WithInFlightConn sets the InFlightConn field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InFlightConn field is set to the value of the last call.
+func (b *MiddlewareTCPSpecApplyConfiguration) WithInFlightConn(value dynamic.TCPInFlightConn) *MiddlewareTCPSpecApplyConfiguration {
+	b.InFlightConn = &value
+	return b
+}
+
+// WithIPWhiteList sets the IPWhiteList field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the IPWhiteList field is set to the value of the last call.
+func (b *MiddlewareTCPSpecApplyConfiguration) WithIPWhiteList(value dynamic.TCPIPWhiteList) *MiddlewareTCPSpecApplyConfiguration {
+	b.IPWhiteList = &value
+	return b
+}
+
+// WithIPAllowList sets the IPAllowList field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the IPAllowList field is set to the value of the last call.
+func (b *MiddlewareTCPSpecApplyConfiguration) WithIPAllowList(value dynamic.TCPIPAllowList) *MiddlewareTCPSpecApplyConfiguration {
+	b.IPAllowList = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirroring.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirroring.go
new file mode 100644
index 000000000..7140f1c37
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirroring.go
@@ -0,0 +1,196 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// MirroringApplyConfiguration represents a declarative configuration of the Mirroring type for use
+// with apply.
+type MirroringApplyConfiguration struct {
+	LoadBalancerSpecApplyConfiguration `json:",inline"`
+	MirrorBody                         *bool                             `json:"mirrorBody,omitempty"`
+	MaxBodySize                        *int64                            `json:"maxBodySize,omitempty"`
+	Mirrors                            []MirrorServiceApplyConfiguration `json:"mirrors,omitempty"`
+}
+
+// MirroringApplyConfiguration constructs a declarative configuration of the Mirroring type for use with
+// apply.
+func Mirroring() *MirroringApplyConfiguration {
+	return &MirroringApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithName(value string) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Name = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithKind(value string) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithNamespace(value string) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithSticky sets the Sticky field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Sticky field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithSticky(value dynamic.Sticky) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Sticky = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithPort(value intstr.IntOrString) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Port = &value
+	return b
+}
+
+// WithScheme sets the Scheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheme field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithScheme(value string) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Scheme = &value
+	return b
+}
+
+// WithStrategy sets the Strategy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Strategy field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithStrategy(value dynamic.BalancerStrategy) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Strategy = &value
+	return b
+}
+
+// WithPassHostHeader sets the PassHostHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassHostHeader field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithPassHostHeader(value bool) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassHostHeader = &value
+	return b
+}
+
+// WithResponseForwarding sets the ResponseForwarding field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseForwarding field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithResponseForwarding(value *ResponseForwardingApplyConfiguration) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ResponseForwarding = value
+	return b
+}
+
+// WithServersTransport sets the ServersTransport field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServersTransport field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithServersTransport(value string) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ServersTransport = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithWeight(value int) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Weight = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithNativeLB(value bool) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithNodePortLB(value bool) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NodePortLB = &value
+	return b
+}
+
+// WithHealthCheck sets the HealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HealthCheck field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithHealthCheck(value *ServerHealthCheckApplyConfiguration) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.HealthCheck = value
+	return b
+}
+
+// WithPassiveHealthCheck sets the PassiveHealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassiveHealthCheck field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithPassiveHealthCheck(value *PassiveServerHealthCheckApplyConfiguration) *MirroringApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassiveHealthCheck = value
+	return b
+}
+
+// WithMirrorBody sets the MirrorBody field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MirrorBody field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithMirrorBody(value bool) *MirroringApplyConfiguration {
+	b.MirrorBody = &value
+	return b
+}
+
+// WithMaxBodySize sets the MaxBodySize field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxBodySize field is set to the value of the last call.
+func (b *MirroringApplyConfiguration) WithMaxBodySize(value int64) *MirroringApplyConfiguration {
+	b.MaxBodySize = &value
+	return b
+}
+
+// WithMirrors adds the given value to the Mirrors field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Mirrors field.
+func (b *MirroringApplyConfiguration) WithMirrors(values ...*MirrorServiceApplyConfiguration) *MirroringApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithMirrors")
+		}
+		b.Mirrors = append(b.Mirrors, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirrorservice.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirrorservice.go
new file mode 100644
index 000000000..f7fde8d3d
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/mirrorservice.go
@@ -0,0 +1,173 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// MirrorServiceApplyConfiguration represents a declarative configuration of the MirrorService type for use
+// with apply.
+type MirrorServiceApplyConfiguration struct {
+	LoadBalancerSpecApplyConfiguration `json:",inline"`
+	Percent                            *int `json:"percent,omitempty"`
+}
+
+// MirrorServiceApplyConfiguration constructs a declarative configuration of the MirrorService type for use with
+// apply.
+func MirrorService() *MirrorServiceApplyConfiguration {
+	return &MirrorServiceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithName(value string) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Name = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithKind(value string) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithNamespace(value string) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithSticky sets the Sticky field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Sticky field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithSticky(value dynamic.Sticky) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Sticky = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithPort(value intstr.IntOrString) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Port = &value
+	return b
+}
+
+// WithScheme sets the Scheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheme field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithScheme(value string) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Scheme = &value
+	return b
+}
+
+// WithStrategy sets the Strategy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Strategy field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithStrategy(value dynamic.BalancerStrategy) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Strategy = &value
+	return b
+}
+
+// WithPassHostHeader sets the PassHostHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassHostHeader field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithPassHostHeader(value bool) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassHostHeader = &value
+	return b
+}
+
+// WithResponseForwarding sets the ResponseForwarding field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseForwarding field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithResponseForwarding(value *ResponseForwardingApplyConfiguration) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ResponseForwarding = value
+	return b
+}
+
+// WithServersTransport sets the ServersTransport field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServersTransport field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithServersTransport(value string) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ServersTransport = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithWeight(value int) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Weight = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithNativeLB(value bool) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithNodePortLB(value bool) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NodePortLB = &value
+	return b
+}
+
+// WithHealthCheck sets the HealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HealthCheck field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithHealthCheck(value *ServerHealthCheckApplyConfiguration) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.HealthCheck = value
+	return b
+}
+
+// WithPassiveHealthCheck sets the PassiveHealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassiveHealthCheck field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithPassiveHealthCheck(value *PassiveServerHealthCheckApplyConfiguration) *MirrorServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassiveHealthCheck = value
+	return b
+}
+
+// WithPercent sets the Percent field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Percent field is set to the value of the last call.
+func (b *MirrorServiceApplyConfiguration) WithPercent(value int) *MirrorServiceApplyConfiguration {
+	b.Percent = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/objectreference.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/objectreference.go
new file mode 100644
index 000000000..bf48afb3e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/objectreference.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ObjectReferenceApplyConfiguration represents a declarative configuration of the ObjectReference type for use
+// with apply.
+type ObjectReferenceApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// ObjectReferenceApplyConfiguration constructs a declarative configuration of the ObjectReference type for use with
+// apply.
+func ObjectReference() *ObjectReferenceApplyConfiguration {
+	return &ObjectReferenceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ObjectReferenceApplyConfiguration) WithName(value string) *ObjectReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ObjectReferenceApplyConfiguration) WithNamespace(value string) *ObjectReferenceApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/passiveserverhealthcheck.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/passiveserverhealthcheck.go
new file mode 100644
index 000000000..f584e214c
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/passiveserverhealthcheck.go
@@ -0,0 +1,60 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// PassiveServerHealthCheckApplyConfiguration represents a declarative configuration of the PassiveServerHealthCheck type for use
+// with apply.
+type PassiveServerHealthCheckApplyConfiguration struct {
+	FailureWindow     *intstr.IntOrString `json:"failureWindow,omitempty"`
+	MaxFailedAttempts *int                `json:"maxFailedAttempts,omitempty"`
+}
+
+// PassiveServerHealthCheckApplyConfiguration constructs a declarative configuration of the PassiveServerHealthCheck type for use with
+// apply.
+func PassiveServerHealthCheck() *PassiveServerHealthCheckApplyConfiguration {
+	return &PassiveServerHealthCheckApplyConfiguration{}
+}
+
+// WithFailureWindow sets the FailureWindow field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FailureWindow field is set to the value of the last call.
+func (b *PassiveServerHealthCheckApplyConfiguration) WithFailureWindow(value intstr.IntOrString) *PassiveServerHealthCheckApplyConfiguration {
+	b.FailureWindow = &value
+	return b
+}
+
+// WithMaxFailedAttempts sets the MaxFailedAttempts field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxFailedAttempts field is set to the value of the last call.
+func (b *PassiveServerHealthCheckApplyConfiguration) WithMaxFailedAttempts(value int) *PassiveServerHealthCheckApplyConfiguration {
+	b.MaxFailedAttempts = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ratelimit.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ratelimit.go
new file mode 100644
index 000000000..8af058d67
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/ratelimit.go
@@ -0,0 +1,88 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// RateLimitApplyConfiguration represents a declarative configuration of the RateLimit type for use
+// with apply.
+type RateLimitApplyConfiguration struct {
+	Average         *int64                   `json:"average,omitempty"`
+	Period          *intstr.IntOrString      `json:"period,omitempty"`
+	Burst           *int64                   `json:"burst,omitempty"`
+	SourceCriterion *dynamic.SourceCriterion `json:"sourceCriterion,omitempty"`
+	Redis           *RedisApplyConfiguration `json:"redis,omitempty"`
+}
+
+// RateLimitApplyConfiguration constructs a declarative configuration of the RateLimit type for use with
+// apply.
+func RateLimit() *RateLimitApplyConfiguration {
+	return &RateLimitApplyConfiguration{}
+}
+
+// WithAverage sets the Average field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Average field is set to the value of the last call.
+func (b *RateLimitApplyConfiguration) WithAverage(value int64) *RateLimitApplyConfiguration {
+	b.Average = &value
+	return b
+}
+
+// WithPeriod sets the Period field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Period field is set to the value of the last call.
+func (b *RateLimitApplyConfiguration) WithPeriod(value intstr.IntOrString) *RateLimitApplyConfiguration {
+	b.Period = &value
+	return b
+}
+
+// WithBurst sets the Burst field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Burst field is set to the value of the last call.
+func (b *RateLimitApplyConfiguration) WithBurst(value int64) *RateLimitApplyConfiguration {
+	b.Burst = &value
+	return b
+}
+
+// WithSourceCriterion sets the SourceCriterion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SourceCriterion field is set to the value of the last call.
+func (b *RateLimitApplyConfiguration) WithSourceCriterion(value dynamic.SourceCriterion) *RateLimitApplyConfiguration {
+	b.SourceCriterion = &value
+	return b
+}
+
+// WithRedis sets the Redis field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Redis field is set to the value of the last call.
+func (b *RateLimitApplyConfiguration) WithRedis(value *RedisApplyConfiguration) *RateLimitApplyConfiguration {
+	b.Redis = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/redis.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/redis.go
new file mode 100644
index 000000000..f402ac375
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/redis.go
@@ -0,0 +1,134 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// RedisApplyConfiguration represents a declarative configuration of the Redis type for use
+// with apply.
+type RedisApplyConfiguration struct {
+	Endpoints      []string                     `json:"endpoints,omitempty"`
+	TLS            *ClientTLSApplyConfiguration `json:"tls,omitempty"`
+	Secret         *string                      `json:"secret,omitempty"`
+	DB             *int                         `json:"db,omitempty"`
+	PoolSize       *int                         `json:"poolSize,omitempty"`
+	MinIdleConns   *int                         `json:"minIdleConns,omitempty"`
+	MaxActiveConns *int                         `json:"maxActiveConns,omitempty"`
+	ReadTimeout    *intstr.IntOrString          `json:"readTimeout,omitempty"`
+	WriteTimeout   *intstr.IntOrString          `json:"writeTimeout,omitempty"`
+	DialTimeout    *intstr.IntOrString          `json:"dialTimeout,omitempty"`
+}
+
+// RedisApplyConfiguration constructs a declarative configuration of the Redis type for use with
+// apply.
+func Redis() *RedisApplyConfiguration {
+	return &RedisApplyConfiguration{}
+}
+
+// WithEndpoints adds the given value to the Endpoints field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Endpoints field.
+func (b *RedisApplyConfiguration) WithEndpoints(values ...string) *RedisApplyConfiguration {
+	for i := range values {
+		b.Endpoints = append(b.Endpoints, values[i])
+	}
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithTLS(value *ClientTLSApplyConfiguration) *RedisApplyConfiguration {
+	b.TLS = value
+	return b
+}
+
+// WithSecret sets the Secret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Secret field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithSecret(value string) *RedisApplyConfiguration {
+	b.Secret = &value
+	return b
+}
+
+// WithDB sets the DB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DB field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithDB(value int) *RedisApplyConfiguration {
+	b.DB = &value
+	return b
+}
+
+// WithPoolSize sets the PoolSize field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PoolSize field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithPoolSize(value int) *RedisApplyConfiguration {
+	b.PoolSize = &value
+	return b
+}
+
+// WithMinIdleConns sets the MinIdleConns field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinIdleConns field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithMinIdleConns(value int) *RedisApplyConfiguration {
+	b.MinIdleConns = &value
+	return b
+}
+
+// WithMaxActiveConns sets the MaxActiveConns field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxActiveConns field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithMaxActiveConns(value int) *RedisApplyConfiguration {
+	b.MaxActiveConns = &value
+	return b
+}
+
+// WithReadTimeout sets the ReadTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ReadTimeout field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithReadTimeout(value intstr.IntOrString) *RedisApplyConfiguration {
+	b.ReadTimeout = &value
+	return b
+}
+
+// WithWriteTimeout sets the WriteTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WriteTimeout field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithWriteTimeout(value intstr.IntOrString) *RedisApplyConfiguration {
+	b.WriteTimeout = &value
+	return b
+}
+
+// WithDialTimeout sets the DialTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DialTimeout field is set to the value of the last call.
+func (b *RedisApplyConfiguration) WithDialTimeout(value intstr.IntOrString) *RedisApplyConfiguration {
+	b.DialTimeout = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/responseforwarding.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/responseforwarding.go
new file mode 100644
index 000000000..73b5936f6
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/responseforwarding.go
@@ -0,0 +1,47 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ResponseForwardingApplyConfiguration represents a declarative configuration of the ResponseForwarding type for use
+// with apply.
+type ResponseForwardingApplyConfiguration struct {
+	FlushInterval *string `json:"flushInterval,omitempty"`
+}
+
+// ResponseForwardingApplyConfiguration constructs a declarative configuration of the ResponseForwarding type for use with
+// apply.
+func ResponseForwarding() *ResponseForwardingApplyConfiguration {
+	return &ResponseForwardingApplyConfiguration{}
+}
+
+// WithFlushInterval sets the FlushInterval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FlushInterval field is set to the value of the last call.
+func (b *ResponseForwardingApplyConfiguration) WithFlushInterval(value string) *ResponseForwardingApplyConfiguration {
+	b.FlushInterval = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/retry.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/retry.go
new file mode 100644
index 000000000..93c06a0f9
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/retry.go
@@ -0,0 +1,60 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// RetryApplyConfiguration represents a declarative configuration of the Retry type for use
+// with apply.
+type RetryApplyConfiguration struct {
+	Attempts        *int                `json:"attempts,omitempty"`
+	InitialInterval *intstr.IntOrString `json:"initialInterval,omitempty"`
+}
+
+// RetryApplyConfiguration constructs a declarative configuration of the Retry type for use with
+// apply.
+func Retry() *RetryApplyConfiguration {
+	return &RetryApplyConfiguration{}
+}
+
+// WithAttempts sets the Attempts field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Attempts field is set to the value of the last call.
+func (b *RetryApplyConfiguration) WithAttempts(value int) *RetryApplyConfiguration {
+	b.Attempts = &value
+	return b
+}
+
+// WithInitialInterval sets the InitialInterval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InitialInterval field is set to the value of the last call.
+func (b *RetryApplyConfiguration) WithInitialInterval(value intstr.IntOrString) *RetryApplyConfiguration {
+	b.InitialInterval = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/rootca.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/rootca.go
new file mode 100644
index 000000000..04df7315a
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/rootca.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// RootCAApplyConfiguration represents a declarative configuration of the RootCA type for use
+// with apply.
+type RootCAApplyConfiguration struct {
+	Secret    *string `json:"secret,omitempty"`
+	ConfigMap *string `json:"configMap,omitempty"`
+}
+
+// RootCAApplyConfiguration constructs a declarative configuration of the RootCA type for use with
+// apply.
+func RootCA() *RootCAApplyConfiguration {
+	return &RootCAApplyConfiguration{}
+}
+
+// WithSecret sets the Secret field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Secret field is set to the value of the last call.
+func (b *RootCAApplyConfiguration) WithSecret(value string) *RootCAApplyConfiguration {
+	b.Secret = &value
+	return b
+}
+
+// WithConfigMap sets the ConfigMap field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ConfigMap field is set to the value of the last call.
+func (b *RootCAApplyConfiguration) WithConfigMap(value string) *RootCAApplyConfiguration {
+	b.ConfigMap = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/route.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/route.go
new file mode 100644
index 000000000..ef9703108
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/route.go
@@ -0,0 +1,115 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+// RouteApplyConfiguration represents a declarative configuration of the Route type for use
+// with apply.
+type RouteApplyConfiguration struct {
+	Match         *string                            `json:"match,omitempty"`
+	Kind          *string                            `json:"kind,omitempty"`
+	Priority      *int                               `json:"priority,omitempty"`
+	Syntax        *string                            `json:"syntax,omitempty"`
+	Services      []ServiceApplyConfiguration        `json:"services,omitempty"`
+	Middlewares   []MiddlewareRefApplyConfiguration  `json:"middlewares,omitempty"`
+	Observability *dynamic.RouterObservabilityConfig `json:"observability,omitempty"`
+}
+
+// RouteApplyConfiguration constructs a declarative configuration of the Route type for use with
+// apply.
+func Route() *RouteApplyConfiguration {
+	return &RouteApplyConfiguration{}
+}
+
+// WithMatch sets the Match field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Match field is set to the value of the last call.
+func (b *RouteApplyConfiguration) WithMatch(value string) *RouteApplyConfiguration {
+	b.Match = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *RouteApplyConfiguration) WithKind(value string) *RouteApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *RouteApplyConfiguration) WithPriority(value int) *RouteApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithSyntax sets the Syntax field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Syntax field is set to the value of the last call.
+func (b *RouteApplyConfiguration) WithSyntax(value string) *RouteApplyConfiguration {
+	b.Syntax = &value
+	return b
+}
+
+// WithServices adds the given value to the Services field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Services field.
+func (b *RouteApplyConfiguration) WithServices(values ...*ServiceApplyConfiguration) *RouteApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithServices")
+		}
+		b.Services = append(b.Services, *values[i])
+	}
+	return b
+}
+
+// WithMiddlewares adds the given value to the Middlewares field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Middlewares field.
+func (b *RouteApplyConfiguration) WithMiddlewares(values ...*MiddlewareRefApplyConfiguration) *RouteApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithMiddlewares")
+		}
+		b.Middlewares = append(b.Middlewares, *values[i])
+	}
+	return b
+}
+
+// WithObservability sets the Observability field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Observability field is set to the value of the last call.
+func (b *RouteApplyConfiguration) WithObservability(value dynamic.RouterObservabilityConfig) *RouteApplyConfiguration {
+	b.Observability = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routetcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routetcp.go
new file mode 100644
index 000000000..a6e7c263e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routetcp.go
@@ -0,0 +1,93 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// RouteTCPApplyConfiguration represents a declarative configuration of the RouteTCP type for use
+// with apply.
+type RouteTCPApplyConfiguration struct {
+	Match       *string                             `json:"match,omitempty"`
+	Priority    *int                                `json:"priority,omitempty"`
+	Syntax      *string                             `json:"syntax,omitempty"`
+	Services    []ServiceTCPApplyConfiguration      `json:"services,omitempty"`
+	Middlewares []ObjectReferenceApplyConfiguration `json:"middlewares,omitempty"`
+}
+
+// RouteTCPApplyConfiguration constructs a declarative configuration of the RouteTCP type for use with
+// apply.
+func RouteTCP() *RouteTCPApplyConfiguration {
+	return &RouteTCPApplyConfiguration{}
+}
+
+// WithMatch sets the Match field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Match field is set to the value of the last call.
+func (b *RouteTCPApplyConfiguration) WithMatch(value string) *RouteTCPApplyConfiguration {
+	b.Match = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *RouteTCPApplyConfiguration) WithPriority(value int) *RouteTCPApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithSyntax sets the Syntax field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Syntax field is set to the value of the last call.
+func (b *RouteTCPApplyConfiguration) WithSyntax(value string) *RouteTCPApplyConfiguration {
+	b.Syntax = &value
+	return b
+}
+
+// WithServices adds the given value to the Services field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Services field.
+func (b *RouteTCPApplyConfiguration) WithServices(values ...*ServiceTCPApplyConfiguration) *RouteTCPApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithServices")
+		}
+		b.Services = append(b.Services, *values[i])
+	}
+	return b
+}
+
+// WithMiddlewares adds the given value to the Middlewares field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Middlewares field.
+func (b *RouteTCPApplyConfiguration) WithMiddlewares(values ...*ObjectReferenceApplyConfiguration) *RouteTCPApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithMiddlewares")
+		}
+		b.Middlewares = append(b.Middlewares, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routeudp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routeudp.go
new file mode 100644
index 000000000..13a49e2ed
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/routeudp.go
@@ -0,0 +1,52 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// RouteUDPApplyConfiguration represents a declarative configuration of the RouteUDP type for use
+// with apply.
+type RouteUDPApplyConfiguration struct {
+	Services []ServiceUDPApplyConfiguration `json:"services,omitempty"`
+}
+
+// RouteUDPApplyConfiguration constructs a declarative configuration of the RouteUDP type for use with
+// apply.
+func RouteUDP() *RouteUDPApplyConfiguration {
+	return &RouteUDPApplyConfiguration{}
+}
+
+// WithServices adds the given value to the Services field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Services field.
+func (b *RouteUDPApplyConfiguration) WithServices(values ...*ServiceUDPApplyConfiguration) *RouteUDPApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithServices")
+		}
+		b.Services = append(b.Services, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverhealthcheck.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverhealthcheck.go
new file mode 100644
index 000000000..c39a2ac05
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverhealthcheck.go
@@ -0,0 +1,156 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ServerHealthCheckApplyConfiguration represents a declarative configuration of the ServerHealthCheck type for use
+// with apply.
+type ServerHealthCheckApplyConfiguration struct {
+	Scheme            *string             `json:"scheme,omitempty"`
+	Mode              *string             `json:"mode,omitempty"`
+	Path              *string             `json:"path,omitempty"`
+	Method            *string             `json:"method,omitempty"`
+	Status            *int                `json:"status,omitempty"`
+	Port              *int                `json:"port,omitempty"`
+	Interval          *intstr.IntOrString `json:"interval,omitempty"`
+	UnhealthyInterval *intstr.IntOrString `json:"unhealthyInterval,omitempty"`
+	Timeout           *intstr.IntOrString `json:"timeout,omitempty"`
+	Hostname          *string             `json:"hostname,omitempty"`
+	FollowRedirects   *bool               `json:"followRedirects,omitempty"`
+	Headers           map[string]string   `json:"headers,omitempty"`
+}
+
+// ServerHealthCheckApplyConfiguration constructs a declarative configuration of the ServerHealthCheck type for use with
+// apply.
+func ServerHealthCheck() *ServerHealthCheckApplyConfiguration {
+	return &ServerHealthCheckApplyConfiguration{}
+}
+
+// WithScheme sets the Scheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheme field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithScheme(value string) *ServerHealthCheckApplyConfiguration {
+	b.Scheme = &value
+	return b
+}
+
+// WithMode sets the Mode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mode field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithMode(value string) *ServerHealthCheckApplyConfiguration {
+	b.Mode = &value
+	return b
+}
+
+// WithPath sets the Path field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Path field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithPath(value string) *ServerHealthCheckApplyConfiguration {
+	b.Path = &value
+	return b
+}
+
+// WithMethod sets the Method field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Method field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithMethod(value string) *ServerHealthCheckApplyConfiguration {
+	b.Method = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithStatus(value int) *ServerHealthCheckApplyConfiguration {
+	b.Status = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithPort(value int) *ServerHealthCheckApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithInterval sets the Interval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Interval field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithInterval(value intstr.IntOrString) *ServerHealthCheckApplyConfiguration {
+	b.Interval = &value
+	return b
+}
+
+// WithUnhealthyInterval sets the UnhealthyInterval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UnhealthyInterval field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithUnhealthyInterval(value intstr.IntOrString) *ServerHealthCheckApplyConfiguration {
+	b.UnhealthyInterval = &value
+	return b
+}
+
+// WithTimeout sets the Timeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Timeout field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithTimeout(value intstr.IntOrString) *ServerHealthCheckApplyConfiguration {
+	b.Timeout = &value
+	return b
+}
+
+// WithHostname sets the Hostname field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Hostname field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithHostname(value string) *ServerHealthCheckApplyConfiguration {
+	b.Hostname = &value
+	return b
+}
+
+// WithFollowRedirects sets the FollowRedirects field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FollowRedirects field is set to the value of the last call.
+func (b *ServerHealthCheckApplyConfiguration) WithFollowRedirects(value bool) *ServerHealthCheckApplyConfiguration {
+	b.FollowRedirects = &value
+	return b
+}
+
+// WithHeaders puts the entries into the Headers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Headers field,
+// overwriting an existing map entries in Headers field with the same key.
+func (b *ServerHealthCheckApplyConfiguration) WithHeaders(entries map[string]string) *ServerHealthCheckApplyConfiguration {
+	if b.Headers == nil && len(entries) > 0 {
+		b.Headers = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Headers[k] = v
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransport.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransport.go
new file mode 100644
index 000000000..95cd7848e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransport.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ServersTransportApplyConfiguration represents a declarative configuration of the ServersTransport type for use
+// with apply.
+type ServersTransportApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *ServersTransportSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// ServersTransport constructs a declarative configuration of the ServersTransport type for use with
+// apply.
+func ServersTransport(name, namespace string) *ServersTransportApplyConfiguration {
+	b := &ServersTransportApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("ServersTransport")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b ServersTransportApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithKind(value string) *ServersTransportApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithAPIVersion(value string) *ServersTransportApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithName(value string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithGenerateName(value string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithNamespace(value string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithUID(value types.UID) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithResourceVersion(value string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithGeneration(value int64) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ServersTransportApplyConfiguration) WithLabels(entries map[string]string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ServersTransportApplyConfiguration) WithAnnotations(entries map[string]string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ServersTransportApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ServersTransportApplyConfiguration) WithFinalizers(values ...string) *ServersTransportApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ServersTransportApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *ServersTransportApplyConfiguration) WithSpec(value *ServersTransportSpecApplyConfiguration) *ServersTransportApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ServersTransportApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ServersTransportApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ServersTransportApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ServersTransportApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransportspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransportspec.go
new file mode 100644
index 000000000..a2507cdb2
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransportspec.go
@@ -0,0 +1,141 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+// ServersTransportSpecApplyConfiguration represents a declarative configuration of the ServersTransportSpec type for use
+// with apply.
+type ServersTransportSpecApplyConfiguration struct {
+	ServerName          *string                               `json:"serverName,omitempty"`
+	InsecureSkipVerify  *bool                                 `json:"insecureSkipVerify,omitempty"`
+	RootCAs             []RootCAApplyConfiguration            `json:"rootCAs,omitempty"`
+	RootCAsSecrets      []string                              `json:"rootCAsSecrets,omitempty"`
+	CertificatesSecrets []string                              `json:"certificatesSecrets,omitempty"`
+	MaxIdleConnsPerHost *int                                  `json:"maxIdleConnsPerHost,omitempty"`
+	ForwardingTimeouts  *ForwardingTimeoutsApplyConfiguration `json:"forwardingTimeouts,omitempty"`
+	DisableHTTP2        *bool                                 `json:"disableHTTP2,omitempty"`
+	PeerCertURI         *string                               `json:"peerCertURI,omitempty"`
+	Spiffe              *dynamic.Spiffe                       `json:"spiffe,omitempty"`
+}
+
+// ServersTransportSpecApplyConfiguration constructs a declarative configuration of the ServersTransportSpec type for use with
+// apply.
+func ServersTransportSpec() *ServersTransportSpecApplyConfiguration {
+	return &ServersTransportSpecApplyConfiguration{}
+}
+
+// WithServerName sets the ServerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServerName field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithServerName(value string) *ServersTransportSpecApplyConfiguration {
+	b.ServerName = &value
+	return b
+}
+
+// WithInsecureSkipVerify sets the InsecureSkipVerify field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InsecureSkipVerify field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithInsecureSkipVerify(value bool) *ServersTransportSpecApplyConfiguration {
+	b.InsecureSkipVerify = &value
+	return b
+}
+
+// WithRootCAs adds the given value to the RootCAs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the RootCAs field.
+func (b *ServersTransportSpecApplyConfiguration) WithRootCAs(values ...*RootCAApplyConfiguration) *ServersTransportSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRootCAs")
+		}
+		b.RootCAs = append(b.RootCAs, *values[i])
+	}
+	return b
+}
+
+// WithRootCAsSecrets adds the given value to the RootCAsSecrets field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the RootCAsSecrets field.
+func (b *ServersTransportSpecApplyConfiguration) WithRootCAsSecrets(values ...string) *ServersTransportSpecApplyConfiguration {
+	for i := range values {
+		b.RootCAsSecrets = append(b.RootCAsSecrets, values[i])
+	}
+	return b
+}
+
+// WithCertificatesSecrets adds the given value to the CertificatesSecrets field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CertificatesSecrets field.
+func (b *ServersTransportSpecApplyConfiguration) WithCertificatesSecrets(values ...string) *ServersTransportSpecApplyConfiguration {
+	for i := range values {
+		b.CertificatesSecrets = append(b.CertificatesSecrets, values[i])
+	}
+	return b
+}
+
+// WithMaxIdleConnsPerHost sets the MaxIdleConnsPerHost field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxIdleConnsPerHost field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithMaxIdleConnsPerHost(value int) *ServersTransportSpecApplyConfiguration {
+	b.MaxIdleConnsPerHost = &value
+	return b
+}
+
+// WithForwardingTimeouts sets the ForwardingTimeouts field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ForwardingTimeouts field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithForwardingTimeouts(value *ForwardingTimeoutsApplyConfiguration) *ServersTransportSpecApplyConfiguration {
+	b.ForwardingTimeouts = value
+	return b
+}
+
+// WithDisableHTTP2 sets the DisableHTTP2 field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisableHTTP2 field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithDisableHTTP2(value bool) *ServersTransportSpecApplyConfiguration {
+	b.DisableHTTP2 = &value
+	return b
+}
+
+// WithPeerCertURI sets the PeerCertURI field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PeerCertURI field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithPeerCertURI(value string) *ServersTransportSpecApplyConfiguration {
+	b.PeerCertURI = &value
+	return b
+}
+
+// WithSpiffe sets the Spiffe field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spiffe field is set to the value of the last call.
+func (b *ServersTransportSpecApplyConfiguration) WithSpiffe(value dynamic.Spiffe) *ServersTransportSpecApplyConfiguration {
+	b.Spiffe = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcp.go
new file mode 100644
index 000000000..46b9ac7a1
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcp.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ServersTransportTCPApplyConfiguration represents a declarative configuration of the ServersTransportTCP type for use
+// with apply.
+type ServersTransportTCPApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *ServersTransportTCPSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// ServersTransportTCP constructs a declarative configuration of the ServersTransportTCP type for use with
+// apply.
+func ServersTransportTCP(name, namespace string) *ServersTransportTCPApplyConfiguration {
+	b := &ServersTransportTCPApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("ServersTransportTCP")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b ServersTransportTCPApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithKind(value string) *ServersTransportTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithAPIVersion(value string) *ServersTransportTCPApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithName(value string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithGenerateName(value string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithNamespace(value string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithUID(value types.UID) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithResourceVersion(value string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithGeneration(value int64) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ServersTransportTCPApplyConfiguration) WithLabels(entries map[string]string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ServersTransportTCPApplyConfiguration) WithAnnotations(entries map[string]string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ServersTransportTCPApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ServersTransportTCPApplyConfiguration) WithFinalizers(values ...string) *ServersTransportTCPApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ServersTransportTCPApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *ServersTransportTCPApplyConfiguration) WithSpec(value *ServersTransportTCPSpecApplyConfiguration) *ServersTransportTCPApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ServersTransportTCPApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ServersTransportTCPApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ServersTransportTCPApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ServersTransportTCPApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcpspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcpspec.go
new file mode 100644
index 000000000..157012eac
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serverstransporttcpspec.go
@@ -0,0 +1,88 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ServersTransportTCPSpecApplyConfiguration represents a declarative configuration of the ServersTransportTCPSpec type for use
+// with apply.
+type ServersTransportTCPSpecApplyConfiguration struct {
+	DialTimeout      *intstr.IntOrString                `json:"dialTimeout,omitempty"`
+	DialKeepAlive    *intstr.IntOrString                `json:"dialKeepAlive,omitempty"`
+	ProxyProtocol    *dynamic.ProxyProtocol             `json:"proxyProtocol,omitempty"`
+	TerminationDelay *intstr.IntOrString                `json:"terminationDelay,omitempty"`
+	TLS              *TLSClientConfigApplyConfiguration `json:"tls,omitempty"`
+}
+
+// ServersTransportTCPSpecApplyConfiguration constructs a declarative configuration of the ServersTransportTCPSpec type for use with
+// apply.
+func ServersTransportTCPSpec() *ServersTransportTCPSpecApplyConfiguration {
+	return &ServersTransportTCPSpecApplyConfiguration{}
+}
+
+// WithDialTimeout sets the DialTimeout field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DialTimeout field is set to the value of the last call.
+func (b *ServersTransportTCPSpecApplyConfiguration) WithDialTimeout(value intstr.IntOrString) *ServersTransportTCPSpecApplyConfiguration {
+	b.DialTimeout = &value
+	return b
+}
+
+// WithDialKeepAlive sets the DialKeepAlive field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DialKeepAlive field is set to the value of the last call.
+func (b *ServersTransportTCPSpecApplyConfiguration) WithDialKeepAlive(value intstr.IntOrString) *ServersTransportTCPSpecApplyConfiguration {
+	b.DialKeepAlive = &value
+	return b
+}
+
+// WithProxyProtocol sets the ProxyProtocol field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ProxyProtocol field is set to the value of the last call.
+func (b *ServersTransportTCPSpecApplyConfiguration) WithProxyProtocol(value dynamic.ProxyProtocol) *ServersTransportTCPSpecApplyConfiguration {
+	b.ProxyProtocol = &value
+	return b
+}
+
+// WithTerminationDelay sets the TerminationDelay field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TerminationDelay field is set to the value of the last call.
+func (b *ServersTransportTCPSpecApplyConfiguration) WithTerminationDelay(value intstr.IntOrString) *ServersTransportTCPSpecApplyConfiguration {
+	b.TerminationDelay = &value
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *ServersTransportTCPSpecApplyConfiguration) WithTLS(value *TLSClientConfigApplyConfiguration) *ServersTransportTCPSpecApplyConfiguration {
+	b.TLS = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/service.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/service.go
new file mode 100644
index 000000000..d0b8342c1
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/service.go
@@ -0,0 +1,164 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ServiceApplyConfiguration represents a declarative configuration of the Service type for use
+// with apply.
+type ServiceApplyConfiguration struct {
+	LoadBalancerSpecApplyConfiguration `json:",inline"`
+}
+
+// ServiceApplyConfiguration constructs a declarative configuration of the Service type for use with
+// apply.
+func Service() *ServiceApplyConfiguration {
+	return &ServiceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithName(value string) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Name = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithKind(value string) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithNamespace(value string) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithSticky sets the Sticky field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Sticky field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithSticky(value dynamic.Sticky) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Sticky = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithPort(value intstr.IntOrString) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Port = &value
+	return b
+}
+
+// WithScheme sets the Scheme field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheme field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithScheme(value string) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Scheme = &value
+	return b
+}
+
+// WithStrategy sets the Strategy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Strategy field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithStrategy(value dynamic.BalancerStrategy) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Strategy = &value
+	return b
+}
+
+// WithPassHostHeader sets the PassHostHeader field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassHostHeader field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithPassHostHeader(value bool) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassHostHeader = &value
+	return b
+}
+
+// WithResponseForwarding sets the ResponseForwarding field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResponseForwarding field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithResponseForwarding(value *ResponseForwardingApplyConfiguration) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ResponseForwarding = value
+	return b
+}
+
+// WithServersTransport sets the ServersTransport field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServersTransport field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithServersTransport(value string) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.ServersTransport = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithWeight(value int) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.Weight = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithNativeLB(value bool) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithNodePortLB(value bool) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.NodePortLB = &value
+	return b
+}
+
+// WithHealthCheck sets the HealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HealthCheck field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithHealthCheck(value *ServerHealthCheckApplyConfiguration) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.HealthCheck = value
+	return b
+}
+
+// WithPassiveHealthCheck sets the PassiveHealthCheck field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PassiveHealthCheck field is set to the value of the last call.
+func (b *ServiceApplyConfiguration) WithPassiveHealthCheck(value *PassiveServerHealthCheckApplyConfiguration) *ServiceApplyConfiguration {
+	b.LoadBalancerSpecApplyConfiguration.PassiveHealthCheck = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/servicetcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/servicetcp.go
new file mode 100644
index 000000000..b5bdc0833
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/servicetcp.go
@@ -0,0 +1,133 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ServiceTCPApplyConfiguration represents a declarative configuration of the ServiceTCP type for use
+// with apply.
+type ServiceTCPApplyConfiguration struct {
+	Name             *string                `json:"name,omitempty"`
+	Namespace        *string                `json:"namespace,omitempty"`
+	Port             *intstr.IntOrString    `json:"port,omitempty"`
+	Weight           *int                   `json:"weight,omitempty"`
+	TerminationDelay *int                   `json:"terminationDelay,omitempty"`
+	ProxyProtocol    *dynamic.ProxyProtocol `json:"proxyProtocol,omitempty"`
+	ServersTransport *string                `json:"serversTransport,omitempty"`
+	TLS              *bool                  `json:"tls,omitempty"`
+	NativeLB         *bool                  `json:"nativeLB,omitempty"`
+	NodePortLB       *bool                  `json:"nodePortLB,omitempty"`
+}
+
+// ServiceTCPApplyConfiguration constructs a declarative configuration of the ServiceTCP type for use with
+// apply.
+func ServiceTCP() *ServiceTCPApplyConfiguration {
+	return &ServiceTCPApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithName(value string) *ServiceTCPApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithNamespace(value string) *ServiceTCPApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithPort(value intstr.IntOrString) *ServiceTCPApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithWeight(value int) *ServiceTCPApplyConfiguration {
+	b.Weight = &value
+	return b
+}
+
+// WithTerminationDelay sets the TerminationDelay field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TerminationDelay field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithTerminationDelay(value int) *ServiceTCPApplyConfiguration {
+	b.TerminationDelay = &value
+	return b
+}
+
+// WithProxyProtocol sets the ProxyProtocol field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ProxyProtocol field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithProxyProtocol(value dynamic.ProxyProtocol) *ServiceTCPApplyConfiguration {
+	b.ProxyProtocol = &value
+	return b
+}
+
+// WithServersTransport sets the ServersTransport field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServersTransport field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithServersTransport(value string) *ServiceTCPApplyConfiguration {
+	b.ServersTransport = &value
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithTLS(value bool) *ServiceTCPApplyConfiguration {
+	b.TLS = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithNativeLB(value bool) *ServiceTCPApplyConfiguration {
+	b.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *ServiceTCPApplyConfiguration) WithNodePortLB(value bool) *ServiceTCPApplyConfiguration {
+	b.NodePortLB = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serviceudp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serviceudp.go
new file mode 100644
index 000000000..325b83c33
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/serviceudp.go
@@ -0,0 +1,96 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+)
+
+// ServiceUDPApplyConfiguration represents a declarative configuration of the ServiceUDP type for use
+// with apply.
+type ServiceUDPApplyConfiguration struct {
+	Name       *string             `json:"name,omitempty"`
+	Namespace  *string             `json:"namespace,omitempty"`
+	Port       *intstr.IntOrString `json:"port,omitempty"`
+	Weight     *int                `json:"weight,omitempty"`
+	NativeLB   *bool               `json:"nativeLB,omitempty"`
+	NodePortLB *bool               `json:"nodePortLB,omitempty"`
+}
+
+// ServiceUDPApplyConfiguration constructs a declarative configuration of the ServiceUDP type for use with
+// apply.
+func ServiceUDP() *ServiceUDPApplyConfiguration {
+	return &ServiceUDPApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithName(value string) *ServiceUDPApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithNamespace(value string) *ServiceUDPApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithPort(value intstr.IntOrString) *ServiceUDPApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithWeight sets the Weight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weight field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithWeight(value int) *ServiceUDPApplyConfiguration {
+	b.Weight = &value
+	return b
+}
+
+// WithNativeLB sets the NativeLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NativeLB field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithNativeLB(value bool) *ServiceUDPApplyConfiguration {
+	b.NativeLB = &value
+	return b
+}
+
+// WithNodePortLB sets the NodePortLB field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodePortLB field is set to the value of the last call.
+func (b *ServiceUDPApplyConfiguration) WithNodePortLB(value bool) *ServiceUDPApplyConfiguration {
+	b.NodePortLB = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tls.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tls.go
new file mode 100644
index 000000000..9e628535b
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tls.go
@@ -0,0 +1,89 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	types "github.com/traefik/traefik/v3/pkg/types"
+)
+
+// TLSApplyConfiguration represents a declarative configuration of the TLS type for use
+// with apply.
+type TLSApplyConfiguration struct {
+	SecretName   *string                         `json:"secretName,omitempty"`
+	Options      *TLSOptionRefApplyConfiguration `json:"options,omitempty"`
+	Store        *TLSStoreRefApplyConfiguration  `json:"store,omitempty"`
+	CertResolver *string                         `json:"certResolver,omitempty"`
+	Domains      []types.Domain                  `json:"domains,omitempty"`
+}
+
+// TLSApplyConfiguration constructs a declarative configuration of the TLS type for use with
+// apply.
+func TLS() *TLSApplyConfiguration {
+	return &TLSApplyConfiguration{}
+}
+
+// WithSecretName sets the SecretName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SecretName field is set to the value of the last call.
+func (b *TLSApplyConfiguration) WithSecretName(value string) *TLSApplyConfiguration {
+	b.SecretName = &value
+	return b
+}
+
+// WithOptions sets the Options field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Options field is set to the value of the last call.
+func (b *TLSApplyConfiguration) WithOptions(value *TLSOptionRefApplyConfiguration) *TLSApplyConfiguration {
+	b.Options = value
+	return b
+}
+
+// WithStore sets the Store field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Store field is set to the value of the last call.
+func (b *TLSApplyConfiguration) WithStore(value *TLSStoreRefApplyConfiguration) *TLSApplyConfiguration {
+	b.Store = value
+	return b
+}
+
+// WithCertResolver sets the CertResolver field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CertResolver field is set to the value of the last call.
+func (b *TLSApplyConfiguration) WithCertResolver(value string) *TLSApplyConfiguration {
+	b.CertResolver = &value
+	return b
+}
+
+// WithDomains adds the given value to the Domains field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Domains field.
+func (b *TLSApplyConfiguration) WithDomains(values ...types.Domain) *TLSApplyConfiguration {
+	for i := range values {
+		b.Domains = append(b.Domains, values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsclientconfig.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsclientconfig.go
new file mode 100644
index 000000000..db409216d
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsclientconfig.go
@@ -0,0 +1,114 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+// TLSClientConfigApplyConfiguration represents a declarative configuration of the TLSClientConfig type for use
+// with apply.
+type TLSClientConfigApplyConfiguration struct {
+	ServerName          *string                    `json:"serverName,omitempty"`
+	InsecureSkipVerify  *bool                      `json:"insecureSkipVerify,omitempty"`
+	RootCAs             []RootCAApplyConfiguration `json:"rootCAs,omitempty"`
+	RootCAsSecrets      []string                   `json:"rootCAsSecrets,omitempty"`
+	CertificatesSecrets []string                   `json:"certificatesSecrets,omitempty"`
+	PeerCertURI         *string                    `json:"peerCertURI,omitempty"`
+	Spiffe              *dynamic.Spiffe            `json:"spiffe,omitempty"`
+}
+
+// TLSClientConfigApplyConfiguration constructs a declarative configuration of the TLSClientConfig type for use with
+// apply.
+func TLSClientConfig() *TLSClientConfigApplyConfiguration {
+	return &TLSClientConfigApplyConfiguration{}
+}
+
+// WithServerName sets the ServerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServerName field is set to the value of the last call.
+func (b *TLSClientConfigApplyConfiguration) WithServerName(value string) *TLSClientConfigApplyConfiguration {
+	b.ServerName = &value
+	return b
+}
+
+// WithInsecureSkipVerify sets the InsecureSkipVerify field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the InsecureSkipVerify field is set to the value of the last call.
+func (b *TLSClientConfigApplyConfiguration) WithInsecureSkipVerify(value bool) *TLSClientConfigApplyConfiguration {
+	b.InsecureSkipVerify = &value
+	return b
+}
+
+// WithRootCAs adds the given value to the RootCAs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the RootCAs field.
+func (b *TLSClientConfigApplyConfiguration) WithRootCAs(values ...*RootCAApplyConfiguration) *TLSClientConfigApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRootCAs")
+		}
+		b.RootCAs = append(b.RootCAs, *values[i])
+	}
+	return b
+}
+
+// WithRootCAsSecrets adds the given value to the RootCAsSecrets field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the RootCAsSecrets field.
+func (b *TLSClientConfigApplyConfiguration) WithRootCAsSecrets(values ...string) *TLSClientConfigApplyConfiguration {
+	for i := range values {
+		b.RootCAsSecrets = append(b.RootCAsSecrets, values[i])
+	}
+	return b
+}
+
+// WithCertificatesSecrets adds the given value to the CertificatesSecrets field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CertificatesSecrets field.
+func (b *TLSClientConfigApplyConfiguration) WithCertificatesSecrets(values ...string) *TLSClientConfigApplyConfiguration {
+	for i := range values {
+		b.CertificatesSecrets = append(b.CertificatesSecrets, values[i])
+	}
+	return b
+}
+
+// WithPeerCertURI sets the PeerCertURI field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PeerCertURI field is set to the value of the last call.
+func (b *TLSClientConfigApplyConfiguration) WithPeerCertURI(value string) *TLSClientConfigApplyConfiguration {
+	b.PeerCertURI = &value
+	return b
+}
+
+// WithSpiffe sets the Spiffe field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spiffe field is set to the value of the last call.
+func (b *TLSClientConfigApplyConfiguration) WithSpiffe(value dynamic.Spiffe) *TLSClientConfigApplyConfiguration {
+	b.Spiffe = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoption.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoption.go
new file mode 100644
index 000000000..e391978ec
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoption.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TLSOptionApplyConfiguration represents a declarative configuration of the TLSOption type for use
+// with apply.
+type TLSOptionApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *TLSOptionSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// TLSOption constructs a declarative configuration of the TLSOption type for use with
+// apply.
+func TLSOption(name, namespace string) *TLSOptionApplyConfiguration {
+	b := &TLSOptionApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TLSOption")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b TLSOptionApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithKind(value string) *TLSOptionApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithAPIVersion(value string) *TLSOptionApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithName(value string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithGenerateName(value string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithNamespace(value string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithUID(value types.UID) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithResourceVersion(value string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithGeneration(value int64) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithCreationTimestamp(value metav1.Time) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TLSOptionApplyConfiguration) WithLabels(entries map[string]string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TLSOptionApplyConfiguration) WithAnnotations(entries map[string]string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TLSOptionApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TLSOptionApplyConfiguration) WithFinalizers(values ...string) *TLSOptionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TLSOptionApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *TLSOptionApplyConfiguration) WithSpec(value *TLSOptionSpecApplyConfiguration) *TLSOptionApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSOptionApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSOptionApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TLSOptionApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSOptionApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionref.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionref.go
new file mode 100644
index 000000000..a3abfd27a
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionref.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// TLSOptionRefApplyConfiguration represents a declarative configuration of the TLSOptionRef type for use
+// with apply.
+type TLSOptionRefApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// TLSOptionRefApplyConfiguration constructs a declarative configuration of the TLSOptionRef type for use with
+// apply.
+func TLSOptionRef() *TLSOptionRefApplyConfiguration {
+	return &TLSOptionRefApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TLSOptionRefApplyConfiguration) WithName(value string) *TLSOptionRefApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TLSOptionRefApplyConfiguration) WithNamespace(value string) *TLSOptionRefApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionspec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionspec.go
new file mode 100644
index 000000000..adf256b6e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsoptionspec.go
@@ -0,0 +1,125 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// TLSOptionSpecApplyConfiguration represents a declarative configuration of the TLSOptionSpec type for use
+// with apply.
+type TLSOptionSpecApplyConfiguration struct {
+	MinVersion               *string                       `json:"minVersion,omitempty"`
+	MaxVersion               *string                       `json:"maxVersion,omitempty"`
+	CipherSuites             []string                      `json:"cipherSuites,omitempty"`
+	CurvePreferences         []string                      `json:"curvePreferences,omitempty"`
+	ClientAuth               *ClientAuthApplyConfiguration `json:"clientAuth,omitempty"`
+	SniStrict                *bool                         `json:"sniStrict,omitempty"`
+	ALPNProtocols            []string                      `json:"alpnProtocols,omitempty"`
+	DisableSessionTickets    *bool                         `json:"disableSessionTickets,omitempty"`
+	PreferServerCipherSuites *bool                         `json:"preferServerCipherSuites,omitempty"`
+}
+
+// TLSOptionSpecApplyConfiguration constructs a declarative configuration of the TLSOptionSpec type for use with
+// apply.
+func TLSOptionSpec() *TLSOptionSpecApplyConfiguration {
+	return &TLSOptionSpecApplyConfiguration{}
+}
+
+// WithMinVersion sets the MinVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinVersion field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithMinVersion(value string) *TLSOptionSpecApplyConfiguration {
+	b.MinVersion = &value
+	return b
+}
+
+// WithMaxVersion sets the MaxVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxVersion field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithMaxVersion(value string) *TLSOptionSpecApplyConfiguration {
+	b.MaxVersion = &value
+	return b
+}
+
+// WithCipherSuites adds the given value to the CipherSuites field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CipherSuites field.
+func (b *TLSOptionSpecApplyConfiguration) WithCipherSuites(values ...string) *TLSOptionSpecApplyConfiguration {
+	for i := range values {
+		b.CipherSuites = append(b.CipherSuites, values[i])
+	}
+	return b
+}
+
+// WithCurvePreferences adds the given value to the CurvePreferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CurvePreferences field.
+func (b *TLSOptionSpecApplyConfiguration) WithCurvePreferences(values ...string) *TLSOptionSpecApplyConfiguration {
+	for i := range values {
+		b.CurvePreferences = append(b.CurvePreferences, values[i])
+	}
+	return b
+}
+
+// WithClientAuth sets the ClientAuth field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ClientAuth field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithClientAuth(value *ClientAuthApplyConfiguration) *TLSOptionSpecApplyConfiguration {
+	b.ClientAuth = value
+	return b
+}
+
+// WithSniStrict sets the SniStrict field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SniStrict field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithSniStrict(value bool) *TLSOptionSpecApplyConfiguration {
+	b.SniStrict = &value
+	return b
+}
+
+// WithALPNProtocols adds the given value to the ALPNProtocols field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ALPNProtocols field.
+func (b *TLSOptionSpecApplyConfiguration) WithALPNProtocols(values ...string) *TLSOptionSpecApplyConfiguration {
+	for i := range values {
+		b.ALPNProtocols = append(b.ALPNProtocols, values[i])
+	}
+	return b
+}
+
+// WithDisableSessionTickets sets the DisableSessionTickets field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisableSessionTickets field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithDisableSessionTickets(value bool) *TLSOptionSpecApplyConfiguration {
+	b.DisableSessionTickets = &value
+	return b
+}
+
+// WithPreferServerCipherSuites sets the PreferServerCipherSuites field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreferServerCipherSuites field is set to the value of the last call.
+func (b *TLSOptionSpecApplyConfiguration) WithPreferServerCipherSuites(value bool) *TLSOptionSpecApplyConfiguration {
+	b.PreferServerCipherSuites = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstore.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstore.go
new file mode 100644
index 000000000..1f0a2858d
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstore.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TLSStoreApplyConfiguration represents a declarative configuration of the TLSStore type for use
+// with apply.
+type TLSStoreApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *TLSStoreSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// TLSStore constructs a declarative configuration of the TLSStore type for use with
+// apply.
+func TLSStore(name, namespace string) *TLSStoreApplyConfiguration {
+	b := &TLSStoreApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TLSStore")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b TLSStoreApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithKind(value string) *TLSStoreApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithAPIVersion(value string) *TLSStoreApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithName(value string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithGenerateName(value string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithNamespace(value string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithUID(value types.UID) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithResourceVersion(value string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithGeneration(value int64) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithCreationTimestamp(value metav1.Time) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TLSStoreApplyConfiguration) WithLabels(entries map[string]string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TLSStoreApplyConfiguration) WithAnnotations(entries map[string]string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TLSStoreApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TLSStoreApplyConfiguration) WithFinalizers(values ...string) *TLSStoreApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TLSStoreApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *TLSStoreApplyConfiguration) WithSpec(value *TLSStoreSpecApplyConfiguration) *TLSStoreApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSStoreApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSStoreApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TLSStoreApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSStoreApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstoreref.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstoreref.go
new file mode 100644
index 000000000..ac89490c8
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstoreref.go
@@ -0,0 +1,56 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// TLSStoreRefApplyConfiguration represents a declarative configuration of the TLSStoreRef type for use
+// with apply.
+type TLSStoreRefApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// TLSStoreRefApplyConfiguration constructs a declarative configuration of the TLSStoreRef type for use with
+// apply.
+func TLSStoreRef() *TLSStoreRefApplyConfiguration {
+	return &TLSStoreRefApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TLSStoreRefApplyConfiguration) WithName(value string) *TLSStoreRefApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TLSStoreRefApplyConfiguration) WithNamespace(value string) *TLSStoreRefApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstorespec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstorespec.go
new file mode 100644
index 000000000..344ef8104
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlsstorespec.go
@@ -0,0 +1,74 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	tls "github.com/traefik/traefik/v3/pkg/tls"
+)
+
+// TLSStoreSpecApplyConfiguration represents a declarative configuration of the TLSStoreSpec type for use
+// with apply.
+type TLSStoreSpecApplyConfiguration struct {
+	DefaultCertificate   *CertificateApplyConfiguration  `json:"defaultCertificate,omitempty"`
+	DefaultGeneratedCert *tls.GeneratedCert              `json:"defaultGeneratedCert,omitempty"`
+	Certificates         []CertificateApplyConfiguration `json:"certificates,omitempty"`
+}
+
+// TLSStoreSpecApplyConfiguration constructs a declarative configuration of the TLSStoreSpec type for use with
+// apply.
+func TLSStoreSpec() *TLSStoreSpecApplyConfiguration {
+	return &TLSStoreSpecApplyConfiguration{}
+}
+
+// WithDefaultCertificate sets the DefaultCertificate field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultCertificate field is set to the value of the last call.
+func (b *TLSStoreSpecApplyConfiguration) WithDefaultCertificate(value *CertificateApplyConfiguration) *TLSStoreSpecApplyConfiguration {
+	b.DefaultCertificate = value
+	return b
+}
+
+// WithDefaultGeneratedCert sets the DefaultGeneratedCert field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultGeneratedCert field is set to the value of the last call.
+func (b *TLSStoreSpecApplyConfiguration) WithDefaultGeneratedCert(value tls.GeneratedCert) *TLSStoreSpecApplyConfiguration {
+	b.DefaultGeneratedCert = &value
+	return b
+}
+
+// WithCertificates adds the given value to the Certificates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Certificates field.
+func (b *TLSStoreSpecApplyConfiguration) WithCertificates(values ...*CertificateApplyConfiguration) *TLSStoreSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCertificates")
+		}
+		b.Certificates = append(b.Certificates, *values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlstcp.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlstcp.go
new file mode 100644
index 000000000..8728fbd2a
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/tlstcp.go
@@ -0,0 +1,98 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	types "github.com/traefik/traefik/v3/pkg/types"
+)
+
+// TLSTCPApplyConfiguration represents a declarative configuration of the TLSTCP type for use
+// with apply.
+type TLSTCPApplyConfiguration struct {
+	SecretName   *string                            `json:"secretName,omitempty"`
+	Passthrough  *bool                              `json:"passthrough,omitempty"`
+	Options      *ObjectReferenceApplyConfiguration `json:"options,omitempty"`
+	Store        *ObjectReferenceApplyConfiguration `json:"store,omitempty"`
+	CertResolver *string                            `json:"certResolver,omitempty"`
+	Domains      []types.Domain                     `json:"domains,omitempty"`
+}
+
+// TLSTCPApplyConfiguration constructs a declarative configuration of the TLSTCP type for use with
+// apply.
+func TLSTCP() *TLSTCPApplyConfiguration {
+	return &TLSTCPApplyConfiguration{}
+}
+
+// WithSecretName sets the SecretName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SecretName field is set to the value of the last call.
+func (b *TLSTCPApplyConfiguration) WithSecretName(value string) *TLSTCPApplyConfiguration {
+	b.SecretName = &value
+	return b
+}
+
+// WithPassthrough sets the Passthrough field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Passthrough field is set to the value of the last call.
+func (b *TLSTCPApplyConfiguration) WithPassthrough(value bool) *TLSTCPApplyConfiguration {
+	b.Passthrough = &value
+	return b
+}
+
+// WithOptions sets the Options field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Options field is set to the value of the last call.
+func (b *TLSTCPApplyConfiguration) WithOptions(value *ObjectReferenceApplyConfiguration) *TLSTCPApplyConfiguration {
+	b.Options = value
+	return b
+}
+
+// WithStore sets the Store field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Store field is set to the value of the last call.
+func (b *TLSTCPApplyConfiguration) WithStore(value *ObjectReferenceApplyConfiguration) *TLSTCPApplyConfiguration {
+	b.Store = value
+	return b
+}
+
+// WithCertResolver sets the CertResolver field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CertResolver field is set to the value of the last call.
+func (b *TLSTCPApplyConfiguration) WithCertResolver(value string) *TLSTCPApplyConfiguration {
+	b.CertResolver = &value
+	return b
+}
+
+// WithDomains adds the given value to the Domains field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Domains field.
+func (b *TLSTCPApplyConfiguration) WithDomains(values ...types.Domain) *TLSTCPApplyConfiguration {
+	for i := range values {
+		b.Domains = append(b.Domains, values[i])
+	}
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservice.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservice.go
new file mode 100644
index 000000000..908418aae
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservice.go
@@ -0,0 +1,241 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TraefikServiceApplyConfiguration represents a declarative configuration of the TraefikService type for use
+// with apply.
+type TraefikServiceApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *TraefikServiceSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// TraefikService constructs a declarative configuration of the TraefikService type for use with
+// apply.
+func TraefikService(name, namespace string) *TraefikServiceApplyConfiguration {
+	b := &TraefikServiceApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TraefikService")
+	b.WithAPIVersion("traefik.io/v1alpha1")
+	return b
+}
+func (b TraefikServiceApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithKind(value string) *TraefikServiceApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithAPIVersion(value string) *TraefikServiceApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithName(value string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithGenerateName(value string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithNamespace(value string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithUID(value types.UID) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithResourceVersion(value string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithGeneration(value int64) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithCreationTimestamp(value metav1.Time) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TraefikServiceApplyConfiguration) WithLabels(entries map[string]string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TraefikServiceApplyConfiguration) WithAnnotations(entries map[string]string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TraefikServiceApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TraefikServiceApplyConfiguration) WithFinalizers(values ...string) *TraefikServiceApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TraefikServiceApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *TraefikServiceApplyConfiguration) WithSpec(value *TraefikServiceSpecApplyConfiguration) *TraefikServiceApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TraefikServiceApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TraefikServiceApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TraefikServiceApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TraefikServiceApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservicespec.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservicespec.go
new file mode 100644
index 000000000..7ddaac9e6
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/traefikservicespec.go
@@ -0,0 +1,65 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// TraefikServiceSpecApplyConfiguration represents a declarative configuration of the TraefikServiceSpec type for use
+// with apply.
+type TraefikServiceSpecApplyConfiguration struct {
+	Weighted            *WeightedRoundRobinApplyConfiguration  `json:"weighted,omitempty"`
+	Mirroring           *MirroringApplyConfiguration           `json:"mirroring,omitempty"`
+	HighestRandomWeight *HighestRandomWeightApplyConfiguration `json:"highestRandomWeight,omitempty"`
+}
+
+// TraefikServiceSpecApplyConfiguration constructs a declarative configuration of the TraefikServiceSpec type for use with
+// apply.
+func TraefikServiceSpec() *TraefikServiceSpecApplyConfiguration {
+	return &TraefikServiceSpecApplyConfiguration{}
+}
+
+// WithWeighted sets the Weighted field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Weighted field is set to the value of the last call.
+func (b *TraefikServiceSpecApplyConfiguration) WithWeighted(value *WeightedRoundRobinApplyConfiguration) *TraefikServiceSpecApplyConfiguration {
+	b.Weighted = value
+	return b
+}
+
+// WithMirroring sets the Mirroring field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mirroring field is set to the value of the last call.
+func (b *TraefikServiceSpecApplyConfiguration) WithMirroring(value *MirroringApplyConfiguration) *TraefikServiceSpecApplyConfiguration {
+	b.Mirroring = value
+	return b
+}
+
+// WithHighestRandomWeight sets the HighestRandomWeight field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HighestRandomWeight field is set to the value of the last call.
+func (b *TraefikServiceSpecApplyConfiguration) WithHighestRandomWeight(value *HighestRandomWeightApplyConfiguration) *TraefikServiceSpecApplyConfiguration {
+	b.HighestRandomWeight = value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/weightedroundrobin.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/weightedroundrobin.go
new file mode 100644
index 000000000..691e9d09e
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1/weightedroundrobin.go
@@ -0,0 +1,65 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	dynamic "github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+// WeightedRoundRobinApplyConfiguration represents a declarative configuration of the WeightedRoundRobin type for use
+// with apply.
+type WeightedRoundRobinApplyConfiguration struct {
+	Services []ServiceApplyConfiguration `json:"services,omitempty"`
+	Sticky   *dynamic.Sticky             `json:"sticky,omitempty"`
+}
+
+// WeightedRoundRobinApplyConfiguration constructs a declarative configuration of the WeightedRoundRobin type for use with
+// apply.
+func WeightedRoundRobin() *WeightedRoundRobinApplyConfiguration {
+	return &WeightedRoundRobinApplyConfiguration{}
+}
+
+// WithServices adds the given value to the Services field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Services field.
+func (b *WeightedRoundRobinApplyConfiguration) WithServices(values ...*ServiceApplyConfiguration) *WeightedRoundRobinApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithServices")
+		}
+		b.Services = append(b.Services, *values[i])
+	}
+	return b
+}
+
+// WithSticky sets the Sticky field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Sticky field is set to the value of the last call.
+func (b *WeightedRoundRobinApplyConfiguration) WithSticky(value dynamic.Sticky) *WeightedRoundRobinApplyConfiguration {
+	b.Sticky = &value
+	return b
+}
diff --git a/pkg/provider/kubernetes/crd/generated/applyconfiguration/utils.go b/pkg/provider/kubernetes/crd/generated/applyconfiguration/utils.go
new file mode 100644
index 000000000..aa7141acc
--- /dev/null
+++ b/pkg/provider/kubernetes/crd/generated/applyconfiguration/utils.go
@@ -0,0 +1,166 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	internal "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/internal"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=traefik.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithKind("BasicAuth"):
+		return &traefikiov1alpha1.BasicAuthApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Certificate"):
+		return &traefikiov1alpha1.CertificateApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Chain"):
+		return &traefikiov1alpha1.ChainApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("CircuitBreaker"):
+		return &traefikiov1alpha1.CircuitBreakerApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ClientAuth"):
+		return &traefikiov1alpha1.ClientAuthApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ClientTLS"):
+		return &traefikiov1alpha1.ClientTLSApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ClientTLSWithCAOptional"):
+		return &traefikiov1alpha1.ClientTLSWithCAOptionalApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Compress"):
+		return &traefikiov1alpha1.CompressApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("DigestAuth"):
+		return &traefikiov1alpha1.DigestAuthApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ErrorPage"):
+		return &traefikiov1alpha1.ErrorPageApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ForwardAuth"):
+		return &traefikiov1alpha1.ForwardAuthApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ForwardingTimeouts"):
+		return &traefikiov1alpha1.ForwardingTimeoutsApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("HighestRandomWeight"):
+		return &traefikiov1alpha1.HighestRandomWeightApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRoute"):
+		return &traefikiov1alpha1.IngressRouteApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteRef"):
+		return &traefikiov1alpha1.IngressRouteRefApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteSpec"):
+		return &traefikiov1alpha1.IngressRouteSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteTCP"):
+		return &traefikiov1alpha1.IngressRouteTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteTCPSpec"):
+		return &traefikiov1alpha1.IngressRouteTCPSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteUDP"):
+		return &traefikiov1alpha1.IngressRouteUDPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("IngressRouteUDPSpec"):
+		return &traefikiov1alpha1.IngressRouteUDPSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("LoadBalancerSpec"):
+		return &traefikiov1alpha1.LoadBalancerSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Middleware"):
+		return &traefikiov1alpha1.MiddlewareApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MiddlewareRef"):
+		return &traefikiov1alpha1.MiddlewareRefApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MiddlewareSpec"):
+		return &traefikiov1alpha1.MiddlewareSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MiddlewareTCP"):
+		return &traefikiov1alpha1.MiddlewareTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MiddlewareTCPSpec"):
+		return &traefikiov1alpha1.MiddlewareTCPSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Mirroring"):
+		return &traefikiov1alpha1.MirroringApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MirrorService"):
+		return &traefikiov1alpha1.MirrorServiceApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ObjectReference"):
+		return &traefikiov1alpha1.ObjectReferenceApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("PassiveServerHealthCheck"):
+		return &traefikiov1alpha1.PassiveServerHealthCheckApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RateLimit"):
+		return &traefikiov1alpha1.RateLimitApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Redis"):
+		return &traefikiov1alpha1.RedisApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ResponseForwarding"):
+		return &traefikiov1alpha1.ResponseForwardingApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Retry"):
+		return &traefikiov1alpha1.RetryApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RootCA"):
+		return &traefikiov1alpha1.RootCAApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Route"):
+		return &traefikiov1alpha1.RouteApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RouteTCP"):
+		return &traefikiov1alpha1.RouteTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RouteUDP"):
+		return &traefikiov1alpha1.RouteUDPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServerHealthCheck"):
+		return &traefikiov1alpha1.ServerHealthCheckApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServersTransport"):
+		return &traefikiov1alpha1.ServersTransportApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServersTransportSpec"):
+		return &traefikiov1alpha1.ServersTransportSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServersTransportTCP"):
+		return &traefikiov1alpha1.ServersTransportTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServersTransportTCPSpec"):
+		return &traefikiov1alpha1.ServersTransportTCPSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Service"):
+		return &traefikiov1alpha1.ServiceApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServiceTCP"):
+		return &traefikiov1alpha1.ServiceTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ServiceUDP"):
+		return &traefikiov1alpha1.ServiceUDPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLS"):
+		return &traefikiov1alpha1.TLSApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSClientConfig"):
+		return &traefikiov1alpha1.TLSClientConfigApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSOption"):
+		return &traefikiov1alpha1.TLSOptionApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSOptionRef"):
+		return &traefikiov1alpha1.TLSOptionRefApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSOptionSpec"):
+		return &traefikiov1alpha1.TLSOptionSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSStore"):
+		return &traefikiov1alpha1.TLSStoreApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSStoreRef"):
+		return &traefikiov1alpha1.TLSStoreRefApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSStoreSpec"):
+		return &traefikiov1alpha1.TLSStoreSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TLSTCP"):
+		return &traefikiov1alpha1.TLSTCPApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TraefikService"):
+		return &traefikiov1alpha1.TraefikServiceApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("TraefikServiceSpec"):
+		return &traefikiov1alpha1.TraefikServiceSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("WeightedRoundRobin"):
+		return &traefikiov1alpha1.WeightedRoundRobinApplyConfiguration{}
+
+	}
+	return nil
+}
+
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
+}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/clientset.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/clientset.go
index 81e985720..e99337aba 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/clientset.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/clientset.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,8 +27,8 @@ THE SOFTWARE.
 package versioned
 
 import (
-	"fmt"
-	"net/http"
+	fmt "fmt"
+	http "net/http"
 
 	traefikv1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	discovery "k8s.io/client-go/discovery"
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/clientset_generated.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/clientset_generated.go
index 771afb9cc..b8091758d 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/clientset_generated.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/clientset_generated.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,9 +27,11 @@ THE SOFTWARE.
 package fake
 
 import (
+	applyconfiguration "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration"
 	clientset "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	traefikv1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	faketraefikv1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/discovery"
@@ -39,8 +41,12 @@ import (
 
 // NewSimpleClientset returns a clientset that will respond with the provided objects.
 // It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
-// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
 // for a real clientset and is mostly useful in simple unit tests.
+//
+// DEPRECATED: NewClientset replaces this with support for field management, which significantly improves
+// server side apply testing. NewClientset is only available when apply configurations are generated (e.g.
+// via --with-applyconfig).
 func NewSimpleClientset(objects ...runtime.Object) *Clientset {
 	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
 	for _, obj := range objects {
@@ -53,9 +59,13 @@ func NewSimpleClientset(objects ...runtime.Object) *Clientset {
 	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
 	cs.AddReactor("*", "*", testing.ObjectReaction(o))
 	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchActcion, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchActcion.ListOptions
+		}
 		gvr := action.GetResource()
 		ns := action.GetNamespace()
-		watch, err := o.Watch(gvr, ns)
+		watch, err := o.Watch(gvr, ns, opts)
 		if err != nil {
 			return false, nil, err
 		}
@@ -82,6 +92,42 @@ func (c *Clientset) Tracker() testing.ObjectTracker {
 	return c.tracker
 }
 
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
 var (
 	_ clientset.Interface = &Clientset{}
 	_ testing.FakeClient  = &Clientset{}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/doc.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/doc.go
index 8e14a2681..51f66e249 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/doc.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/doc.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/register.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/register.go
index d89dd1d19..5981c3533 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/register.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/register.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/doc.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/doc.go
index ce689e997..ab558f7a6 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/doc.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/doc.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/register.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/register.go
index 23add3bf9..b4e546f4a 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/register.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/register.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/doc.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/doc.go
index 19afe1581..84e289b0d 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/doc.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/doc.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/doc.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/doc.go
index 7747ceae0..ff45ddce5 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/doc.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/doc.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroute.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroute.go
index 66dec4591..7d23ec9fd 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroute.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroute.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeIngressRoutes implements IngressRouteInterface
-type FakeIngressRoutes struct {
+// fakeIngressRoutes implements IngressRouteInterface
+type fakeIngressRoutes struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.IngressRoute, *v1alpha1.IngressRouteList, *traefikiov1alpha1.IngressRouteApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var ingressroutesResource = v1alpha1.SchemeGroupVersion.WithResource("ingressroutes")
-
-var ingressroutesKind = v1alpha1.SchemeGroupVersion.WithKind("IngressRoute")
-
-// Get takes name of the ingressRoute, and returns the corresponding ingressRoute object, and an error if there is any.
-func (c *FakeIngressRoutes) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRoute, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(ingressroutesResource, c.ns, name), &v1alpha1.IngressRoute{})
-
-	if obj == nil {
-		return nil, err
+func newFakeIngressRoutes(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.IngressRouteInterface {
+	return &fakeIngressRoutes{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.IngressRoute, *v1alpha1.IngressRouteList, *traefikiov1alpha1.IngressRouteApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("ingressroutes"),
+			v1alpha1.SchemeGroupVersion.WithKind("IngressRoute"),
+			func() *v1alpha1.IngressRoute { return &v1alpha1.IngressRoute{} },
+			func() *v1alpha1.IngressRouteList { return &v1alpha1.IngressRouteList{} },
+			func(dst, src *v1alpha1.IngressRouteList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.IngressRouteList) []*v1alpha1.IngressRoute {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.IngressRouteList, items []*v1alpha1.IngressRoute) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.IngressRoute), err
-}
-
-// List takes label and field selectors, and returns the list of IngressRoutes that match those selectors.
-func (c *FakeIngressRoutes) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(ingressroutesResource, ingressroutesKind, c.ns, opts), &v1alpha1.IngressRouteList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.IngressRouteList{ListMeta: obj.(*v1alpha1.IngressRouteList).ListMeta}
-	for _, item := range obj.(*v1alpha1.IngressRouteList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRoutes.
-func (c *FakeIngressRoutes) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(ingressroutesResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a ingressRoute and creates it.  Returns the server's representation of the ingressRoute, and an error, if there is any.
-func (c *FakeIngressRoutes) Create(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.CreateOptions) (result *v1alpha1.IngressRoute, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(ingressroutesResource, c.ns, ingressRoute), &v1alpha1.IngressRoute{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRoute), err
-}
-
-// Update takes the representation of a ingressRoute and updates it. Returns the server's representation of the ingressRoute, and an error, if there is any.
-func (c *FakeIngressRoutes) Update(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.UpdateOptions) (result *v1alpha1.IngressRoute, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(ingressroutesResource, c.ns, ingressRoute), &v1alpha1.IngressRoute{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRoute), err
-}
-
-// Delete takes name of the ingressRoute and deletes it. Returns an error if one occurs.
-func (c *FakeIngressRoutes) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(ingressroutesResource, c.ns, name, opts), &v1alpha1.IngressRoute{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeIngressRoutes) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(ingressroutesResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.IngressRouteList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched ingressRoute.
-func (c *FakeIngressRoutes) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRoute, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(ingressroutesResource, c.ns, name, pt, data, subresources...), &v1alpha1.IngressRoute{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRoute), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroutetcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroutetcp.go
index e88c24a59..5b8e0fdd4 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroutetcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressroutetcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeIngressRouteTCPs implements IngressRouteTCPInterface
-type FakeIngressRouteTCPs struct {
+// fakeIngressRouteTCPs implements IngressRouteTCPInterface
+type fakeIngressRouteTCPs struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.IngressRouteTCP, *v1alpha1.IngressRouteTCPList, *traefikiov1alpha1.IngressRouteTCPApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var ingressroutetcpsResource = v1alpha1.SchemeGroupVersion.WithResource("ingressroutetcps")
-
-var ingressroutetcpsKind = v1alpha1.SchemeGroupVersion.WithKind("IngressRouteTCP")
-
-// Get takes name of the ingressRouteTCP, and returns the corresponding ingressRouteTCP object, and an error if there is any.
-func (c *FakeIngressRouteTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(ingressroutetcpsResource, c.ns, name), &v1alpha1.IngressRouteTCP{})
-
-	if obj == nil {
-		return nil, err
+func newFakeIngressRouteTCPs(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.IngressRouteTCPInterface {
+	return &fakeIngressRouteTCPs{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.IngressRouteTCP, *v1alpha1.IngressRouteTCPList, *traefikiov1alpha1.IngressRouteTCPApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("ingressroutetcps"),
+			v1alpha1.SchemeGroupVersion.WithKind("IngressRouteTCP"),
+			func() *v1alpha1.IngressRouteTCP { return &v1alpha1.IngressRouteTCP{} },
+			func() *v1alpha1.IngressRouteTCPList { return &v1alpha1.IngressRouteTCPList{} },
+			func(dst, src *v1alpha1.IngressRouteTCPList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.IngressRouteTCPList) []*v1alpha1.IngressRouteTCP {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.IngressRouteTCPList, items []*v1alpha1.IngressRouteTCP) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.IngressRouteTCP), err
-}
-
-// List takes label and field selectors, and returns the list of IngressRouteTCPs that match those selectors.
-func (c *FakeIngressRouteTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteTCPList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(ingressroutetcpsResource, ingressroutetcpsKind, c.ns, opts), &v1alpha1.IngressRouteTCPList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.IngressRouteTCPList{ListMeta: obj.(*v1alpha1.IngressRouteTCPList).ListMeta}
-	for _, item := range obj.(*v1alpha1.IngressRouteTCPList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRouteTCPs.
-func (c *FakeIngressRouteTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(ingressroutetcpsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a ingressRouteTCP and creates it.  Returns the server's representation of the ingressRouteTCP, and an error, if there is any.
-func (c *FakeIngressRouteTCPs) Create(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.CreateOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(ingressroutetcpsResource, c.ns, ingressRouteTCP), &v1alpha1.IngressRouteTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteTCP), err
-}
-
-// Update takes the representation of a ingressRouteTCP and updates it. Returns the server's representation of the ingressRouteTCP, and an error, if there is any.
-func (c *FakeIngressRouteTCPs) Update(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.UpdateOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(ingressroutetcpsResource, c.ns, ingressRouteTCP), &v1alpha1.IngressRouteTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteTCP), err
-}
-
-// Delete takes name of the ingressRouteTCP and deletes it. Returns an error if one occurs.
-func (c *FakeIngressRouteTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(ingressroutetcpsResource, c.ns, name, opts), &v1alpha1.IngressRouteTCP{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeIngressRouteTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(ingressroutetcpsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.IngressRouteTCPList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched ingressRouteTCP.
-func (c *FakeIngressRouteTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(ingressroutetcpsResource, c.ns, name, pt, data, subresources...), &v1alpha1.IngressRouteTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteTCP), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressrouteudp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressrouteudp.go
index 34b448660..1523cce6a 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressrouteudp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_ingressrouteudp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeIngressRouteUDPs implements IngressRouteUDPInterface
-type FakeIngressRouteUDPs struct {
+// fakeIngressRouteUDPs implements IngressRouteUDPInterface
+type fakeIngressRouteUDPs struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.IngressRouteUDP, *v1alpha1.IngressRouteUDPList, *traefikiov1alpha1.IngressRouteUDPApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var ingressrouteudpsResource = v1alpha1.SchemeGroupVersion.WithResource("ingressrouteudps")
-
-var ingressrouteudpsKind = v1alpha1.SchemeGroupVersion.WithKind("IngressRouteUDP")
-
-// Get takes name of the ingressRouteUDP, and returns the corresponding ingressRouteUDP object, and an error if there is any.
-func (c *FakeIngressRouteUDPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(ingressrouteudpsResource, c.ns, name), &v1alpha1.IngressRouteUDP{})
-
-	if obj == nil {
-		return nil, err
+func newFakeIngressRouteUDPs(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.IngressRouteUDPInterface {
+	return &fakeIngressRouteUDPs{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.IngressRouteUDP, *v1alpha1.IngressRouteUDPList, *traefikiov1alpha1.IngressRouteUDPApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("ingressrouteudps"),
+			v1alpha1.SchemeGroupVersion.WithKind("IngressRouteUDP"),
+			func() *v1alpha1.IngressRouteUDP { return &v1alpha1.IngressRouteUDP{} },
+			func() *v1alpha1.IngressRouteUDPList { return &v1alpha1.IngressRouteUDPList{} },
+			func(dst, src *v1alpha1.IngressRouteUDPList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.IngressRouteUDPList) []*v1alpha1.IngressRouteUDP {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.IngressRouteUDPList, items []*v1alpha1.IngressRouteUDP) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.IngressRouteUDP), err
-}
-
-// List takes label and field selectors, and returns the list of IngressRouteUDPs that match those selectors.
-func (c *FakeIngressRouteUDPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteUDPList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(ingressrouteudpsResource, ingressrouteudpsKind, c.ns, opts), &v1alpha1.IngressRouteUDPList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.IngressRouteUDPList{ListMeta: obj.(*v1alpha1.IngressRouteUDPList).ListMeta}
-	for _, item := range obj.(*v1alpha1.IngressRouteUDPList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRouteUDPs.
-func (c *FakeIngressRouteUDPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(ingressrouteudpsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a ingressRouteUDP and creates it.  Returns the server's representation of the ingressRouteUDP, and an error, if there is any.
-func (c *FakeIngressRouteUDPs) Create(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.CreateOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(ingressrouteudpsResource, c.ns, ingressRouteUDP), &v1alpha1.IngressRouteUDP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteUDP), err
-}
-
-// Update takes the representation of a ingressRouteUDP and updates it. Returns the server's representation of the ingressRouteUDP, and an error, if there is any.
-func (c *FakeIngressRouteUDPs) Update(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.UpdateOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(ingressrouteudpsResource, c.ns, ingressRouteUDP), &v1alpha1.IngressRouteUDP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteUDP), err
-}
-
-// Delete takes name of the ingressRouteUDP and deletes it. Returns an error if one occurs.
-func (c *FakeIngressRouteUDPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(ingressrouteudpsResource, c.ns, name, opts), &v1alpha1.IngressRouteUDP{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeIngressRouteUDPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(ingressrouteudpsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.IngressRouteUDPList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched ingressRouteUDP.
-func (c *FakeIngressRouteUDPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteUDP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(ingressrouteudpsResource, c.ns, name, pt, data, subresources...), &v1alpha1.IngressRouteUDP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.IngressRouteUDP), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middleware.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middleware.go
index a27a91a4e..2d336991a 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middleware.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middleware.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,33 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeMiddlewares implements MiddlewareInterface
-type FakeMiddlewares struct {
+// fakeMiddlewares implements MiddlewareInterface
+type fakeMiddlewares struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.Middleware, *v1alpha1.MiddlewareList, *traefikiov1alpha1.MiddlewareApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var middlewaresResource = v1alpha1.SchemeGroupVersion.WithResource("middlewares")
-
-var middlewaresKind = v1alpha1.SchemeGroupVersion.WithKind("Middleware")
-
-// Get takes name of the middleware, and returns the corresponding middleware object, and an error if there is any.
-func (c *FakeMiddlewares) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.Middleware, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(middlewaresResource, c.ns, name), &v1alpha1.Middleware{})
-
-	if obj == nil {
-		return nil, err
+func newFakeMiddlewares(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.MiddlewareInterface {
+	return &fakeMiddlewares{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.Middleware, *v1alpha1.MiddlewareList, *traefikiov1alpha1.MiddlewareApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("middlewares"),
+			v1alpha1.SchemeGroupVersion.WithKind("Middleware"),
+			func() *v1alpha1.Middleware { return &v1alpha1.Middleware{} },
+			func() *v1alpha1.MiddlewareList { return &v1alpha1.MiddlewareList{} },
+			func(dst, src *v1alpha1.MiddlewareList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.MiddlewareList) []*v1alpha1.Middleware { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.MiddlewareList, items []*v1alpha1.Middleware) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.Middleware), err
-}
-
-// List takes label and field selectors, and returns the list of Middlewares that match those selectors.
-func (c *FakeMiddlewares) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.MiddlewareList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(middlewaresResource, middlewaresKind, c.ns, opts), &v1alpha1.MiddlewareList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.MiddlewareList{ListMeta: obj.(*v1alpha1.MiddlewareList).ListMeta}
-	for _, item := range obj.(*v1alpha1.MiddlewareList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested middlewares.
-func (c *FakeMiddlewares) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(middlewaresResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a middleware and creates it.  Returns the server's representation of the middleware, and an error, if there is any.
-func (c *FakeMiddlewares) Create(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.CreateOptions) (result *v1alpha1.Middleware, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(middlewaresResource, c.ns, middleware), &v1alpha1.Middleware{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.Middleware), err
-}
-
-// Update takes the representation of a middleware and updates it. Returns the server's representation of the middleware, and an error, if there is any.
-func (c *FakeMiddlewares) Update(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.UpdateOptions) (result *v1alpha1.Middleware, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(middlewaresResource, c.ns, middleware), &v1alpha1.Middleware{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.Middleware), err
-}
-
-// Delete takes name of the middleware and deletes it. Returns an error if one occurs.
-func (c *FakeMiddlewares) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(middlewaresResource, c.ns, name, opts), &v1alpha1.Middleware{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeMiddlewares) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(middlewaresResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.MiddlewareList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched middleware.
-func (c *FakeMiddlewares) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.Middleware, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(middlewaresResource, c.ns, name, pt, data, subresources...), &v1alpha1.Middleware{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.Middleware), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middlewaretcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middlewaretcp.go
index 4a01eba10..db27a281d 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middlewaretcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_middlewaretcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeMiddlewareTCPs implements MiddlewareTCPInterface
-type FakeMiddlewareTCPs struct {
+// fakeMiddlewareTCPs implements MiddlewareTCPInterface
+type fakeMiddlewareTCPs struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.MiddlewareTCP, *v1alpha1.MiddlewareTCPList, *traefikiov1alpha1.MiddlewareTCPApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var middlewaretcpsResource = v1alpha1.SchemeGroupVersion.WithResource("middlewaretcps")
-
-var middlewaretcpsKind = v1alpha1.SchemeGroupVersion.WithKind("MiddlewareTCP")
-
-// Get takes name of the middlewareTCP, and returns the corresponding middlewareTCP object, and an error if there is any.
-func (c *FakeMiddlewareTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(middlewaretcpsResource, c.ns, name), &v1alpha1.MiddlewareTCP{})
-
-	if obj == nil {
-		return nil, err
+func newFakeMiddlewareTCPs(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.MiddlewareTCPInterface {
+	return &fakeMiddlewareTCPs{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.MiddlewareTCP, *v1alpha1.MiddlewareTCPList, *traefikiov1alpha1.MiddlewareTCPApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("middlewaretcps"),
+			v1alpha1.SchemeGroupVersion.WithKind("MiddlewareTCP"),
+			func() *v1alpha1.MiddlewareTCP { return &v1alpha1.MiddlewareTCP{} },
+			func() *v1alpha1.MiddlewareTCPList { return &v1alpha1.MiddlewareTCPList{} },
+			func(dst, src *v1alpha1.MiddlewareTCPList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.MiddlewareTCPList) []*v1alpha1.MiddlewareTCP {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.MiddlewareTCPList, items []*v1alpha1.MiddlewareTCP) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.MiddlewareTCP), err
-}
-
-// List takes label and field selectors, and returns the list of MiddlewareTCPs that match those selectors.
-func (c *FakeMiddlewareTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.MiddlewareTCPList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(middlewaretcpsResource, middlewaretcpsKind, c.ns, opts), &v1alpha1.MiddlewareTCPList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.MiddlewareTCPList{ListMeta: obj.(*v1alpha1.MiddlewareTCPList).ListMeta}
-	for _, item := range obj.(*v1alpha1.MiddlewareTCPList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested middlewareTCPs.
-func (c *FakeMiddlewareTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(middlewaretcpsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a middlewareTCP and creates it.  Returns the server's representation of the middlewareTCP, and an error, if there is any.
-func (c *FakeMiddlewareTCPs) Create(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.CreateOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(middlewaretcpsResource, c.ns, middlewareTCP), &v1alpha1.MiddlewareTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.MiddlewareTCP), err
-}
-
-// Update takes the representation of a middlewareTCP and updates it. Returns the server's representation of the middlewareTCP, and an error, if there is any.
-func (c *FakeMiddlewareTCPs) Update(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.UpdateOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(middlewaretcpsResource, c.ns, middlewareTCP), &v1alpha1.MiddlewareTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.MiddlewareTCP), err
-}
-
-// Delete takes name of the middlewareTCP and deletes it. Returns an error if one occurs.
-func (c *FakeMiddlewareTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(middlewaretcpsResource, c.ns, name, opts), &v1alpha1.MiddlewareTCP{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeMiddlewareTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(middlewaretcpsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.MiddlewareTCPList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched middlewareTCP.
-func (c *FakeMiddlewareTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.MiddlewareTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(middlewaretcpsResource, c.ns, name, pt, data, subresources...), &v1alpha1.MiddlewareTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.MiddlewareTCP), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransport.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransport.go
index 562e5cc1f..85719e75e 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransport.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransport.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeServersTransports implements ServersTransportInterface
-type FakeServersTransports struct {
+// fakeServersTransports implements ServersTransportInterface
+type fakeServersTransports struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.ServersTransport, *v1alpha1.ServersTransportList, *traefikiov1alpha1.ServersTransportApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var serverstransportsResource = v1alpha1.SchemeGroupVersion.WithResource("serverstransports")
-
-var serverstransportsKind = v1alpha1.SchemeGroupVersion.WithKind("ServersTransport")
-
-// Get takes name of the serversTransport, and returns the corresponding serversTransport object, and an error if there is any.
-func (c *FakeServersTransports) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ServersTransport, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(serverstransportsResource, c.ns, name), &v1alpha1.ServersTransport{})
-
-	if obj == nil {
-		return nil, err
+func newFakeServersTransports(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.ServersTransportInterface {
+	return &fakeServersTransports{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.ServersTransport, *v1alpha1.ServersTransportList, *traefikiov1alpha1.ServersTransportApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("serverstransports"),
+			v1alpha1.SchemeGroupVersion.WithKind("ServersTransport"),
+			func() *v1alpha1.ServersTransport { return &v1alpha1.ServersTransport{} },
+			func() *v1alpha1.ServersTransportList { return &v1alpha1.ServersTransportList{} },
+			func(dst, src *v1alpha1.ServersTransportList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.ServersTransportList) []*v1alpha1.ServersTransport {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.ServersTransportList, items []*v1alpha1.ServersTransport) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.ServersTransport), err
-}
-
-// List takes label and field selectors, and returns the list of ServersTransports that match those selectors.
-func (c *FakeServersTransports) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ServersTransportList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(serverstransportsResource, serverstransportsKind, c.ns, opts), &v1alpha1.ServersTransportList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.ServersTransportList{ListMeta: obj.(*v1alpha1.ServersTransportList).ListMeta}
-	for _, item := range obj.(*v1alpha1.ServersTransportList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested serversTransports.
-func (c *FakeServersTransports) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(serverstransportsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a serversTransport and creates it.  Returns the server's representation of the serversTransport, and an error, if there is any.
-func (c *FakeServersTransports) Create(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.CreateOptions) (result *v1alpha1.ServersTransport, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(serverstransportsResource, c.ns, serversTransport), &v1alpha1.ServersTransport{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransport), err
-}
-
-// Update takes the representation of a serversTransport and updates it. Returns the server's representation of the serversTransport, and an error, if there is any.
-func (c *FakeServersTransports) Update(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.UpdateOptions) (result *v1alpha1.ServersTransport, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(serverstransportsResource, c.ns, serversTransport), &v1alpha1.ServersTransport{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransport), err
-}
-
-// Delete takes name of the serversTransport and deletes it. Returns an error if one occurs.
-func (c *FakeServersTransports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(serverstransportsResource, c.ns, name, opts), &v1alpha1.ServersTransport{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeServersTransports) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(serverstransportsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.ServersTransportList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched serversTransport.
-func (c *FakeServersTransports) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransport, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(serverstransportsResource, c.ns, name, pt, data, subresources...), &v1alpha1.ServersTransport{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransport), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransporttcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransporttcp.go
index 878e2e5dd..484fcb03e 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransporttcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_serverstransporttcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeServersTransportTCPs implements ServersTransportTCPInterface
-type FakeServersTransportTCPs struct {
+// fakeServersTransportTCPs implements ServersTransportTCPInterface
+type fakeServersTransportTCPs struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.ServersTransportTCP, *v1alpha1.ServersTransportTCPList, *traefikiov1alpha1.ServersTransportTCPApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var serverstransporttcpsResource = v1alpha1.SchemeGroupVersion.WithResource("serverstransporttcps")
-
-var serverstransporttcpsKind = v1alpha1.SchemeGroupVersion.WithKind("ServersTransportTCP")
-
-// Get takes name of the serversTransportTCP, and returns the corresponding serversTransportTCP object, and an error if there is any.
-func (c *FakeServersTransportTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(serverstransporttcpsResource, c.ns, name), &v1alpha1.ServersTransportTCP{})
-
-	if obj == nil {
-		return nil, err
+func newFakeServersTransportTCPs(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.ServersTransportTCPInterface {
+	return &fakeServersTransportTCPs{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.ServersTransportTCP, *v1alpha1.ServersTransportTCPList, *traefikiov1alpha1.ServersTransportTCPApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("serverstransporttcps"),
+			v1alpha1.SchemeGroupVersion.WithKind("ServersTransportTCP"),
+			func() *v1alpha1.ServersTransportTCP { return &v1alpha1.ServersTransportTCP{} },
+			func() *v1alpha1.ServersTransportTCPList { return &v1alpha1.ServersTransportTCPList{} },
+			func(dst, src *v1alpha1.ServersTransportTCPList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.ServersTransportTCPList) []*v1alpha1.ServersTransportTCP {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.ServersTransportTCPList, items []*v1alpha1.ServersTransportTCP) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.ServersTransportTCP), err
-}
-
-// List takes label and field selectors, and returns the list of ServersTransportTCPs that match those selectors.
-func (c *FakeServersTransportTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ServersTransportTCPList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(serverstransporttcpsResource, serverstransporttcpsKind, c.ns, opts), &v1alpha1.ServersTransportTCPList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.ServersTransportTCPList{ListMeta: obj.(*v1alpha1.ServersTransportTCPList).ListMeta}
-	for _, item := range obj.(*v1alpha1.ServersTransportTCPList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested serversTransportTCPs.
-func (c *FakeServersTransportTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(serverstransporttcpsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a serversTransportTCP and creates it.  Returns the server's representation of the serversTransportTCP, and an error, if there is any.
-func (c *FakeServersTransportTCPs) Create(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.CreateOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(serverstransporttcpsResource, c.ns, serversTransportTCP), &v1alpha1.ServersTransportTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransportTCP), err
-}
-
-// Update takes the representation of a serversTransportTCP and updates it. Returns the server's representation of the serversTransportTCP, and an error, if there is any.
-func (c *FakeServersTransportTCPs) Update(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.UpdateOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(serverstransporttcpsResource, c.ns, serversTransportTCP), &v1alpha1.ServersTransportTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransportTCP), err
-}
-
-// Delete takes name of the serversTransportTCP and deletes it. Returns an error if one occurs.
-func (c *FakeServersTransportTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(serverstransporttcpsResource, c.ns, name, opts), &v1alpha1.ServersTransportTCP{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeServersTransportTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(serverstransporttcpsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.ServersTransportTCPList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched serversTransportTCP.
-func (c *FakeServersTransportTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransportTCP, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(serverstransporttcpsResource, c.ns, name, pt, data, subresources...), &v1alpha1.ServersTransportTCP{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.ServersTransportTCP), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsoption.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsoption.go
index be344614f..0bef0dde5 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsoption.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsoption.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,33 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeTLSOptions implements TLSOptionInterface
-type FakeTLSOptions struct {
+// fakeTLSOptions implements TLSOptionInterface
+type fakeTLSOptions struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.TLSOption, *v1alpha1.TLSOptionList, *traefikiov1alpha1.TLSOptionApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var tlsoptionsResource = v1alpha1.SchemeGroupVersion.WithResource("tlsoptions")
-
-var tlsoptionsKind = v1alpha1.SchemeGroupVersion.WithKind("TLSOption")
-
-// Get takes name of the tLSOption, and returns the corresponding tLSOption object, and an error if there is any.
-func (c *FakeTLSOptions) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TLSOption, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(tlsoptionsResource, c.ns, name), &v1alpha1.TLSOption{})
-
-	if obj == nil {
-		return nil, err
+func newFakeTLSOptions(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.TLSOptionInterface {
+	return &fakeTLSOptions{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.TLSOption, *v1alpha1.TLSOptionList, *traefikiov1alpha1.TLSOptionApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("tlsoptions"),
+			v1alpha1.SchemeGroupVersion.WithKind("TLSOption"),
+			func() *v1alpha1.TLSOption { return &v1alpha1.TLSOption{} },
+			func() *v1alpha1.TLSOptionList { return &v1alpha1.TLSOptionList{} },
+			func(dst, src *v1alpha1.TLSOptionList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.TLSOptionList) []*v1alpha1.TLSOption { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.TLSOptionList, items []*v1alpha1.TLSOption) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.TLSOption), err
-}
-
-// List takes label and field selectors, and returns the list of TLSOptions that match those selectors.
-func (c *FakeTLSOptions) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TLSOptionList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(tlsoptionsResource, tlsoptionsKind, c.ns, opts), &v1alpha1.TLSOptionList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.TLSOptionList{ListMeta: obj.(*v1alpha1.TLSOptionList).ListMeta}
-	for _, item := range obj.(*v1alpha1.TLSOptionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested tLSOptions.
-func (c *FakeTLSOptions) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(tlsoptionsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a tLSOption and creates it.  Returns the server's representation of the tLSOption, and an error, if there is any.
-func (c *FakeTLSOptions) Create(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.CreateOptions) (result *v1alpha1.TLSOption, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(tlsoptionsResource, c.ns, tLSOption), &v1alpha1.TLSOption{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSOption), err
-}
-
-// Update takes the representation of a tLSOption and updates it. Returns the server's representation of the tLSOption, and an error, if there is any.
-func (c *FakeTLSOptions) Update(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.UpdateOptions) (result *v1alpha1.TLSOption, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(tlsoptionsResource, c.ns, tLSOption), &v1alpha1.TLSOption{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSOption), err
-}
-
-// Delete takes name of the tLSOption and deletes it. Returns an error if one occurs.
-func (c *FakeTLSOptions) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(tlsoptionsResource, c.ns, name, opts), &v1alpha1.TLSOption{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeTLSOptions) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(tlsoptionsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.TLSOptionList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched tLSOption.
-func (c *FakeTLSOptions) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSOption, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(tlsoptionsResource, c.ns, name, pt, data, subresources...), &v1alpha1.TLSOption{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSOption), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsstore.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsstore.go
index a779aaa48..55abfda0d 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsstore.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_tlsstore.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,33 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeTLSStores implements TLSStoreInterface
-type FakeTLSStores struct {
+// fakeTLSStores implements TLSStoreInterface
+type fakeTLSStores struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.TLSStore, *v1alpha1.TLSStoreList, *traefikiov1alpha1.TLSStoreApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var tlsstoresResource = v1alpha1.SchemeGroupVersion.WithResource("tlsstores")
-
-var tlsstoresKind = v1alpha1.SchemeGroupVersion.WithKind("TLSStore")
-
-// Get takes name of the tLSStore, and returns the corresponding tLSStore object, and an error if there is any.
-func (c *FakeTLSStores) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TLSStore, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(tlsstoresResource, c.ns, name), &v1alpha1.TLSStore{})
-
-	if obj == nil {
-		return nil, err
+func newFakeTLSStores(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.TLSStoreInterface {
+	return &fakeTLSStores{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.TLSStore, *v1alpha1.TLSStoreList, *traefikiov1alpha1.TLSStoreApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("tlsstores"),
+			v1alpha1.SchemeGroupVersion.WithKind("TLSStore"),
+			func() *v1alpha1.TLSStore { return &v1alpha1.TLSStore{} },
+			func() *v1alpha1.TLSStoreList { return &v1alpha1.TLSStoreList{} },
+			func(dst, src *v1alpha1.TLSStoreList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.TLSStoreList) []*v1alpha1.TLSStore { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.TLSStoreList, items []*v1alpha1.TLSStore) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.TLSStore), err
-}
-
-// List takes label and field selectors, and returns the list of TLSStores that match those selectors.
-func (c *FakeTLSStores) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TLSStoreList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(tlsstoresResource, tlsstoresKind, c.ns, opts), &v1alpha1.TLSStoreList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.TLSStoreList{ListMeta: obj.(*v1alpha1.TLSStoreList).ListMeta}
-	for _, item := range obj.(*v1alpha1.TLSStoreList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested tLSStores.
-func (c *FakeTLSStores) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(tlsstoresResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a tLSStore and creates it.  Returns the server's representation of the tLSStore, and an error, if there is any.
-func (c *FakeTLSStores) Create(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.CreateOptions) (result *v1alpha1.TLSStore, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(tlsstoresResource, c.ns, tLSStore), &v1alpha1.TLSStore{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSStore), err
-}
-
-// Update takes the representation of a tLSStore and updates it. Returns the server's representation of the tLSStore, and an error, if there is any.
-func (c *FakeTLSStores) Update(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.UpdateOptions) (result *v1alpha1.TLSStore, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(tlsstoresResource, c.ns, tLSStore), &v1alpha1.TLSStore{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSStore), err
-}
-
-// Delete takes name of the tLSStore and deletes it. Returns an error if one occurs.
-func (c *FakeTLSStores) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(tlsstoresResource, c.ns, name, opts), &v1alpha1.TLSStore{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeTLSStores) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(tlsstoresResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.TLSStoreList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched tLSStore.
-func (c *FakeTLSStores) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSStore, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(tlsstoresResource, c.ns, name, pt, data, subresources...), &v1alpha1.TLSStore{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TLSStore), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikio_client.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikio_client.go
index 2d9b5bb91..fa3eab775 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikio_client.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikio_client.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -37,43 +37,43 @@ type FakeTraefikV1alpha1 struct {
 }
 
 func (c *FakeTraefikV1alpha1) IngressRoutes(namespace string) v1alpha1.IngressRouteInterface {
-	return &FakeIngressRoutes{c, namespace}
+	return newFakeIngressRoutes(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) IngressRouteTCPs(namespace string) v1alpha1.IngressRouteTCPInterface {
-	return &FakeIngressRouteTCPs{c, namespace}
+	return newFakeIngressRouteTCPs(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) IngressRouteUDPs(namespace string) v1alpha1.IngressRouteUDPInterface {
-	return &FakeIngressRouteUDPs{c, namespace}
+	return newFakeIngressRouteUDPs(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) Middlewares(namespace string) v1alpha1.MiddlewareInterface {
-	return &FakeMiddlewares{c, namespace}
+	return newFakeMiddlewares(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) MiddlewareTCPs(namespace string) v1alpha1.MiddlewareTCPInterface {
-	return &FakeMiddlewareTCPs{c, namespace}
+	return newFakeMiddlewareTCPs(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) ServersTransports(namespace string) v1alpha1.ServersTransportInterface {
-	return &FakeServersTransports{c, namespace}
+	return newFakeServersTransports(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) ServersTransportTCPs(namespace string) v1alpha1.ServersTransportTCPInterface {
-	return &FakeServersTransportTCPs{c, namespace}
+	return newFakeServersTransportTCPs(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) TLSOptions(namespace string) v1alpha1.TLSOptionInterface {
-	return &FakeTLSOptions{c, namespace}
+	return newFakeTLSOptions(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) TLSStores(namespace string) v1alpha1.TLSStoreInterface {
-	return &FakeTLSStores{c, namespace}
+	return newFakeTLSStores(c, namespace)
 }
 
 func (c *FakeTraefikV1alpha1) TraefikServices(namespace string) v1alpha1.TraefikServiceInterface {
-	return &FakeTraefikServices{c, namespace}
+	return newFakeTraefikServices(c, namespace)
 }
 
 // RESTClient returns a RESTClient that is used to communicate
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikservice.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikservice.go
index d5ad869fa..d9afee423 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikservice.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/fake/fake_traefikservice.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,111 +27,35 @@ THE SOFTWARE.
 package fake
 
 import (
-	"context"
-
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
+	typedtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1"
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
+	gentype "k8s.io/client-go/gentype"
 )
 
-// FakeTraefikServices implements TraefikServiceInterface
-type FakeTraefikServices struct {
+// fakeTraefikServices implements TraefikServiceInterface
+type fakeTraefikServices struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.TraefikService, *v1alpha1.TraefikServiceList, *traefikiov1alpha1.TraefikServiceApplyConfiguration]
 	Fake *FakeTraefikV1alpha1
-	ns   string
 }
 
-var traefikservicesResource = v1alpha1.SchemeGroupVersion.WithResource("traefikservices")
-
-var traefikservicesKind = v1alpha1.SchemeGroupVersion.WithKind("TraefikService")
-
-// Get takes name of the traefikService, and returns the corresponding traefikService object, and an error if there is any.
-func (c *FakeTraefikServices) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TraefikService, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(traefikservicesResource, c.ns, name), &v1alpha1.TraefikService{})
-
-	if obj == nil {
-		return nil, err
+func newFakeTraefikServices(fake *FakeTraefikV1alpha1, namespace string) typedtraefikiov1alpha1.TraefikServiceInterface {
+	return &fakeTraefikServices{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.TraefikService, *v1alpha1.TraefikServiceList, *traefikiov1alpha1.TraefikServiceApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("traefikservices"),
+			v1alpha1.SchemeGroupVersion.WithKind("TraefikService"),
+			func() *v1alpha1.TraefikService { return &v1alpha1.TraefikService{} },
+			func() *v1alpha1.TraefikServiceList { return &v1alpha1.TraefikServiceList{} },
+			func(dst, src *v1alpha1.TraefikServiceList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.TraefikServiceList) []*v1alpha1.TraefikService {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.TraefikServiceList, items []*v1alpha1.TraefikService) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
 	}
-	return obj.(*v1alpha1.TraefikService), err
-}
-
-// List takes label and field selectors, and returns the list of TraefikServices that match those selectors.
-func (c *FakeTraefikServices) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TraefikServiceList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(traefikservicesResource, traefikservicesKind, c.ns, opts), &v1alpha1.TraefikServiceList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1alpha1.TraefikServiceList{ListMeta: obj.(*v1alpha1.TraefikServiceList).ListMeta}
-	for _, item := range obj.(*v1alpha1.TraefikServiceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested traefikServices.
-func (c *FakeTraefikServices) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(traefikservicesResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a traefikService and creates it.  Returns the server's representation of the traefikService, and an error, if there is any.
-func (c *FakeTraefikServices) Create(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.CreateOptions) (result *v1alpha1.TraefikService, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(traefikservicesResource, c.ns, traefikService), &v1alpha1.TraefikService{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TraefikService), err
-}
-
-// Update takes the representation of a traefikService and updates it. Returns the server's representation of the traefikService, and an error, if there is any.
-func (c *FakeTraefikServices) Update(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.UpdateOptions) (result *v1alpha1.TraefikService, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(traefikservicesResource, c.ns, traefikService), &v1alpha1.TraefikService{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TraefikService), err
-}
-
-// Delete takes name of the traefikService and deletes it. Returns an error if one occurs.
-func (c *FakeTraefikServices) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(traefikservicesResource, c.ns, name, opts), &v1alpha1.TraefikService{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakeTraefikServices) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(traefikservicesResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1alpha1.TraefikServiceList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched traefikService.
-func (c *FakeTraefikServices) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TraefikService, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(traefikservicesResource, c.ns, name, pt, data, subresources...), &v1alpha1.TraefikService{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1alpha1.TraefikService), err
 }
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/generated_expansion.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/generated_expansion.go
index 0de236543..527010c45 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/generated_expansion.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/generated_expansion.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroute.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroute.go
index 7370d551f..66cd158a0 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroute.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroute.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // IngressRoutesGetter has a method to return a IngressRouteInterface.
@@ -46,141 +46,33 @@ type IngressRoutesGetter interface {
 
 // IngressRouteInterface has methods to work with IngressRoute resources.
 type IngressRouteInterface interface {
-	Create(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.CreateOptions) (*v1alpha1.IngressRoute, error)
-	Update(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.UpdateOptions) (*v1alpha1.IngressRoute, error)
+	Create(ctx context.Context, ingressRoute *traefikiov1alpha1.IngressRoute, opts v1.CreateOptions) (*traefikiov1alpha1.IngressRoute, error)
+	Update(ctx context.Context, ingressRoute *traefikiov1alpha1.IngressRoute, opts v1.UpdateOptions) (*traefikiov1alpha1.IngressRoute, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.IngressRoute, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.IngressRouteList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.IngressRoute, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.IngressRouteList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRoute, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.IngressRoute, err error)
+	Apply(ctx context.Context, ingressRoute *applyconfigurationtraefikiov1alpha1.IngressRouteApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.IngressRoute, err error)
 	IngressRouteExpansion
 }
 
 // ingressRoutes implements IngressRouteInterface
 type ingressRoutes struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.IngressRoute, *traefikiov1alpha1.IngressRouteList, *applyconfigurationtraefikiov1alpha1.IngressRouteApplyConfiguration]
 }
 
 // newIngressRoutes returns a IngressRoutes
 func newIngressRoutes(c *TraefikV1alpha1Client, namespace string) *ingressRoutes {
 	return &ingressRoutes{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.IngressRoute, *traefikiov1alpha1.IngressRouteList, *applyconfigurationtraefikiov1alpha1.IngressRouteApplyConfiguration](
+			"ingressroutes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.IngressRoute { return &traefikiov1alpha1.IngressRoute{} },
+			func() *traefikiov1alpha1.IngressRouteList { return &traefikiov1alpha1.IngressRouteList{} },
+		),
 	}
 }
-
-// Get takes name of the ingressRoute, and returns the corresponding ingressRoute object, and an error if there is any.
-func (c *ingressRoutes) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRoute, err error) {
-	result = &v1alpha1.IngressRoute{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of IngressRoutes that match those selectors.
-func (c *ingressRoutes) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.IngressRouteList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRoutes.
-func (c *ingressRoutes) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a ingressRoute and creates it.  Returns the server's representation of the ingressRoute, and an error, if there is any.
-func (c *ingressRoutes) Create(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.CreateOptions) (result *v1alpha1.IngressRoute, err error) {
-	result = &v1alpha1.IngressRoute{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRoute).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a ingressRoute and updates it. Returns the server's representation of the ingressRoute, and an error, if there is any.
-func (c *ingressRoutes) Update(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, opts v1.UpdateOptions) (result *v1alpha1.IngressRoute, err error) {
-	result = &v1alpha1.IngressRoute{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		Name(ingressRoute.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRoute).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the ingressRoute and deletes it. Returns an error if one occurs.
-func (c *ingressRoutes) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *ingressRoutes) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched ingressRoute.
-func (c *ingressRoutes) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRoute, err error) {
-	result = &v1alpha1.IngressRoute{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("ingressroutes").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroutetcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroutetcp.go
index 7255228fe..7449553cc 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroutetcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressroutetcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // IngressRouteTCPsGetter has a method to return a IngressRouteTCPInterface.
@@ -46,141 +46,33 @@ type IngressRouteTCPsGetter interface {
 
 // IngressRouteTCPInterface has methods to work with IngressRouteTCP resources.
 type IngressRouteTCPInterface interface {
-	Create(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.CreateOptions) (*v1alpha1.IngressRouteTCP, error)
-	Update(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.UpdateOptions) (*v1alpha1.IngressRouteTCP, error)
+	Create(ctx context.Context, ingressRouteTCP *traefikiov1alpha1.IngressRouteTCP, opts v1.CreateOptions) (*traefikiov1alpha1.IngressRouteTCP, error)
+	Update(ctx context.Context, ingressRouteTCP *traefikiov1alpha1.IngressRouteTCP, opts v1.UpdateOptions) (*traefikiov1alpha1.IngressRouteTCP, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.IngressRouteTCP, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.IngressRouteTCPList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.IngressRouteTCP, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.IngressRouteTCPList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteTCP, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.IngressRouteTCP, err error)
+	Apply(ctx context.Context, ingressRouteTCP *applyconfigurationtraefikiov1alpha1.IngressRouteTCPApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.IngressRouteTCP, err error)
 	IngressRouteTCPExpansion
 }
 
 // ingressRouteTCPs implements IngressRouteTCPInterface
 type ingressRouteTCPs struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.IngressRouteTCP, *traefikiov1alpha1.IngressRouteTCPList, *applyconfigurationtraefikiov1alpha1.IngressRouteTCPApplyConfiguration]
 }
 
 // newIngressRouteTCPs returns a IngressRouteTCPs
 func newIngressRouteTCPs(c *TraefikV1alpha1Client, namespace string) *ingressRouteTCPs {
 	return &ingressRouteTCPs{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.IngressRouteTCP, *traefikiov1alpha1.IngressRouteTCPList, *applyconfigurationtraefikiov1alpha1.IngressRouteTCPApplyConfiguration](
+			"ingressroutetcps",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.IngressRouteTCP { return &traefikiov1alpha1.IngressRouteTCP{} },
+			func() *traefikiov1alpha1.IngressRouteTCPList { return &traefikiov1alpha1.IngressRouteTCPList{} },
+		),
 	}
 }
-
-// Get takes name of the ingressRouteTCP, and returns the corresponding ingressRouteTCP object, and an error if there is any.
-func (c *ingressRouteTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	result = &v1alpha1.IngressRouteTCP{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of IngressRouteTCPs that match those selectors.
-func (c *ingressRouteTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteTCPList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.IngressRouteTCPList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRouteTCPs.
-func (c *ingressRouteTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a ingressRouteTCP and creates it.  Returns the server's representation of the ingressRouteTCP, and an error, if there is any.
-func (c *ingressRouteTCPs) Create(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.CreateOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	result = &v1alpha1.IngressRouteTCP{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRouteTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a ingressRouteTCP and updates it. Returns the server's representation of the ingressRouteTCP, and an error, if there is any.
-func (c *ingressRouteTCPs) Update(ctx context.Context, ingressRouteTCP *v1alpha1.IngressRouteTCP, opts v1.UpdateOptions) (result *v1alpha1.IngressRouteTCP, err error) {
-	result = &v1alpha1.IngressRouteTCP{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		Name(ingressRouteTCP.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRouteTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the ingressRouteTCP and deletes it. Returns an error if one occurs.
-func (c *ingressRouteTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *ingressRouteTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched ingressRouteTCP.
-func (c *ingressRouteTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteTCP, err error) {
-	result = &v1alpha1.IngressRouteTCP{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("ingressroutetcps").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressrouteudp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressrouteudp.go
index 1b267886a..183791e17 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressrouteudp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/ingressrouteudp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // IngressRouteUDPsGetter has a method to return a IngressRouteUDPInterface.
@@ -46,141 +46,33 @@ type IngressRouteUDPsGetter interface {
 
 // IngressRouteUDPInterface has methods to work with IngressRouteUDP resources.
 type IngressRouteUDPInterface interface {
-	Create(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.CreateOptions) (*v1alpha1.IngressRouteUDP, error)
-	Update(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.UpdateOptions) (*v1alpha1.IngressRouteUDP, error)
+	Create(ctx context.Context, ingressRouteUDP *traefikiov1alpha1.IngressRouteUDP, opts v1.CreateOptions) (*traefikiov1alpha1.IngressRouteUDP, error)
+	Update(ctx context.Context, ingressRouteUDP *traefikiov1alpha1.IngressRouteUDP, opts v1.UpdateOptions) (*traefikiov1alpha1.IngressRouteUDP, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.IngressRouteUDP, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.IngressRouteUDPList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.IngressRouteUDP, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.IngressRouteUDPList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteUDP, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.IngressRouteUDP, err error)
+	Apply(ctx context.Context, ingressRouteUDP *applyconfigurationtraefikiov1alpha1.IngressRouteUDPApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.IngressRouteUDP, err error)
 	IngressRouteUDPExpansion
 }
 
 // ingressRouteUDPs implements IngressRouteUDPInterface
 type ingressRouteUDPs struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.IngressRouteUDP, *traefikiov1alpha1.IngressRouteUDPList, *applyconfigurationtraefikiov1alpha1.IngressRouteUDPApplyConfiguration]
 }
 
 // newIngressRouteUDPs returns a IngressRouteUDPs
 func newIngressRouteUDPs(c *TraefikV1alpha1Client, namespace string) *ingressRouteUDPs {
 	return &ingressRouteUDPs{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.IngressRouteUDP, *traefikiov1alpha1.IngressRouteUDPList, *applyconfigurationtraefikiov1alpha1.IngressRouteUDPApplyConfiguration](
+			"ingressrouteudps",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.IngressRouteUDP { return &traefikiov1alpha1.IngressRouteUDP{} },
+			func() *traefikiov1alpha1.IngressRouteUDPList { return &traefikiov1alpha1.IngressRouteUDPList{} },
+		),
 	}
 }
-
-// Get takes name of the ingressRouteUDP, and returns the corresponding ingressRouteUDP object, and an error if there is any.
-func (c *ingressRouteUDPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	result = &v1alpha1.IngressRouteUDP{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of IngressRouteUDPs that match those selectors.
-func (c *ingressRouteUDPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.IngressRouteUDPList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.IngressRouteUDPList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested ingressRouteUDPs.
-func (c *ingressRouteUDPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a ingressRouteUDP and creates it.  Returns the server's representation of the ingressRouteUDP, and an error, if there is any.
-func (c *ingressRouteUDPs) Create(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.CreateOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	result = &v1alpha1.IngressRouteUDP{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRouteUDP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a ingressRouteUDP and updates it. Returns the server's representation of the ingressRouteUDP, and an error, if there is any.
-func (c *ingressRouteUDPs) Update(ctx context.Context, ingressRouteUDP *v1alpha1.IngressRouteUDP, opts v1.UpdateOptions) (result *v1alpha1.IngressRouteUDP, err error) {
-	result = &v1alpha1.IngressRouteUDP{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		Name(ingressRouteUDP.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(ingressRouteUDP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the ingressRouteUDP and deletes it. Returns an error if one occurs.
-func (c *ingressRouteUDPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *ingressRouteUDPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched ingressRouteUDP.
-func (c *ingressRouteUDPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.IngressRouteUDP, err error) {
-	result = &v1alpha1.IngressRouteUDP{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("ingressrouteudps").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middleware.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middleware.go
index a4c743c28..330286151 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middleware.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middleware.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // MiddlewaresGetter has a method to return a MiddlewareInterface.
@@ -46,141 +46,33 @@ type MiddlewaresGetter interface {
 
 // MiddlewareInterface has methods to work with Middleware resources.
 type MiddlewareInterface interface {
-	Create(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.CreateOptions) (*v1alpha1.Middleware, error)
-	Update(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.UpdateOptions) (*v1alpha1.Middleware, error)
+	Create(ctx context.Context, middleware *traefikiov1alpha1.Middleware, opts v1.CreateOptions) (*traefikiov1alpha1.Middleware, error)
+	Update(ctx context.Context, middleware *traefikiov1alpha1.Middleware, opts v1.UpdateOptions) (*traefikiov1alpha1.Middleware, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.Middleware, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.MiddlewareList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.Middleware, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.MiddlewareList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.Middleware, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.Middleware, err error)
+	Apply(ctx context.Context, middleware *applyconfigurationtraefikiov1alpha1.MiddlewareApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.Middleware, err error)
 	MiddlewareExpansion
 }
 
 // middlewares implements MiddlewareInterface
 type middlewares struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.Middleware, *traefikiov1alpha1.MiddlewareList, *applyconfigurationtraefikiov1alpha1.MiddlewareApplyConfiguration]
 }
 
 // newMiddlewares returns a Middlewares
 func newMiddlewares(c *TraefikV1alpha1Client, namespace string) *middlewares {
 	return &middlewares{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.Middleware, *traefikiov1alpha1.MiddlewareList, *applyconfigurationtraefikiov1alpha1.MiddlewareApplyConfiguration](
+			"middlewares",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.Middleware { return &traefikiov1alpha1.Middleware{} },
+			func() *traefikiov1alpha1.MiddlewareList { return &traefikiov1alpha1.MiddlewareList{} },
+		),
 	}
 }
-
-// Get takes name of the middleware, and returns the corresponding middleware object, and an error if there is any.
-func (c *middlewares) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.Middleware, err error) {
-	result = &v1alpha1.Middleware{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewares").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of Middlewares that match those selectors.
-func (c *middlewares) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.MiddlewareList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.MiddlewareList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewares").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested middlewares.
-func (c *middlewares) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewares").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a middleware and creates it.  Returns the server's representation of the middleware, and an error, if there is any.
-func (c *middlewares) Create(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.CreateOptions) (result *v1alpha1.Middleware, err error) {
-	result = &v1alpha1.Middleware{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("middlewares").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(middleware).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a middleware and updates it. Returns the server's representation of the middleware, and an error, if there is any.
-func (c *middlewares) Update(ctx context.Context, middleware *v1alpha1.Middleware, opts v1.UpdateOptions) (result *v1alpha1.Middleware, err error) {
-	result = &v1alpha1.Middleware{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("middlewares").
-		Name(middleware.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(middleware).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the middleware and deletes it. Returns an error if one occurs.
-func (c *middlewares) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("middlewares").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *middlewares) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("middlewares").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched middleware.
-func (c *middlewares) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.Middleware, err error) {
-	result = &v1alpha1.Middleware{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("middlewares").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middlewaretcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middlewaretcp.go
index 29e2901ab..534a57ff1 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middlewaretcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/middlewaretcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // MiddlewareTCPsGetter has a method to return a MiddlewareTCPInterface.
@@ -46,141 +46,33 @@ type MiddlewareTCPsGetter interface {
 
 // MiddlewareTCPInterface has methods to work with MiddlewareTCP resources.
 type MiddlewareTCPInterface interface {
-	Create(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.CreateOptions) (*v1alpha1.MiddlewareTCP, error)
-	Update(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.UpdateOptions) (*v1alpha1.MiddlewareTCP, error)
+	Create(ctx context.Context, middlewareTCP *traefikiov1alpha1.MiddlewareTCP, opts v1.CreateOptions) (*traefikiov1alpha1.MiddlewareTCP, error)
+	Update(ctx context.Context, middlewareTCP *traefikiov1alpha1.MiddlewareTCP, opts v1.UpdateOptions) (*traefikiov1alpha1.MiddlewareTCP, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.MiddlewareTCP, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.MiddlewareTCPList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.MiddlewareTCP, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.MiddlewareTCPList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.MiddlewareTCP, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.MiddlewareTCP, err error)
+	Apply(ctx context.Context, middlewareTCP *applyconfigurationtraefikiov1alpha1.MiddlewareTCPApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.MiddlewareTCP, err error)
 	MiddlewareTCPExpansion
 }
 
 // middlewareTCPs implements MiddlewareTCPInterface
 type middlewareTCPs struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.MiddlewareTCP, *traefikiov1alpha1.MiddlewareTCPList, *applyconfigurationtraefikiov1alpha1.MiddlewareTCPApplyConfiguration]
 }
 
 // newMiddlewareTCPs returns a MiddlewareTCPs
 func newMiddlewareTCPs(c *TraefikV1alpha1Client, namespace string) *middlewareTCPs {
 	return &middlewareTCPs{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.MiddlewareTCP, *traefikiov1alpha1.MiddlewareTCPList, *applyconfigurationtraefikiov1alpha1.MiddlewareTCPApplyConfiguration](
+			"middlewaretcps",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.MiddlewareTCP { return &traefikiov1alpha1.MiddlewareTCP{} },
+			func() *traefikiov1alpha1.MiddlewareTCPList { return &traefikiov1alpha1.MiddlewareTCPList{} },
+		),
 	}
 }
-
-// Get takes name of the middlewareTCP, and returns the corresponding middlewareTCP object, and an error if there is any.
-func (c *middlewareTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	result = &v1alpha1.MiddlewareTCP{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of MiddlewareTCPs that match those selectors.
-func (c *middlewareTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.MiddlewareTCPList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.MiddlewareTCPList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested middlewareTCPs.
-func (c *middlewareTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a middlewareTCP and creates it.  Returns the server's representation of the middlewareTCP, and an error, if there is any.
-func (c *middlewareTCPs) Create(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.CreateOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	result = &v1alpha1.MiddlewareTCP{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(middlewareTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a middlewareTCP and updates it. Returns the server's representation of the middlewareTCP, and an error, if there is any.
-func (c *middlewareTCPs) Update(ctx context.Context, middlewareTCP *v1alpha1.MiddlewareTCP, opts v1.UpdateOptions) (result *v1alpha1.MiddlewareTCP, err error) {
-	result = &v1alpha1.MiddlewareTCP{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		Name(middlewareTCP.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(middlewareTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the middlewareTCP and deletes it. Returns an error if one occurs.
-func (c *middlewareTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *middlewareTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched middlewareTCP.
-func (c *middlewareTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.MiddlewareTCP, err error) {
-	result = &v1alpha1.MiddlewareTCP{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("middlewaretcps").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransport.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransport.go
index 3a267692d..187bb801f 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransport.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransport.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // ServersTransportsGetter has a method to return a ServersTransportInterface.
@@ -46,141 +46,33 @@ type ServersTransportsGetter interface {
 
 // ServersTransportInterface has methods to work with ServersTransport resources.
 type ServersTransportInterface interface {
-	Create(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.CreateOptions) (*v1alpha1.ServersTransport, error)
-	Update(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.UpdateOptions) (*v1alpha1.ServersTransport, error)
+	Create(ctx context.Context, serversTransport *traefikiov1alpha1.ServersTransport, opts v1.CreateOptions) (*traefikiov1alpha1.ServersTransport, error)
+	Update(ctx context.Context, serversTransport *traefikiov1alpha1.ServersTransport, opts v1.UpdateOptions) (*traefikiov1alpha1.ServersTransport, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.ServersTransport, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.ServersTransportList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.ServersTransport, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.ServersTransportList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransport, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.ServersTransport, err error)
+	Apply(ctx context.Context, serversTransport *applyconfigurationtraefikiov1alpha1.ServersTransportApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.ServersTransport, err error)
 	ServersTransportExpansion
 }
 
 // serversTransports implements ServersTransportInterface
 type serversTransports struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.ServersTransport, *traefikiov1alpha1.ServersTransportList, *applyconfigurationtraefikiov1alpha1.ServersTransportApplyConfiguration]
 }
 
 // newServersTransports returns a ServersTransports
 func newServersTransports(c *TraefikV1alpha1Client, namespace string) *serversTransports {
 	return &serversTransports{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.ServersTransport, *traefikiov1alpha1.ServersTransportList, *applyconfigurationtraefikiov1alpha1.ServersTransportApplyConfiguration](
+			"serverstransports",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.ServersTransport { return &traefikiov1alpha1.ServersTransport{} },
+			func() *traefikiov1alpha1.ServersTransportList { return &traefikiov1alpha1.ServersTransportList{} },
+		),
 	}
 }
-
-// Get takes name of the serversTransport, and returns the corresponding serversTransport object, and an error if there is any.
-func (c *serversTransports) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ServersTransport, err error) {
-	result = &v1alpha1.ServersTransport{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of ServersTransports that match those selectors.
-func (c *serversTransports) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ServersTransportList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.ServersTransportList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested serversTransports.
-func (c *serversTransports) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a serversTransport and creates it.  Returns the server's representation of the serversTransport, and an error, if there is any.
-func (c *serversTransports) Create(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.CreateOptions) (result *v1alpha1.ServersTransport, err error) {
-	result = &v1alpha1.ServersTransport{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(serversTransport).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a serversTransport and updates it. Returns the server's representation of the serversTransport, and an error, if there is any.
-func (c *serversTransports) Update(ctx context.Context, serversTransport *v1alpha1.ServersTransport, opts v1.UpdateOptions) (result *v1alpha1.ServersTransport, err error) {
-	result = &v1alpha1.ServersTransport{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		Name(serversTransport.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(serversTransport).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the serversTransport and deletes it. Returns an error if one occurs.
-func (c *serversTransports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *serversTransports) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("serverstransports").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched serversTransport.
-func (c *serversTransports) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransport, err error) {
-	result = &v1alpha1.ServersTransport{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("serverstransports").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransporttcp.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransporttcp.go
index 4dd49721d..f9b56fb3a 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransporttcp.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/serverstransporttcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // ServersTransportTCPsGetter has a method to return a ServersTransportTCPInterface.
@@ -46,141 +46,33 @@ type ServersTransportTCPsGetter interface {
 
 // ServersTransportTCPInterface has methods to work with ServersTransportTCP resources.
 type ServersTransportTCPInterface interface {
-	Create(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.CreateOptions) (*v1alpha1.ServersTransportTCP, error)
-	Update(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.UpdateOptions) (*v1alpha1.ServersTransportTCP, error)
+	Create(ctx context.Context, serversTransportTCP *traefikiov1alpha1.ServersTransportTCP, opts v1.CreateOptions) (*traefikiov1alpha1.ServersTransportTCP, error)
+	Update(ctx context.Context, serversTransportTCP *traefikiov1alpha1.ServersTransportTCP, opts v1.UpdateOptions) (*traefikiov1alpha1.ServersTransportTCP, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.ServersTransportTCP, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.ServersTransportTCPList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.ServersTransportTCP, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.ServersTransportTCPList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransportTCP, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.ServersTransportTCP, err error)
+	Apply(ctx context.Context, serversTransportTCP *applyconfigurationtraefikiov1alpha1.ServersTransportTCPApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.ServersTransportTCP, err error)
 	ServersTransportTCPExpansion
 }
 
 // serversTransportTCPs implements ServersTransportTCPInterface
 type serversTransportTCPs struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.ServersTransportTCP, *traefikiov1alpha1.ServersTransportTCPList, *applyconfigurationtraefikiov1alpha1.ServersTransportTCPApplyConfiguration]
 }
 
 // newServersTransportTCPs returns a ServersTransportTCPs
 func newServersTransportTCPs(c *TraefikV1alpha1Client, namespace string) *serversTransportTCPs {
 	return &serversTransportTCPs{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.ServersTransportTCP, *traefikiov1alpha1.ServersTransportTCPList, *applyconfigurationtraefikiov1alpha1.ServersTransportTCPApplyConfiguration](
+			"serverstransporttcps",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.ServersTransportTCP { return &traefikiov1alpha1.ServersTransportTCP{} },
+			func() *traefikiov1alpha1.ServersTransportTCPList { return &traefikiov1alpha1.ServersTransportTCPList{} },
+		),
 	}
 }
-
-// Get takes name of the serversTransportTCP, and returns the corresponding serversTransportTCP object, and an error if there is any.
-func (c *serversTransportTCPs) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	result = &v1alpha1.ServersTransportTCP{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of ServersTransportTCPs that match those selectors.
-func (c *serversTransportTCPs) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ServersTransportTCPList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.ServersTransportTCPList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested serversTransportTCPs.
-func (c *serversTransportTCPs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a serversTransportTCP and creates it.  Returns the server's representation of the serversTransportTCP, and an error, if there is any.
-func (c *serversTransportTCPs) Create(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.CreateOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	result = &v1alpha1.ServersTransportTCP{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(serversTransportTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a serversTransportTCP and updates it. Returns the server's representation of the serversTransportTCP, and an error, if there is any.
-func (c *serversTransportTCPs) Update(ctx context.Context, serversTransportTCP *v1alpha1.ServersTransportTCP, opts v1.UpdateOptions) (result *v1alpha1.ServersTransportTCP, err error) {
-	result = &v1alpha1.ServersTransportTCP{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		Name(serversTransportTCP.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(serversTransportTCP).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the serversTransportTCP and deletes it. Returns an error if one occurs.
-func (c *serversTransportTCPs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *serversTransportTCPs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched serversTransportTCP.
-func (c *serversTransportTCPs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ServersTransportTCP, err error) {
-	result = &v1alpha1.ServersTransportTCP{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("serverstransporttcps").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsoption.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsoption.go
index 3f1dfb6b0..6f7842f53 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsoption.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsoption.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // TLSOptionsGetter has a method to return a TLSOptionInterface.
@@ -46,141 +46,33 @@ type TLSOptionsGetter interface {
 
 // TLSOptionInterface has methods to work with TLSOption resources.
 type TLSOptionInterface interface {
-	Create(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.CreateOptions) (*v1alpha1.TLSOption, error)
-	Update(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.UpdateOptions) (*v1alpha1.TLSOption, error)
+	Create(ctx context.Context, tLSOption *traefikiov1alpha1.TLSOption, opts v1.CreateOptions) (*traefikiov1alpha1.TLSOption, error)
+	Update(ctx context.Context, tLSOption *traefikiov1alpha1.TLSOption, opts v1.UpdateOptions) (*traefikiov1alpha1.TLSOption, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.TLSOption, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.TLSOptionList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.TLSOption, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.TLSOptionList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSOption, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.TLSOption, err error)
+	Apply(ctx context.Context, tLSOption *applyconfigurationtraefikiov1alpha1.TLSOptionApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.TLSOption, err error)
 	TLSOptionExpansion
 }
 
 // tLSOptions implements TLSOptionInterface
 type tLSOptions struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.TLSOption, *traefikiov1alpha1.TLSOptionList, *applyconfigurationtraefikiov1alpha1.TLSOptionApplyConfiguration]
 }
 
 // newTLSOptions returns a TLSOptions
 func newTLSOptions(c *TraefikV1alpha1Client, namespace string) *tLSOptions {
 	return &tLSOptions{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.TLSOption, *traefikiov1alpha1.TLSOptionList, *applyconfigurationtraefikiov1alpha1.TLSOptionApplyConfiguration](
+			"tlsoptions",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.TLSOption { return &traefikiov1alpha1.TLSOption{} },
+			func() *traefikiov1alpha1.TLSOptionList { return &traefikiov1alpha1.TLSOptionList{} },
+		),
 	}
 }
-
-// Get takes name of the tLSOption, and returns the corresponding tLSOption object, and an error if there is any.
-func (c *tLSOptions) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TLSOption, err error) {
-	result = &v1alpha1.TLSOption{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of TLSOptions that match those selectors.
-func (c *tLSOptions) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TLSOptionList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.TLSOptionList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested tLSOptions.
-func (c *tLSOptions) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a tLSOption and creates it.  Returns the server's representation of the tLSOption, and an error, if there is any.
-func (c *tLSOptions) Create(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.CreateOptions) (result *v1alpha1.TLSOption, err error) {
-	result = &v1alpha1.TLSOption{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(tLSOption).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a tLSOption and updates it. Returns the server's representation of the tLSOption, and an error, if there is any.
-func (c *tLSOptions) Update(ctx context.Context, tLSOption *v1alpha1.TLSOption, opts v1.UpdateOptions) (result *v1alpha1.TLSOption, err error) {
-	result = &v1alpha1.TLSOption{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		Name(tLSOption.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(tLSOption).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the tLSOption and deletes it. Returns an error if one occurs.
-func (c *tLSOptions) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *tLSOptions) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched tLSOption.
-func (c *tLSOptions) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSOption, err error) {
-	result = &v1alpha1.TLSOption{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("tlsoptions").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsstore.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsstore.go
index 3756b990a..de517efdb 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsstore.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/tlsstore.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // TLSStoresGetter has a method to return a TLSStoreInterface.
@@ -46,141 +46,33 @@ type TLSStoresGetter interface {
 
 // TLSStoreInterface has methods to work with TLSStore resources.
 type TLSStoreInterface interface {
-	Create(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.CreateOptions) (*v1alpha1.TLSStore, error)
-	Update(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.UpdateOptions) (*v1alpha1.TLSStore, error)
+	Create(ctx context.Context, tLSStore *traefikiov1alpha1.TLSStore, opts v1.CreateOptions) (*traefikiov1alpha1.TLSStore, error)
+	Update(ctx context.Context, tLSStore *traefikiov1alpha1.TLSStore, opts v1.UpdateOptions) (*traefikiov1alpha1.TLSStore, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.TLSStore, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.TLSStoreList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.TLSStore, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.TLSStoreList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSStore, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.TLSStore, err error)
+	Apply(ctx context.Context, tLSStore *applyconfigurationtraefikiov1alpha1.TLSStoreApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.TLSStore, err error)
 	TLSStoreExpansion
 }
 
 // tLSStores implements TLSStoreInterface
 type tLSStores struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.TLSStore, *traefikiov1alpha1.TLSStoreList, *applyconfigurationtraefikiov1alpha1.TLSStoreApplyConfiguration]
 }
 
 // newTLSStores returns a TLSStores
 func newTLSStores(c *TraefikV1alpha1Client, namespace string) *tLSStores {
 	return &tLSStores{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.TLSStore, *traefikiov1alpha1.TLSStoreList, *applyconfigurationtraefikiov1alpha1.TLSStoreApplyConfiguration](
+			"tlsstores",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.TLSStore { return &traefikiov1alpha1.TLSStore{} },
+			func() *traefikiov1alpha1.TLSStoreList { return &traefikiov1alpha1.TLSStoreList{} },
+		),
 	}
 }
-
-// Get takes name of the tLSStore, and returns the corresponding tLSStore object, and an error if there is any.
-func (c *tLSStores) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TLSStore, err error) {
-	result = &v1alpha1.TLSStore{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of TLSStores that match those selectors.
-func (c *tLSStores) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TLSStoreList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.TLSStoreList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested tLSStores.
-func (c *tLSStores) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a tLSStore and creates it.  Returns the server's representation of the tLSStore, and an error, if there is any.
-func (c *tLSStores) Create(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.CreateOptions) (result *v1alpha1.TLSStore, err error) {
-	result = &v1alpha1.TLSStore{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(tLSStore).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a tLSStore and updates it. Returns the server's representation of the tLSStore, and an error, if there is any.
-func (c *tLSStores) Update(ctx context.Context, tLSStore *v1alpha1.TLSStore, opts v1.UpdateOptions) (result *v1alpha1.TLSStore, err error) {
-	result = &v1alpha1.TLSStore{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		Name(tLSStore.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(tLSStore).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the tLSStore and deletes it. Returns an error if one occurs.
-func (c *tLSStores) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *tLSStores) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("tlsstores").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched tLSStore.
-func (c *tLSStores) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TLSStore, err error) {
-	result = &v1alpha1.TLSStore{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("tlsstores").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikio_client.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikio_client.go
index e0162c6df..e5c964747 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikio_client.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikio_client.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
 
-	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	rest "k8s.io/client-go/rest"
 )
 
@@ -98,9 +98,7 @@ func (c *TraefikV1alpha1Client) TraefikServices(namespace string) TraefikService
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*TraefikV1alpha1Client, error) {
 	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
+	setConfigDefaults(&config)
 	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
@@ -112,9 +110,7 @@ func NewForConfig(c *rest.Config) (*TraefikV1alpha1Client, error) {
 // Note the http client provided takes precedence over the configured transport values.
 func NewForConfigAndClient(c *rest.Config, h *http.Client) (*TraefikV1alpha1Client, error) {
 	config := *c
-	if err := setConfigDefaults(&config); err != nil {
-		return nil, err
-	}
+	setConfigDefaults(&config)
 	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
@@ -137,17 +133,15 @@ func New(c rest.Interface) *TraefikV1alpha1Client {
 	return &TraefikV1alpha1Client{c}
 }
 
-func setConfigDefaults(config *rest.Config) error {
-	gv := v1alpha1.SchemeGroupVersion
+func setConfigDefaults(config *rest.Config) {
+	gv := traefikiov1alpha1.SchemeGroupVersion
 	config.GroupVersion = &gv
 	config.APIPath = "/apis"
-	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
 
 	if config.UserAgent == "" {
 		config.UserAgent = rest.DefaultKubernetesUserAgent()
 	}
-
-	return nil
 }
 
 // RESTClient returns a RESTClient that is used to communicate
diff --git a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikservice.go b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikservice.go
index 84a56cd6b..1bc07d33e 100644
--- a/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikservice.go
+++ b/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefikio/v1alpha1/traefikservice.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,15 +27,15 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
 
+	applyconfigurationtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/applyconfiguration/traefikio/v1alpha1"
 	scheme "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
+	gentype "k8s.io/client-go/gentype"
 )
 
 // TraefikServicesGetter has a method to return a TraefikServiceInterface.
@@ -46,141 +46,33 @@ type TraefikServicesGetter interface {
 
 // TraefikServiceInterface has methods to work with TraefikService resources.
 type TraefikServiceInterface interface {
-	Create(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.CreateOptions) (*v1alpha1.TraefikService, error)
-	Update(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.UpdateOptions) (*v1alpha1.TraefikService, error)
+	Create(ctx context.Context, traefikService *traefikiov1alpha1.TraefikService, opts v1.CreateOptions) (*traefikiov1alpha1.TraefikService, error)
+	Update(ctx context.Context, traefikService *traefikiov1alpha1.TraefikService, opts v1.UpdateOptions) (*traefikiov1alpha1.TraefikService, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.TraefikService, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.TraefikServiceList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*traefikiov1alpha1.TraefikService, error)
+	List(ctx context.Context, opts v1.ListOptions) (*traefikiov1alpha1.TraefikServiceList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TraefikService, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *traefikiov1alpha1.TraefikService, err error)
+	Apply(ctx context.Context, traefikService *applyconfigurationtraefikiov1alpha1.TraefikServiceApplyConfiguration, opts v1.ApplyOptions) (result *traefikiov1alpha1.TraefikService, err error)
 	TraefikServiceExpansion
 }
 
 // traefikServices implements TraefikServiceInterface
 type traefikServices struct {
-	client rest.Interface
-	ns     string
+	*gentype.ClientWithListAndApply[*traefikiov1alpha1.TraefikService, *traefikiov1alpha1.TraefikServiceList, *applyconfigurationtraefikiov1alpha1.TraefikServiceApplyConfiguration]
 }
 
 // newTraefikServices returns a TraefikServices
 func newTraefikServices(c *TraefikV1alpha1Client, namespace string) *traefikServices {
 	return &traefikServices{
-		client: c.RESTClient(),
-		ns:     namespace,
+		gentype.NewClientWithListAndApply[*traefikiov1alpha1.TraefikService, *traefikiov1alpha1.TraefikServiceList, *applyconfigurationtraefikiov1alpha1.TraefikServiceApplyConfiguration](
+			"traefikservices",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *traefikiov1alpha1.TraefikService { return &traefikiov1alpha1.TraefikService{} },
+			func() *traefikiov1alpha1.TraefikServiceList { return &traefikiov1alpha1.TraefikServiceList{} },
+		),
 	}
 }
-
-// Get takes name of the traefikService, and returns the corresponding traefikService object, and an error if there is any.
-func (c *traefikServices) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.TraefikService, err error) {
-	result = &v1alpha1.TraefikService{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of TraefikServices that match those selectors.
-func (c *traefikServices) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.TraefikServiceList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1alpha1.TraefikServiceList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested traefikServices.
-func (c *traefikServices) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a traefikService and creates it.  Returns the server's representation of the traefikService, and an error, if there is any.
-func (c *traefikServices) Create(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.CreateOptions) (result *v1alpha1.TraefikService, err error) {
-	result = &v1alpha1.TraefikService{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(traefikService).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a traefikService and updates it. Returns the server's representation of the traefikService, and an error, if there is any.
-func (c *traefikServices) Update(ctx context.Context, traefikService *v1alpha1.TraefikService, opts v1.UpdateOptions) (result *v1alpha1.TraefikService, err error) {
-	result = &v1alpha1.TraefikService{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		Name(traefikService.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(traefikService).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the traefikService and deletes it. Returns an error if one occurs.
-func (c *traefikServices) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *traefikServices) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("traefikservices").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched traefikService.
-func (c *traefikServices) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.TraefikService, err error) {
-	result = &v1alpha1.TraefikService{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("traefikservices").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/factory.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/factory.go
index 1dff9903f..41ed66f44 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/factory.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/factory.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -236,6 +236,7 @@ type SharedInformerFactory interface {
 
 	// Start initializes all requested informers. They are handled in goroutines
 	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
 	Start(stopCh <-chan struct{})
 
 	// Shutdown marks a factory as shutting down. At that point no new
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/generic.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/generic.go
index 970e2e899..f975efcc5 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/generic.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/generic.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,7 +27,7 @@ THE SOFTWARE.
 package externalversions
 
 import (
-	"fmt"
+	fmt "fmt"
 
 	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces/factory_interfaces.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces/factory_interfaces.go
index ce6b460e0..22470b163 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces/factory_interfaces.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/interface.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/interface.go
index 27ce04f22..686edc9a7 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/interface.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/interface.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroute.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroute.go
index b9e466333..5bfc88702 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroute.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroute.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // IngressRoutes.
 type IngressRouteInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.IngressRouteLister
+	Lister() traefikiov1alpha1.IngressRouteLister
 }
 
 type ingressRouteInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredIngressRouteInformer(client versioned.Interface, namespace strin
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRoutes(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRoutes(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRoutes(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRoutes(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRoutes(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRoutes(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.IngressRoute{},
+		&crdtraefikiov1alpha1.IngressRoute{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *ingressRouteInformer) defaultInformer(client versioned.Interface, resyn
 }
 
 func (f *ingressRouteInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.IngressRoute{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.IngressRoute{}, f.defaultInformer)
 }
 
-func (f *ingressRouteInformer) Lister() v1alpha1.IngressRouteLister {
-	return v1alpha1.NewIngressRouteLister(f.Informer().GetIndexer())
+func (f *ingressRouteInformer) Lister() traefikiov1alpha1.IngressRouteLister {
+	return traefikiov1alpha1.NewIngressRouteLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroutetcp.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroutetcp.go
index fd42c12c0..52405235a 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroutetcp.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressroutetcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // IngressRouteTCPs.
 type IngressRouteTCPInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.IngressRouteTCPLister
+	Lister() traefikiov1alpha1.IngressRouteTCPLister
 }
 
 type ingressRouteTCPInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredIngressRouteTCPInformer(client versioned.Interface, namespace st
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRouteTCPs(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.IngressRouteTCP{},
+		&crdtraefikiov1alpha1.IngressRouteTCP{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *ingressRouteTCPInformer) defaultInformer(client versioned.Interface, re
 }
 
 func (f *ingressRouteTCPInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.IngressRouteTCP{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.IngressRouteTCP{}, f.defaultInformer)
 }
 
-func (f *ingressRouteTCPInformer) Lister() v1alpha1.IngressRouteTCPLister {
-	return v1alpha1.NewIngressRouteTCPLister(f.Informer().GetIndexer())
+func (f *ingressRouteTCPInformer) Lister() traefikiov1alpha1.IngressRouteTCPLister {
+	return traefikiov1alpha1.NewIngressRouteTCPLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressrouteudp.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressrouteudp.go
index 652b35e3e..273dfe7b2 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressrouteudp.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/ingressrouteudp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // IngressRouteUDPs.
 type IngressRouteUDPInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.IngressRouteUDPLister
+	Lister() traefikiov1alpha1.IngressRouteUDPLister
 }
 
 type ingressRouteUDPInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredIngressRouteUDPInformer(client versioned.Interface, namespace st
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRouteUDPs(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.IngressRouteUDP{},
+		&crdtraefikiov1alpha1.IngressRouteUDP{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *ingressRouteUDPInformer) defaultInformer(client versioned.Interface, re
 }
 
 func (f *ingressRouteUDPInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.IngressRouteUDP{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.IngressRouteUDP{}, f.defaultInformer)
 }
 
-func (f *ingressRouteUDPInformer) Lister() v1alpha1.IngressRouteUDPLister {
-	return v1alpha1.NewIngressRouteUDPLister(f.Informer().GetIndexer())
+func (f *ingressRouteUDPInformer) Lister() traefikiov1alpha1.IngressRouteUDPLister {
+	return traefikiov1alpha1.NewIngressRouteUDPLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/interface.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/interface.go
index 0bdad9ac9..48708e981 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/interface.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/interface.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middleware.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middleware.go
index 0d6839287..324c5219d 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middleware.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middleware.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // Middlewares.
 type MiddlewareInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.MiddlewareLister
+	Lister() traefikiov1alpha1.MiddlewareLister
 }
 
 type middlewareInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredMiddlewareInformer(client versioned.Interface, namespace string,
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().Middlewares(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().Middlewares(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().Middlewares(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().Middlewares(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().Middlewares(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().Middlewares(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.Middleware{},
+		&crdtraefikiov1alpha1.Middleware{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *middlewareInformer) defaultInformer(client versioned.Interface, resyncP
 }
 
 func (f *middlewareInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.Middleware{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.Middleware{}, f.defaultInformer)
 }
 
-func (f *middlewareInformer) Lister() v1alpha1.MiddlewareLister {
-	return v1alpha1.NewMiddlewareLister(f.Informer().GetIndexer())
+func (f *middlewareInformer) Lister() traefikiov1alpha1.MiddlewareLister {
+	return traefikiov1alpha1.NewMiddlewareLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middlewaretcp.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middlewaretcp.go
index ec02ec206..e8cacfd41 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middlewaretcp.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/middlewaretcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // MiddlewareTCPs.
 type MiddlewareTCPInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.MiddlewareTCPLister
+	Lister() traefikiov1alpha1.MiddlewareTCPLister
 }
 
 type middlewareTCPInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredMiddlewareTCPInformer(client versioned.Interface, namespace stri
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().MiddlewareTCPs(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.MiddlewareTCP{},
+		&crdtraefikiov1alpha1.MiddlewareTCP{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *middlewareTCPInformer) defaultInformer(client versioned.Interface, resy
 }
 
 func (f *middlewareTCPInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.MiddlewareTCP{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.MiddlewareTCP{}, f.defaultInformer)
 }
 
-func (f *middlewareTCPInformer) Lister() v1alpha1.MiddlewareTCPLister {
-	return v1alpha1.NewMiddlewareTCPLister(f.Informer().GetIndexer())
+func (f *middlewareTCPInformer) Lister() traefikiov1alpha1.MiddlewareTCPLister {
+	return traefikiov1alpha1.NewMiddlewareTCPLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransport.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransport.go
index ea7739ff9..8b091354d 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransport.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransport.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // ServersTransports.
 type ServersTransportInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.ServersTransportLister
+	Lister() traefikiov1alpha1.ServersTransportLister
 }
 
 type serversTransportInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredServersTransportInformer(client versioned.Interface, namespace s
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().ServersTransports(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().ServersTransports(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().ServersTransports(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().ServersTransports(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().ServersTransports(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().ServersTransports(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.ServersTransport{},
+		&crdtraefikiov1alpha1.ServersTransport{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *serversTransportInformer) defaultInformer(client versioned.Interface, r
 }
 
 func (f *serversTransportInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.ServersTransport{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.ServersTransport{}, f.defaultInformer)
 }
 
-func (f *serversTransportInformer) Lister() v1alpha1.ServersTransportLister {
-	return v1alpha1.NewServersTransportLister(f.Informer().GetIndexer())
+func (f *serversTransportInformer) Lister() traefikiov1alpha1.ServersTransportLister {
+	return traefikiov1alpha1.NewServersTransportLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransporttcp.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransporttcp.go
index c0c102591..824c67cae 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransporttcp.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/serverstransporttcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // ServersTransportTCPs.
 type ServersTransportTCPInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.ServersTransportTCPLister
+	Lister() traefikiov1alpha1.ServersTransportTCPLister
 }
 
 type serversTransportTCPInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredServersTransportTCPInformer(client versioned.Interface, namespac
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().ServersTransportTCPs(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.ServersTransportTCP{},
+		&crdtraefikiov1alpha1.ServersTransportTCP{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *serversTransportTCPInformer) defaultInformer(client versioned.Interface
 }
 
 func (f *serversTransportTCPInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.ServersTransportTCP{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.ServersTransportTCP{}, f.defaultInformer)
 }
 
-func (f *serversTransportTCPInformer) Lister() v1alpha1.ServersTransportTCPLister {
-	return v1alpha1.NewServersTransportTCPLister(f.Informer().GetIndexer())
+func (f *serversTransportTCPInformer) Lister() traefikiov1alpha1.ServersTransportTCPLister {
+	return traefikiov1alpha1.NewServersTransportTCPLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsoption.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsoption.go
index fa65e9e63..fbc03787a 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsoption.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsoption.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // TLSOptions.
 type TLSOptionInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.TLSOptionLister
+	Lister() traefikiov1alpha1.TLSOptionLister
 }
 
 type tLSOptionInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredTLSOptionInformer(client versioned.Interface, namespace string,
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TLSOptions(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().TLSOptions(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TLSOptions(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().TLSOptions(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TLSOptions(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TLSOptions(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.TLSOption{},
+		&crdtraefikiov1alpha1.TLSOption{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *tLSOptionInformer) defaultInformer(client versioned.Interface, resyncPe
 }
 
 func (f *tLSOptionInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.TLSOption{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.TLSOption{}, f.defaultInformer)
 }
 
-func (f *tLSOptionInformer) Lister() v1alpha1.TLSOptionLister {
-	return v1alpha1.NewTLSOptionLister(f.Informer().GetIndexer())
+func (f *tLSOptionInformer) Lister() traefikiov1alpha1.TLSOptionLister {
+	return traefikiov1alpha1.NewTLSOptionLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsstore.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsstore.go
index 04095e338..02eea4cf8 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsstore.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/tlsstore.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // TLSStores.
 type TLSStoreInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.TLSStoreLister
+	Lister() traefikiov1alpha1.TLSStoreLister
 }
 
 type tLSStoreInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredTLSStoreInformer(client versioned.Interface, namespace string, r
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TLSStores(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().TLSStores(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TLSStores(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().TLSStores(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TLSStores(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TLSStores(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.TLSStore{},
+		&crdtraefikiov1alpha1.TLSStore{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *tLSStoreInformer) defaultInformer(client versioned.Interface, resyncPer
 }
 
 func (f *tLSStoreInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.TLSStore{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.TLSStore{}, f.defaultInformer)
 }
 
-func (f *tLSStoreInformer) Lister() v1alpha1.TLSStoreLister {
-	return v1alpha1.NewTLSStoreLister(f.Informer().GetIndexer())
+func (f *tLSStoreInformer) Lister() traefikiov1alpha1.TLSStoreLister {
+	return traefikiov1alpha1.NewTLSStoreLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/traefikservice.go b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/traefikservice.go
index a1a1bbf58..272be98cb 100644
--- a/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/traefikservice.go
+++ b/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefikio/v1alpha1/traefikservice.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,13 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	"context"
+	context "context"
 	time "time"
 
 	versioned "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned"
 	internalinterfaces "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
-	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1"
+	crdtraefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	watch "k8s.io/apimachinery/pkg/watch"
@@ -44,7 +44,7 @@ import (
 // TraefikServices.
 type TraefikServiceInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1alpha1.TraefikServiceLister
+	Lister() traefikiov1alpha1.TraefikServiceLister
 }
 
 type traefikServiceInformer struct {
@@ -70,16 +70,28 @@ func NewFilteredTraefikServiceInformer(client versioned.Interface, namespace str
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TraefikServices(namespace).List(context.TODO(), options)
+				return client.TraefikV1alpha1().TraefikServices(namespace).List(context.Background(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.TraefikV1alpha1().TraefikServices(namespace).Watch(context.TODO(), options)
+				return client.TraefikV1alpha1().TraefikServices(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TraefikServices(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().TraefikServices(namespace).Watch(ctx, options)
 			},
 		},
-		&traefikiov1alpha1.TraefikService{},
+		&crdtraefikiov1alpha1.TraefikService{},
 		resyncPeriod,
 		indexers,
 	)
@@ -90,9 +102,9 @@ func (f *traefikServiceInformer) defaultInformer(client versioned.Interface, res
 }
 
 func (f *traefikServiceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&traefikiov1alpha1.TraefikService{}, f.defaultInformer)
+	return f.factory.InformerFor(&crdtraefikiov1alpha1.TraefikService{}, f.defaultInformer)
 }
 
-func (f *traefikServiceInformer) Lister() v1alpha1.TraefikServiceLister {
-	return v1alpha1.NewTraefikServiceLister(f.Informer().GetIndexer())
+func (f *traefikServiceInformer) Lister() traefikiov1alpha1.TraefikServiceLister {
+	return traefikiov1alpha1.NewTraefikServiceLister(f.Informer().GetIndexer())
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/expansion_generated.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/expansion_generated.go
index b61b4b735..32f3d7b4a 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/expansion_generated.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/expansion_generated.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroute.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroute.go
index a88372570..57647bde4 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroute.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroute.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // IngressRouteLister helps list IngressRoutes.
@@ -38,7 +38,7 @@ import (
 type IngressRouteLister interface {
 	// List lists all IngressRoutes in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRoute, err error)
 	// IngressRoutes returns an object that can list and get IngressRoutes.
 	IngressRoutes(namespace string) IngressRouteNamespaceLister
 	IngressRouteListerExpansion
@@ -46,25 +46,17 @@ type IngressRouteLister interface {
 
 // ingressRouteLister implements the IngressRouteLister interface.
 type ingressRouteLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRoute]
 }
 
 // NewIngressRouteLister returns a new IngressRouteLister.
 func NewIngressRouteLister(indexer cache.Indexer) IngressRouteLister {
-	return &ingressRouteLister{indexer: indexer}
-}
-
-// List lists all IngressRoutes in the indexer.
-func (s *ingressRouteLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRoute))
-	})
-	return ret, err
+	return &ingressRouteLister{listers.New[*traefikiov1alpha1.IngressRoute](indexer, traefikiov1alpha1.Resource("ingressroute"))}
 }
 
 // IngressRoutes returns an object that can list and get IngressRoutes.
 func (s *ingressRouteLister) IngressRoutes(namespace string) IngressRouteNamespaceLister {
-	return ingressRouteNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return ingressRouteNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.IngressRoute](s.ResourceIndexer, namespace)}
 }
 
 // IngressRouteNamespaceLister helps list and get IngressRoutes.
@@ -72,36 +64,15 @@ func (s *ingressRouteLister) IngressRoutes(namespace string) IngressRouteNamespa
 type IngressRouteNamespaceLister interface {
 	// List lists all IngressRoutes in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRoute, err error)
 	// Get retrieves the IngressRoute from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.IngressRoute, error)
+	Get(name string) (*traefikiov1alpha1.IngressRoute, error)
 	IngressRouteNamespaceListerExpansion
 }
 
 // ingressRouteNamespaceLister implements the IngressRouteNamespaceLister
 // interface.
 type ingressRouteNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all IngressRoutes in the indexer for a given namespace.
-func (s ingressRouteNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRoute))
-	})
-	return ret, err
-}
-
-// Get retrieves the IngressRoute from the indexer for a given namespace and name.
-func (s ingressRouteNamespaceLister) Get(name string) (*v1alpha1.IngressRoute, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("ingressroute"), name)
-	}
-	return obj.(*v1alpha1.IngressRoute), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRoute]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroutetcp.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroutetcp.go
index a0f2c50da..661047de6 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroutetcp.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressroutetcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // IngressRouteTCPLister helps list IngressRouteTCPs.
@@ -38,7 +38,7 @@ import (
 type IngressRouteTCPLister interface {
 	// List lists all IngressRouteTCPs in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRouteTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRouteTCP, err error)
 	// IngressRouteTCPs returns an object that can list and get IngressRouteTCPs.
 	IngressRouteTCPs(namespace string) IngressRouteTCPNamespaceLister
 	IngressRouteTCPListerExpansion
@@ -46,25 +46,17 @@ type IngressRouteTCPLister interface {
 
 // ingressRouteTCPLister implements the IngressRouteTCPLister interface.
 type ingressRouteTCPLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRouteTCP]
 }
 
 // NewIngressRouteTCPLister returns a new IngressRouteTCPLister.
 func NewIngressRouteTCPLister(indexer cache.Indexer) IngressRouteTCPLister {
-	return &ingressRouteTCPLister{indexer: indexer}
-}
-
-// List lists all IngressRouteTCPs in the indexer.
-func (s *ingressRouteTCPLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRouteTCP, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRouteTCP))
-	})
-	return ret, err
+	return &ingressRouteTCPLister{listers.New[*traefikiov1alpha1.IngressRouteTCP](indexer, traefikiov1alpha1.Resource("ingressroutetcp"))}
 }
 
 // IngressRouteTCPs returns an object that can list and get IngressRouteTCPs.
 func (s *ingressRouteTCPLister) IngressRouteTCPs(namespace string) IngressRouteTCPNamespaceLister {
-	return ingressRouteTCPNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return ingressRouteTCPNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.IngressRouteTCP](s.ResourceIndexer, namespace)}
 }
 
 // IngressRouteTCPNamespaceLister helps list and get IngressRouteTCPs.
@@ -72,36 +64,15 @@ func (s *ingressRouteTCPLister) IngressRouteTCPs(namespace string) IngressRouteT
 type IngressRouteTCPNamespaceLister interface {
 	// List lists all IngressRouteTCPs in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRouteTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRouteTCP, err error)
 	// Get retrieves the IngressRouteTCP from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.IngressRouteTCP, error)
+	Get(name string) (*traefikiov1alpha1.IngressRouteTCP, error)
 	IngressRouteTCPNamespaceListerExpansion
 }
 
 // ingressRouteTCPNamespaceLister implements the IngressRouteTCPNamespaceLister
 // interface.
 type ingressRouteTCPNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all IngressRouteTCPs in the indexer for a given namespace.
-func (s ingressRouteTCPNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRouteTCP, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRouteTCP))
-	})
-	return ret, err
-}
-
-// Get retrieves the IngressRouteTCP from the indexer for a given namespace and name.
-func (s ingressRouteTCPNamespaceLister) Get(name string) (*v1alpha1.IngressRouteTCP, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("ingressroutetcp"), name)
-	}
-	return obj.(*v1alpha1.IngressRouteTCP), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRouteTCP]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressrouteudp.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressrouteudp.go
index 429ae71d8..ae03f3299 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressrouteudp.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/ingressrouteudp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // IngressRouteUDPLister helps list IngressRouteUDPs.
@@ -38,7 +38,7 @@ import (
 type IngressRouteUDPLister interface {
 	// List lists all IngressRouteUDPs in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRouteUDP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRouteUDP, err error)
 	// IngressRouteUDPs returns an object that can list and get IngressRouteUDPs.
 	IngressRouteUDPs(namespace string) IngressRouteUDPNamespaceLister
 	IngressRouteUDPListerExpansion
@@ -46,25 +46,17 @@ type IngressRouteUDPLister interface {
 
 // ingressRouteUDPLister implements the IngressRouteUDPLister interface.
 type ingressRouteUDPLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRouteUDP]
 }
 
 // NewIngressRouteUDPLister returns a new IngressRouteUDPLister.
 func NewIngressRouteUDPLister(indexer cache.Indexer) IngressRouteUDPLister {
-	return &ingressRouteUDPLister{indexer: indexer}
-}
-
-// List lists all IngressRouteUDPs in the indexer.
-func (s *ingressRouteUDPLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRouteUDP, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRouteUDP))
-	})
-	return ret, err
+	return &ingressRouteUDPLister{listers.New[*traefikiov1alpha1.IngressRouteUDP](indexer, traefikiov1alpha1.Resource("ingressrouteudp"))}
 }
 
 // IngressRouteUDPs returns an object that can list and get IngressRouteUDPs.
 func (s *ingressRouteUDPLister) IngressRouteUDPs(namespace string) IngressRouteUDPNamespaceLister {
-	return ingressRouteUDPNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return ingressRouteUDPNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.IngressRouteUDP](s.ResourceIndexer, namespace)}
 }
 
 // IngressRouteUDPNamespaceLister helps list and get IngressRouteUDPs.
@@ -72,36 +64,15 @@ func (s *ingressRouteUDPLister) IngressRouteUDPs(namespace string) IngressRouteU
 type IngressRouteUDPNamespaceLister interface {
 	// List lists all IngressRouteUDPs in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.IngressRouteUDP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.IngressRouteUDP, err error)
 	// Get retrieves the IngressRouteUDP from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.IngressRouteUDP, error)
+	Get(name string) (*traefikiov1alpha1.IngressRouteUDP, error)
 	IngressRouteUDPNamespaceListerExpansion
 }
 
 // ingressRouteUDPNamespaceLister implements the IngressRouteUDPNamespaceLister
 // interface.
 type ingressRouteUDPNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all IngressRouteUDPs in the indexer for a given namespace.
-func (s ingressRouteUDPNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRouteUDP, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.IngressRouteUDP))
-	})
-	return ret, err
-}
-
-// Get retrieves the IngressRouteUDP from the indexer for a given namespace and name.
-func (s ingressRouteUDPNamespaceLister) Get(name string) (*v1alpha1.IngressRouteUDP, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("ingressrouteudp"), name)
-	}
-	return obj.(*v1alpha1.IngressRouteUDP), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.IngressRouteUDP]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middleware.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middleware.go
index 9d9c1c468..f87306ef2 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middleware.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middleware.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // MiddlewareLister helps list Middlewares.
@@ -38,7 +38,7 @@ import (
 type MiddlewareLister interface {
 	// List lists all Middlewares in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.Middleware, err error)
 	// Middlewares returns an object that can list and get Middlewares.
 	Middlewares(namespace string) MiddlewareNamespaceLister
 	MiddlewareListerExpansion
@@ -46,25 +46,17 @@ type MiddlewareLister interface {
 
 // middlewareLister implements the MiddlewareLister interface.
 type middlewareLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.Middleware]
 }
 
 // NewMiddlewareLister returns a new MiddlewareLister.
 func NewMiddlewareLister(indexer cache.Indexer) MiddlewareLister {
-	return &middlewareLister{indexer: indexer}
-}
-
-// List lists all Middlewares in the indexer.
-func (s *middlewareLister) List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.Middleware))
-	})
-	return ret, err
+	return &middlewareLister{listers.New[*traefikiov1alpha1.Middleware](indexer, traefikiov1alpha1.Resource("middleware"))}
 }
 
 // Middlewares returns an object that can list and get Middlewares.
 func (s *middlewareLister) Middlewares(namespace string) MiddlewareNamespaceLister {
-	return middlewareNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return middlewareNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.Middleware](s.ResourceIndexer, namespace)}
 }
 
 // MiddlewareNamespaceLister helps list and get Middlewares.
@@ -72,36 +64,15 @@ func (s *middlewareLister) Middlewares(namespace string) MiddlewareNamespaceList
 type MiddlewareNamespaceLister interface {
 	// List lists all Middlewares in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.Middleware, err error)
 	// Get retrieves the Middleware from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.Middleware, error)
+	Get(name string) (*traefikiov1alpha1.Middleware, error)
 	MiddlewareNamespaceListerExpansion
 }
 
 // middlewareNamespaceLister implements the MiddlewareNamespaceLister
 // interface.
 type middlewareNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all Middlewares in the indexer for a given namespace.
-func (s middlewareNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.Middleware))
-	})
-	return ret, err
-}
-
-// Get retrieves the Middleware from the indexer for a given namespace and name.
-func (s middlewareNamespaceLister) Get(name string) (*v1alpha1.Middleware, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("middleware"), name)
-	}
-	return obj.(*v1alpha1.Middleware), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.Middleware]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middlewaretcp.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middlewaretcp.go
index 547800f78..8eca35e2d 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middlewaretcp.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/middlewaretcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // MiddlewareTCPLister helps list MiddlewareTCPs.
@@ -38,7 +38,7 @@ import (
 type MiddlewareTCPLister interface {
 	// List lists all MiddlewareTCPs in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.MiddlewareTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.MiddlewareTCP, err error)
 	// MiddlewareTCPs returns an object that can list and get MiddlewareTCPs.
 	MiddlewareTCPs(namespace string) MiddlewareTCPNamespaceLister
 	MiddlewareTCPListerExpansion
@@ -46,25 +46,17 @@ type MiddlewareTCPLister interface {
 
 // middlewareTCPLister implements the MiddlewareTCPLister interface.
 type middlewareTCPLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.MiddlewareTCP]
 }
 
 // NewMiddlewareTCPLister returns a new MiddlewareTCPLister.
 func NewMiddlewareTCPLister(indexer cache.Indexer) MiddlewareTCPLister {
-	return &middlewareTCPLister{indexer: indexer}
-}
-
-// List lists all MiddlewareTCPs in the indexer.
-func (s *middlewareTCPLister) List(selector labels.Selector) (ret []*v1alpha1.MiddlewareTCP, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.MiddlewareTCP))
-	})
-	return ret, err
+	return &middlewareTCPLister{listers.New[*traefikiov1alpha1.MiddlewareTCP](indexer, traefikiov1alpha1.Resource("middlewaretcp"))}
 }
 
 // MiddlewareTCPs returns an object that can list and get MiddlewareTCPs.
 func (s *middlewareTCPLister) MiddlewareTCPs(namespace string) MiddlewareTCPNamespaceLister {
-	return middlewareTCPNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return middlewareTCPNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.MiddlewareTCP](s.ResourceIndexer, namespace)}
 }
 
 // MiddlewareTCPNamespaceLister helps list and get MiddlewareTCPs.
@@ -72,36 +64,15 @@ func (s *middlewareTCPLister) MiddlewareTCPs(namespace string) MiddlewareTCPName
 type MiddlewareTCPNamespaceLister interface {
 	// List lists all MiddlewareTCPs in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.MiddlewareTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.MiddlewareTCP, err error)
 	// Get retrieves the MiddlewareTCP from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.MiddlewareTCP, error)
+	Get(name string) (*traefikiov1alpha1.MiddlewareTCP, error)
 	MiddlewareTCPNamespaceListerExpansion
 }
 
 // middlewareTCPNamespaceLister implements the MiddlewareTCPNamespaceLister
 // interface.
 type middlewareTCPNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all MiddlewareTCPs in the indexer for a given namespace.
-func (s middlewareTCPNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.MiddlewareTCP, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.MiddlewareTCP))
-	})
-	return ret, err
-}
-
-// Get retrieves the MiddlewareTCP from the indexer for a given namespace and name.
-func (s middlewareTCPNamespaceLister) Get(name string) (*v1alpha1.MiddlewareTCP, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("middlewaretcp"), name)
-	}
-	return obj.(*v1alpha1.MiddlewareTCP), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.MiddlewareTCP]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransport.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransport.go
index f95ea600f..3b9374428 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransport.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransport.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // ServersTransportLister helps list ServersTransports.
@@ -38,7 +38,7 @@ import (
 type ServersTransportLister interface {
 	// List lists all ServersTransports in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.ServersTransport, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.ServersTransport, err error)
 	// ServersTransports returns an object that can list and get ServersTransports.
 	ServersTransports(namespace string) ServersTransportNamespaceLister
 	ServersTransportListerExpansion
@@ -46,25 +46,17 @@ type ServersTransportLister interface {
 
 // serversTransportLister implements the ServersTransportLister interface.
 type serversTransportLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.ServersTransport]
 }
 
 // NewServersTransportLister returns a new ServersTransportLister.
 func NewServersTransportLister(indexer cache.Indexer) ServersTransportLister {
-	return &serversTransportLister{indexer: indexer}
-}
-
-// List lists all ServersTransports in the indexer.
-func (s *serversTransportLister) List(selector labels.Selector) (ret []*v1alpha1.ServersTransport, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.ServersTransport))
-	})
-	return ret, err
+	return &serversTransportLister{listers.New[*traefikiov1alpha1.ServersTransport](indexer, traefikiov1alpha1.Resource("serverstransport"))}
 }
 
 // ServersTransports returns an object that can list and get ServersTransports.
 func (s *serversTransportLister) ServersTransports(namespace string) ServersTransportNamespaceLister {
-	return serversTransportNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return serversTransportNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.ServersTransport](s.ResourceIndexer, namespace)}
 }
 
 // ServersTransportNamespaceLister helps list and get ServersTransports.
@@ -72,36 +64,15 @@ func (s *serversTransportLister) ServersTransports(namespace string) ServersTran
 type ServersTransportNamespaceLister interface {
 	// List lists all ServersTransports in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.ServersTransport, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.ServersTransport, err error)
 	// Get retrieves the ServersTransport from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.ServersTransport, error)
+	Get(name string) (*traefikiov1alpha1.ServersTransport, error)
 	ServersTransportNamespaceListerExpansion
 }
 
 // serversTransportNamespaceLister implements the ServersTransportNamespaceLister
 // interface.
 type serversTransportNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all ServersTransports in the indexer for a given namespace.
-func (s serversTransportNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.ServersTransport, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.ServersTransport))
-	})
-	return ret, err
-}
-
-// Get retrieves the ServersTransport from the indexer for a given namespace and name.
-func (s serversTransportNamespaceLister) Get(name string) (*v1alpha1.ServersTransport, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("serverstransport"), name)
-	}
-	return obj.(*v1alpha1.ServersTransport), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.ServersTransport]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransporttcp.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransporttcp.go
index 4f43abf78..8b4bba0a6 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransporttcp.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/serverstransporttcp.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // ServersTransportTCPLister helps list ServersTransportTCPs.
@@ -38,7 +38,7 @@ import (
 type ServersTransportTCPLister interface {
 	// List lists all ServersTransportTCPs in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.ServersTransportTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.ServersTransportTCP, err error)
 	// ServersTransportTCPs returns an object that can list and get ServersTransportTCPs.
 	ServersTransportTCPs(namespace string) ServersTransportTCPNamespaceLister
 	ServersTransportTCPListerExpansion
@@ -46,25 +46,17 @@ type ServersTransportTCPLister interface {
 
 // serversTransportTCPLister implements the ServersTransportTCPLister interface.
 type serversTransportTCPLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.ServersTransportTCP]
 }
 
 // NewServersTransportTCPLister returns a new ServersTransportTCPLister.
 func NewServersTransportTCPLister(indexer cache.Indexer) ServersTransportTCPLister {
-	return &serversTransportTCPLister{indexer: indexer}
-}
-
-// List lists all ServersTransportTCPs in the indexer.
-func (s *serversTransportTCPLister) List(selector labels.Selector) (ret []*v1alpha1.ServersTransportTCP, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.ServersTransportTCP))
-	})
-	return ret, err
+	return &serversTransportTCPLister{listers.New[*traefikiov1alpha1.ServersTransportTCP](indexer, traefikiov1alpha1.Resource("serverstransporttcp"))}
 }
 
 // ServersTransportTCPs returns an object that can list and get ServersTransportTCPs.
 func (s *serversTransportTCPLister) ServersTransportTCPs(namespace string) ServersTransportTCPNamespaceLister {
-	return serversTransportTCPNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return serversTransportTCPNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.ServersTransportTCP](s.ResourceIndexer, namespace)}
 }
 
 // ServersTransportTCPNamespaceLister helps list and get ServersTransportTCPs.
@@ -72,36 +64,15 @@ func (s *serversTransportTCPLister) ServersTransportTCPs(namespace string) Serve
 type ServersTransportTCPNamespaceLister interface {
 	// List lists all ServersTransportTCPs in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.ServersTransportTCP, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.ServersTransportTCP, err error)
 	// Get retrieves the ServersTransportTCP from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.ServersTransportTCP, error)
+	Get(name string) (*traefikiov1alpha1.ServersTransportTCP, error)
 	ServersTransportTCPNamespaceListerExpansion
 }
 
 // serversTransportTCPNamespaceLister implements the ServersTransportTCPNamespaceLister
 // interface.
 type serversTransportTCPNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all ServersTransportTCPs in the indexer for a given namespace.
-func (s serversTransportTCPNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.ServersTransportTCP, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.ServersTransportTCP))
-	})
-	return ret, err
-}
-
-// Get retrieves the ServersTransportTCP from the indexer for a given namespace and name.
-func (s serversTransportTCPNamespaceLister) Get(name string) (*v1alpha1.ServersTransportTCP, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("serverstransporttcp"), name)
-	}
-	return obj.(*v1alpha1.ServersTransportTCP), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.ServersTransportTCP]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsoption.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsoption.go
index f5c00ad7d..495b134e8 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsoption.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsoption.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // TLSOptionLister helps list TLSOptions.
@@ -38,7 +38,7 @@ import (
 type TLSOptionLister interface {
 	// List lists all TLSOptions in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TLSOption, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TLSOption, err error)
 	// TLSOptions returns an object that can list and get TLSOptions.
 	TLSOptions(namespace string) TLSOptionNamespaceLister
 	TLSOptionListerExpansion
@@ -46,25 +46,17 @@ type TLSOptionLister interface {
 
 // tLSOptionLister implements the TLSOptionLister interface.
 type tLSOptionLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.TLSOption]
 }
 
 // NewTLSOptionLister returns a new TLSOptionLister.
 func NewTLSOptionLister(indexer cache.Indexer) TLSOptionLister {
-	return &tLSOptionLister{indexer: indexer}
-}
-
-// List lists all TLSOptions in the indexer.
-func (s *tLSOptionLister) List(selector labels.Selector) (ret []*v1alpha1.TLSOption, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TLSOption))
-	})
-	return ret, err
+	return &tLSOptionLister{listers.New[*traefikiov1alpha1.TLSOption](indexer, traefikiov1alpha1.Resource("tlsoption"))}
 }
 
 // TLSOptions returns an object that can list and get TLSOptions.
 func (s *tLSOptionLister) TLSOptions(namespace string) TLSOptionNamespaceLister {
-	return tLSOptionNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return tLSOptionNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.TLSOption](s.ResourceIndexer, namespace)}
 }
 
 // TLSOptionNamespaceLister helps list and get TLSOptions.
@@ -72,36 +64,15 @@ func (s *tLSOptionLister) TLSOptions(namespace string) TLSOptionNamespaceLister
 type TLSOptionNamespaceLister interface {
 	// List lists all TLSOptions in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TLSOption, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TLSOption, err error)
 	// Get retrieves the TLSOption from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.TLSOption, error)
+	Get(name string) (*traefikiov1alpha1.TLSOption, error)
 	TLSOptionNamespaceListerExpansion
 }
 
 // tLSOptionNamespaceLister implements the TLSOptionNamespaceLister
 // interface.
 type tLSOptionNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all TLSOptions in the indexer for a given namespace.
-func (s tLSOptionNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.TLSOption, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TLSOption))
-	})
-	return ret, err
-}
-
-// Get retrieves the TLSOption from the indexer for a given namespace and name.
-func (s tLSOptionNamespaceLister) Get(name string) (*v1alpha1.TLSOption, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("tlsoption"), name)
-	}
-	return obj.(*v1alpha1.TLSOption), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.TLSOption]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsstore.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsstore.go
index a5529027c..787246420 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsstore.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/tlsstore.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // TLSStoreLister helps list TLSStores.
@@ -38,7 +38,7 @@ import (
 type TLSStoreLister interface {
 	// List lists all TLSStores in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TLSStore, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TLSStore, err error)
 	// TLSStores returns an object that can list and get TLSStores.
 	TLSStores(namespace string) TLSStoreNamespaceLister
 	TLSStoreListerExpansion
@@ -46,25 +46,17 @@ type TLSStoreLister interface {
 
 // tLSStoreLister implements the TLSStoreLister interface.
 type tLSStoreLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.TLSStore]
 }
 
 // NewTLSStoreLister returns a new TLSStoreLister.
 func NewTLSStoreLister(indexer cache.Indexer) TLSStoreLister {
-	return &tLSStoreLister{indexer: indexer}
-}
-
-// List lists all TLSStores in the indexer.
-func (s *tLSStoreLister) List(selector labels.Selector) (ret []*v1alpha1.TLSStore, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TLSStore))
-	})
-	return ret, err
+	return &tLSStoreLister{listers.New[*traefikiov1alpha1.TLSStore](indexer, traefikiov1alpha1.Resource("tlsstore"))}
 }
 
 // TLSStores returns an object that can list and get TLSStores.
 func (s *tLSStoreLister) TLSStores(namespace string) TLSStoreNamespaceLister {
-	return tLSStoreNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return tLSStoreNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.TLSStore](s.ResourceIndexer, namespace)}
 }
 
 // TLSStoreNamespaceLister helps list and get TLSStores.
@@ -72,36 +64,15 @@ func (s *tLSStoreLister) TLSStores(namespace string) TLSStoreNamespaceLister {
 type TLSStoreNamespaceLister interface {
 	// List lists all TLSStores in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TLSStore, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TLSStore, err error)
 	// Get retrieves the TLSStore from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.TLSStore, error)
+	Get(name string) (*traefikiov1alpha1.TLSStore, error)
 	TLSStoreNamespaceListerExpansion
 }
 
 // tLSStoreNamespaceLister implements the TLSStoreNamespaceLister
 // interface.
 type tLSStoreNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all TLSStores in the indexer for a given namespace.
-func (s tLSStoreNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.TLSStore, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TLSStore))
-	})
-	return ret, err
-}
-
-// Get retrieves the TLSStore from the indexer for a given namespace and name.
-func (s tLSStoreNamespaceLister) Get(name string) (*v1alpha1.TLSStore, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("tlsstore"), name)
-	}
-	return obj.(*v1alpha1.TLSStore), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.TLSStore]
 }
diff --git a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/traefikservice.go b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/traefikservice.go
index 229e6fe67..5712a2628 100644
--- a/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/traefikservice.go
+++ b/pkg/provider/kubernetes/crd/generated/listers/traefikio/v1alpha1/traefikservice.go
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -27,10 +27,10 @@ THE SOFTWARE.
 package v1alpha1
 
 import (
-	v1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
+	traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
 )
 
 // TraefikServiceLister helps list TraefikServices.
@@ -38,7 +38,7 @@ import (
 type TraefikServiceLister interface {
 	// List lists all TraefikServices in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TraefikService, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TraefikService, err error)
 	// TraefikServices returns an object that can list and get TraefikServices.
 	TraefikServices(namespace string) TraefikServiceNamespaceLister
 	TraefikServiceListerExpansion
@@ -46,25 +46,17 @@ type TraefikServiceLister interface {
 
 // traefikServiceLister implements the TraefikServiceLister interface.
 type traefikServiceLister struct {
-	indexer cache.Indexer
+	listers.ResourceIndexer[*traefikiov1alpha1.TraefikService]
 }
 
 // NewTraefikServiceLister returns a new TraefikServiceLister.
 func NewTraefikServiceLister(indexer cache.Indexer) TraefikServiceLister {
-	return &traefikServiceLister{indexer: indexer}
-}
-
-// List lists all TraefikServices in the indexer.
-func (s *traefikServiceLister) List(selector labels.Selector) (ret []*v1alpha1.TraefikService, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TraefikService))
-	})
-	return ret, err
+	return &traefikServiceLister{listers.New[*traefikiov1alpha1.TraefikService](indexer, traefikiov1alpha1.Resource("traefikservice"))}
 }
 
 // TraefikServices returns an object that can list and get TraefikServices.
 func (s *traefikServiceLister) TraefikServices(namespace string) TraefikServiceNamespaceLister {
-	return traefikServiceNamespaceLister{indexer: s.indexer, namespace: namespace}
+	return traefikServiceNamespaceLister{listers.NewNamespaced[*traefikiov1alpha1.TraefikService](s.ResourceIndexer, namespace)}
 }
 
 // TraefikServiceNamespaceLister helps list and get TraefikServices.
@@ -72,36 +64,15 @@ func (s *traefikServiceLister) TraefikServices(namespace string) TraefikServiceN
 type TraefikServiceNamespaceLister interface {
 	// List lists all TraefikServices in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1alpha1.TraefikService, err error)
+	List(selector labels.Selector) (ret []*traefikiov1alpha1.TraefikService, err error)
 	// Get retrieves the TraefikService from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1alpha1.TraefikService, error)
+	Get(name string) (*traefikiov1alpha1.TraefikService, error)
 	TraefikServiceNamespaceListerExpansion
 }
 
 // traefikServiceNamespaceLister implements the TraefikServiceNamespaceLister
 // interface.
 type traefikServiceNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all TraefikServices in the indexer for a given namespace.
-func (s traefikServiceNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.TraefikService, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1alpha1.TraefikService))
-	})
-	return ret, err
-}
-
-// Get retrieves the TraefikService from the indexer for a given namespace and name.
-func (s traefikServiceNamespaceLister) Get(name string) (*v1alpha1.TraefikService, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1alpha1.Resource("traefikservice"), name)
-	}
-	return obj.(*v1alpha1.TraefikService), nil
+	listers.ResourceIndexer[*traefikiov1alpha1.TraefikService]
 }
diff --git a/pkg/provider/kubernetes/crd/kubernetes.go b/pkg/provider/kubernetes/crd/kubernetes.go
index b9f5c0aa5..92b45a124 100644
--- a/pkg/provider/kubernetes/crd/kubernetes.go
+++ b/pkg/provider/kubernetes/crd/kubernetes.go
@@ -1379,15 +1379,18 @@ func buildCertificates(client Client, tlsStore, namespace string, certificates [
 	return nil
 }
 
-func makeServiceKey(rule, ingressName string) (string, error) {
+func makeServiceKey(rule, ingressName string) string {
 	h := sha256.New()
+
+	// As explained in https://pkg.go.dev/hash#Hash,
+	// Write never returns an error.
 	if _, err := h.Write([]byte(rule)); err != nil {
-		return "", err
+		return ""
 	}
 
 	key := fmt.Sprintf("%s-%.10x", ingressName, h.Sum(nil))
 
-	return key, nil
+	return key
 }
 
 func makeID(namespace, name string) string {
diff --git a/pkg/provider/kubernetes/crd/kubernetes_http.go b/pkg/provider/kubernetes/crd/kubernetes_http.go
index 2e907d6c3..be9490ad6 100644
--- a/pkg/provider/kubernetes/crd/kubernetes_http.go
+++ b/pkg/provider/kubernetes/crd/kubernetes_http.go
@@ -14,7 +14,6 @@ import (
 	"github.com/traefik/traefik/v3/pkg/observability/logs"
 	"github.com/traefik/traefik/v3/pkg/provider"
 	traefikv1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
-	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/k8s"
 	"github.com/traefik/traefik/v3/pkg/tls"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -61,6 +60,12 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 			disableClusterScopeResources: p.DisableClusterScopeResources,
 		}
 
+		parentRouterNames, err := resolveParentRouterNames(client, ingressRoute, p.AllowCrossNamespace)
+		if err != nil {
+			logger.Error().Err(err).Msg("Error resolving parent routers")
+			continue
+		}
+
 		for _, route := range ingressRoute.Spec.Routes {
 			if len(route.Kind) > 0 && route.Kind != "Rule" {
 				logger.Error().Msgf("Unsupported match kind: %s. Only \"Rule\" is supported for now.", route.Kind)
@@ -72,11 +77,7 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 				continue
 			}
 
-			serviceKey, err := makeServiceKey(route.Match, ingressName)
-			if err != nil {
-				logger.Error().Err(err).Send()
-				continue
-			}
+			serviceKey := makeServiceKey(route.Match, ingressName)
 
 			mds, err := p.makeMiddlewareKeys(ctx, ingressRoute.Namespace, route.Middlewares)
 			if err != nil {
@@ -87,7 +88,8 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 			normalized := provider.Normalize(makeID(ingressRoute.Namespace, serviceKey))
 			serviceName := normalized
 
-			if len(route.Services) > 1 {
+			switch {
+			case len(route.Services) > 1:
 				spec := traefikv1alpha1.TraefikServiceSpec{
 					Weighted: &traefikv1alpha1.WeightedRoundRobin{
 						Services: route.Services,
@@ -99,7 +101,7 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 					logger.Error().Err(errBuild).Send()
 					continue
 				}
-			} else if len(route.Services) == 1 {
+			case len(route.Services) == 1:
 				fullName, serversLB, err := cb.nameAndService(ctx, ingressRoute.Namespace, route.Services[0].LoadBalancerSpec)
 				if err != nil {
 					logger.Error().Err(err).Send()
@@ -111,6 +113,9 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 				} else {
 					serviceName = fullName
 				}
+			default:
+				// Routes without services leave serviceName empty.
+				serviceName = ""
 			}
 
 			r := &dynamic.Router{
@@ -121,6 +126,7 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
 				Rule:          route.Match,
 				Service:       serviceName,
 				Observability: route.Observability,
+				ParentRefs:    parentRouterNames,
 			}
 
 			if ingressRoute.Spec.TLS != nil {
@@ -202,6 +208,50 @@ func (p *Provider) makeMiddlewareKeys(ctx context.Context, ingRouteNamespace str
 	return mds, nil
 }
 
+// resolveParentRouterNames resolves parent IngressRoute references to router names.
+// It returns the list of parent router names and an error if one occurred during processing.
+func resolveParentRouterNames(client Client, ingressRoute *traefikv1alpha1.IngressRoute, allowCrossNamespace bool) ([]string, error) {
+	// If no parent refs, return empty list (not an error).
+	if len(ingressRoute.Spec.ParentRefs) == 0 {
+		return nil, nil
+	}
+
+	var parentRouterNames []string
+	for _, parentRef := range ingressRoute.Spec.ParentRefs {
+		// Determine parent namespace (default to child namespace if not specified).
+		parentNamespace := parentRef.Namespace
+		if parentNamespace == "" {
+			parentNamespace = ingressRoute.Namespace
+		}
+
+		// Validate cross-namespace access.
+		if !isNamespaceAllowed(allowCrossNamespace, ingressRoute.Namespace, parentNamespace) {
+			return nil, fmt.Errorf("cross-namespace reference to parent IngressRoute %s/%s not allowed", parentNamespace, parentRef.Name)
+		}
+
+		var parentIngressRoute *traefikv1alpha1.IngressRoute
+		for _, ir := range client.GetIngressRoutes() {
+			if ir.Name == parentRef.Name && ir.Namespace == parentNamespace {
+				parentIngressRoute = ir
+				break
+			}
+		}
+
+		if parentIngressRoute == nil {
+			return nil, fmt.Errorf("parent IngressRoute %s/%s does not exist", parentNamespace, parentRef.Name)
+		}
+
+		// Compute router names for all routes in parent IngressRoute.
+		for _, route := range parentIngressRoute.Spec.Routes {
+			serviceKey := makeServiceKey(route.Match, parentIngressRoute.Name)
+			routerName := provider.Normalize(makeID(parentIngressRoute.Namespace, serviceKey))
+			parentRouterNames = append(parentRouterNames, routerName)
+		}
+	}
+
+	return parentRouterNames, nil
+}
+
 type configBuilder struct {
 	client                       Client
 	allowCrossNamespace          bool
@@ -216,13 +266,17 @@ type configBuilder struct {
 func (c configBuilder) buildTraefikService(ctx context.Context, tService *traefikv1alpha1.TraefikService, conf map[string]*dynamic.Service) error {
 	id := provider.Normalize(makeID(tService.Namespace, tService.Name))
 
-	if tService.Spec.Weighted != nil {
+	switch {
+	case tService.Spec.Weighted != nil:
 		return c.buildServicesLB(ctx, tService.Namespace, tService.Spec, id, conf)
-	} else if tService.Spec.Mirroring != nil {
+	case tService.Spec.Mirroring != nil:
 		return c.buildMirroring(ctx, tService, id, conf)
-	}
+	case tService.Spec.HighestRandomWeight != nil:
+		return c.buildHRW(ctx, tService, id, conf)
+	default:
 
-	return errors.New("unspecified service type")
+		return errors.New("unspecified service type")
+	}
 }
 
 // buildServicesLB creates the configuration for the load-balancer of services named id, and defined in tService.
@@ -329,7 +383,7 @@ func (c configBuilder) buildServersLB(namespace string, svc traefikv1alpha1.Load
 	// TODO: remove this when the fake client apply default values.
 	if svc.Strategy != "" {
 		switch svc.Strategy {
-		case dynamic.BalancerStrategyWRR, dynamic.BalancerStrategyP2C:
+		case dynamic.BalancerStrategyWRR, dynamic.BalancerStrategyP2C, dynamic.BalancerStrategyHRW, dynamic.BalancerStrategyLeastTime:
 			lb.Strategy = svc.Strategy
 
 		// Here we are just logging a warning as the default value is already applied.
@@ -392,6 +446,21 @@ func (c configBuilder) buildServersLB(namespace string, svc traefikv1alpha1.Load
 		}
 	}
 
+	if svc.PassiveHealthCheck != nil {
+		lb.PassiveHealthCheck = &dynamic.PassiveServerHealthCheck{}
+		lb.PassiveHealthCheck.SetDefaults()
+
+		if svc.PassiveHealthCheck.MaxFailedAttempts != nil {
+			lb.PassiveHealthCheck.MaxFailedAttempts = *svc.PassiveHealthCheck.MaxFailedAttempts
+		}
+
+		if svc.PassiveHealthCheck.FailureWindow != nil {
+			if err := lb.PassiveHealthCheck.FailureWindow.Set(svc.PassiveHealthCheck.FailureWindow.String()); err != nil {
+				return nil, err
+			}
+		}
+	}
+
 	conf := svc
 	lb.PassHostHeader = conf.PassHostHeader
 	if lb.PassHostHeader == nil {
@@ -572,7 +641,10 @@ func (c configBuilder) loadServers(parentNamespace string, svc traefikv1alpha1.L
 		}
 
 		for _, endpoint := range endpointSlice.Endpoints {
-			if !k8s.EndpointServing(endpoint) {
+			// The Serving condition allows to track if the Pod can receive traffic.
+			// It is set to true when the Pod is Ready or Terminating.
+			// From the go documentation, a nil value should be interpreted as "true".
+			if !ptr.Deref(endpoint.Conditions.Serving, true) {
 				continue
 			}
 
@@ -584,7 +656,7 @@ func (c configBuilder) loadServers(parentNamespace string, svc traefikv1alpha1.L
 				addresses[address] = struct{}{}
 				servers = append(servers, dynamic.Server{
 					URL:    fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(address, strconv.Itoa(int(port)))),
-					Fenced: ptr.Deref(endpoint.Conditions.Terminating, false) && ptr.Deref(endpoint.Conditions.Serving, false),
+					Fenced: ptr.Deref(endpoint.Conditions.Terminating, false),
 				})
 			}
 		}
@@ -629,6 +701,38 @@ func (c configBuilder) nameAndService(ctx context.Context, parentNamespace strin
 	}
 }
 
+func (c configBuilder) buildHRW(ctx context.Context, tService *traefikv1alpha1.TraefikService, id string, conf map[string]*dynamic.Service) error {
+	var hrwServices []dynamic.HRWService
+	for _, hrwService := range tService.Spec.HighestRandomWeight.Services {
+		hrwServiceName, k8sService, err := c.nameAndService(ctx, tService.Namespace, hrwService.LoadBalancerSpec)
+		if err != nil {
+			return err
+		}
+
+		if k8sService != nil {
+			conf[hrwServiceName] = k8sService
+		}
+
+		weight := hrwService.Weight
+		if weight == nil {
+			weight = func(i int) *int { return &i }(1)
+		}
+
+		hrwServices = append(hrwServices, dynamic.HRWService{
+			Name:   hrwServiceName,
+			Weight: weight,
+		})
+	}
+
+	conf[id] = &dynamic.Service{
+		HighestRandomWeight: &dynamic.HighestRandomWeight{
+			Services: hrwServices,
+		},
+	}
+
+	return nil
+}
+
 func splitSvcNameProvider(name string) (string, string) {
 	parts := strings.Split(name, providerNamespaceSeparator)
 
diff --git a/pkg/provider/kubernetes/crd/kubernetes_tcp.go b/pkg/provider/kubernetes/crd/kubernetes_tcp.go
index c4c3fa6d4..bbe48f638 100644
--- a/pkg/provider/kubernetes/crd/kubernetes_tcp.go
+++ b/pkg/provider/kubernetes/crd/kubernetes_tcp.go
@@ -50,11 +50,7 @@ func (p *Provider) loadIngressRouteTCPConfiguration(ctx context.Context, client
 				continue
 			}
 
-			key, err := makeServiceKey(route.Match, ingressName)
-			if err != nil {
-				logger.Error().Err(err).Send()
-				continue
-			}
+			key := makeServiceKey(route.Match, ingressName)
 
 			mds, err := p.makeMiddlewareTCPKeys(ctx, ingressRouteTCP.Namespace, route.Middlewares)
 			if err != nil {
diff --git a/pkg/provider/kubernetes/crd/kubernetes_test.go b/pkg/provider/kubernetes/crd/kubernetes_test.go
index ec6651091..018a3dd43 100644
--- a/pkg/provider/kubernetes/crd/kubernetes_test.go
+++ b/pkg/provider/kubernetes/crd/kubernetes_test.go
@@ -1655,7 +1655,7 @@ func TestLoadIngressRouteTCPs(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -3150,6 +3150,79 @@ func TestLoadIngressRoutes(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc:  "one kube services in a highest random weight",
+			paths: []string{"with_highest_random_weight.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-test-route-77c62dfe9517144aeeaa": {
+							EntryPoints: []string{"web"},
+							Service:     "default-hrw1",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/foo`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-hrw1": {
+							HighestRandomWeight: &dynamic.HighestRandomWeight{
+								Services: []dynamic.HRWService{
+									{Name: "default-whoami1-8080", Weight: pointer(10)},
+									{Name: "default-whoami2-8080", Weight: pointer(20)},
+								},
+							},
+						},
+						"default-whoami1-8080": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.1:8080",
+									},
+									{
+										URL: "http://10.10.0.2:8080",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+						"default-whoami2-8080": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.3:8080",
+									},
+									{
+										URL: "http://10.10.0.4:8080",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+			},
+		},
 		{
 			desc:  "One ingress Route with two different services, with weights",
 			paths: []string{"services.yml", "with_two_services_weight.yml"},
@@ -5278,6 +5351,370 @@ func TestLoadIngressRoutes(t *testing.T) {
 				TLS: &dynamic.TLSConfiguration{},
 			},
 		},
+		{
+			desc:  "IngressRoute with single parent (single route)",
+			paths: []string{"parent_refs_services.yml", "parent_refs_single_parent_single_route.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-parent-single-3c07cfffe8e5f876a01e": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`parent.example.com`)",
+						},
+						"default-child-single-2bba0a3de1b50b70a519": {
+							Service:    "default-child-single-2bba0a3de1b50b70a519",
+							Rule:       "Path(`/api`)",
+							ParentRefs: []string{"default-parent-single-3c07cfffe8e5f876a01e"},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-child-single-2bba0a3de1b50b70a519": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.2.1:9000",
+									},
+									{
+										URL: "http://10.10.2.2:9000",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:  "IngressRoute with single parent (multiple routes) - all parent routers in ParentRefs",
+			paths: []string{"parent_refs_services.yml", "parent_refs_single_parent_multiple_routes.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-parent-multi-4aac0d541c2b669a2d5d": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`api.example.com`) && PathPrefix(`/v1`)",
+						},
+						"default-parent-multi-0af1ca0a94f5b87a125e": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`api.example.com`) && PathPrefix(`/v2`)",
+						},
+						"default-child-multi-routes-b0479051e6a353d66211": {
+							Service:    "default-child-multi-routes-b0479051e6a353d66211",
+							Rule:       "Path(`/users`)",
+							ParentRefs: []string{"default-parent-multi-4aac0d541c2b669a2d5d", "default-parent-multi-0af1ca0a94f5b87a125e"},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-child-multi-routes-b0479051e6a353d66211": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.5.1:9000",
+									},
+									{
+										URL: "http://10.10.5.2:9000",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:  "IngressRoute with multiple parents",
+			paths: []string{"parent_refs_services.yml", "parent_refs_multiple_parents.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-parent-a-629990b524bf9a1a8d27": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`a.example.com`)",
+						},
+						"default-parent-b-add617f9b95cff009054": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`b.example.com`)",
+						},
+						"default-child-multi-parents-8013b5025acddd1761d1": {
+							Service:    "default-child-multi-parents-8013b5025acddd1761d1",
+							Rule:       "Path(`/shared`)",
+							ParentRefs: []string{"default-parent-a-629990b524bf9a1a8d27", "default-parent-b-add617f9b95cff009054"},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-child-multi-parents-8013b5025acddd1761d1": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.8.1:9000",
+									},
+									{
+										URL: "http://10.10.8.2:9000",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:  "IngressRoute with missing parent - routers skipped",
+			paths: []string{"parent_refs_services.yml", "parent_refs_missing_parent.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers:           map[string]*dynamic.Router{},
+					Middlewares:       map[string]*dynamic.Middleware{},
+					Services:          map[string]*dynamic.Service{},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:                "IngressRoute with cross-namespace parent allowed",
+			allowCrossNamespace: true,
+			paths:               []string{"parent_refs_services.yml", "parent_refs_cross_namespace_allowed.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"ns-a-parent-cross-74575ab54671a3ede28c": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`cross.example.com`)",
+						},
+						"ns-b-child-cross-allowed-0bad04de665623bf2362": {
+							Service:    "ns-b-child-cross-allowed-0bad04de665623bf2362",
+							Rule:       "Path(`/cross`)",
+							ParentRefs: []string{"ns-a-parent-cross-74575ab54671a3ede28c"},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"ns-b-child-cross-allowed-0bad04de665623bf2362": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.11.1:9000",
+									},
+									{
+										URL: "http://10.10.11.2:9000",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:                "IngressRoute with cross-namespace parent denied",
+			allowCrossNamespace: false,
+			paths:               []string{"parent_refs_services.yml", "parent_refs_cross_namespace_denied.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"ns-a-parent-cross-74575ab54671a3ede28c": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`cross.example.com`)",
+						},
+					},
+					Middlewares:       map[string]*dynamic.Middleware{},
+					Services:          map[string]*dynamic.Service{},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:  "IngressRoute with parent namespace defaulting to child namespace",
+			paths: []string{"parent_refs_services.yml", "parent_refs_default_namespace.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-parent-default-9b8ab283eeed3eb66561": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`default.example.com`)",
+						},
+						"default-child-same-9234eba1edcfbd8a7723": {
+							Service:    "default-child-same-9234eba1edcfbd8a7723",
+							Rule:       "Path(`/same`)",
+							ParentRefs: []string{"default-parent-default-9b8ab283eeed3eb66561"},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-child-same-9234eba1edcfbd8a7723": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyWRR,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.14.1:9000",
+									},
+									{
+										URL: "http://10.10.14.2:9000",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
+		{
+			desc:  "Simple Ingress Route with leasttime strategy",
+			paths: []string{"services.yml", "with_leasttime_strategy.yml"},
+			expected: &dynamic.Configuration{
+				UDP: &dynamic.UDPConfiguration{
+					Routers:  map[string]*dynamic.UDPRouter{},
+					Services: map[string]*dynamic.UDPService{},
+				},
+				TCP: &dynamic.TCPConfiguration{
+					Routers:           map[string]*dynamic.TCPRouter{},
+					Middlewares:       map[string]*dynamic.TCPMiddleware{},
+					Services:          map[string]*dynamic.TCPService{},
+					ServersTransports: map[string]*dynamic.TCPServersTransport{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-test-route-55869f6407935ccfa805": {
+							EntryPoints: []string{"web"},
+							Service:     "default-test-route-55869f6407935ccfa805",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/leasttime`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-test-route-55869f6407935ccfa805": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy: dynamic.BalancerStrategyLeastTime,
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.3:8080",
+									},
+									{
+										URL: "http://10.10.0.4:8080",
+									},
+								},
+								PassHostHeader: pointer(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: ptypes.Duration(100 * time.Millisecond),
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
 	}
 
 	for _, test := range testCases {
@@ -5291,7 +5728,7 @@ func TestLoadIngressRoutes(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -5373,7 +5810,7 @@ func TestLoadIngressRoutes_multipleEndpointAddresses(t *testing.T) {
 	k8sObjects, crdObjects := readResources(t, []string{"services.yml", "with_multiple_endpointslices.yml"})
 
 	kubeClient := kubefake.NewClientset(k8sObjects...)
-	crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+	crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 	client := newClientImpl(kubeClient, crdClient)
 
@@ -5882,7 +6319,7 @@ func TestLoadIngressRouteUDPs(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -7385,7 +7822,7 @@ func TestCrossNamespace(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -7655,7 +8092,7 @@ func TestExternalNameService(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -7837,7 +8274,7 @@ func TestNativeLB(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -8103,7 +8540,7 @@ func TestNodePortLB(t *testing.T) {
 			k8sObjects, crdObjects := readResources(t, test.paths)
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
@@ -8144,7 +8581,7 @@ func TestCreateBasicAuthCredentials(t *testing.T) {
 	}
 
 	kubeClient := kubefake.NewClientset(k8sObjects...)
-	crdClient := traefikcrdfake.NewSimpleClientset()
+	crdClient := traefikcrdfake.NewClientset()
 
 	client := newClientImpl(kubeClient, crdClient)
 
@@ -8749,7 +9186,7 @@ func TestGlobalNativeLB(t *testing.T) {
 			}
 
 			kubeClient := kubefake.NewClientset(k8sObjects...)
-			crdClient := traefikcrdfake.NewSimpleClientset(crdObjects...)
+			crdClient := traefikcrdfake.NewClientset(crdObjects...)
 
 			client := newClientImpl(kubeClient, crdClient)
 
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go
index 6fda0077d..36c50286b 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go
@@ -13,18 +13,22 @@ type IngressRouteSpec struct {
 	Routes []Route `json:"routes"`
 	// EntryPoints defines the list of entry point names to bind to.
 	// Entry points have to be configured in the static configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
 	// Default: all.
 	EntryPoints []string `json:"entryPoints,omitempty"`
 	// TLS defines the TLS configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/router/#tls
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls
 	TLS *TLS `json:"tls,omitempty"`
+	// ParentRefs defines references to parent IngressRoute resources for multi-layer routing.
+	// When set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.
+	// More info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs
+	ParentRefs []IngressRouteRef `json:"parentRefs,omitempty"`
 }
 
 // Route holds the HTTP route configuration.
 type Route struct {
 	// Match defines the router's rule.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/
 	Match string `json:"match"`
 	// Kind defines the kind of the route.
 	// Rule is the only supported kind.
@@ -32,62 +36,62 @@ type Route struct {
 	// +kubebuilder:validation:Enum=Rule
 	Kind string `json:"kind,omitempty"`
 	// Priority defines the router's priority.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#priority
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority
 	// +kubebuilder:validation:Maximum=9223372036854774807
 	Priority int `json:"priority,omitempty"`
 	// Syntax defines the router's rule syntax.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
 	// Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
 	Syntax string `json:"syntax,omitempty"`
 	// Services defines the list of Service.
 	// It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
 	Services []Service `json:"services,omitempty"`
 	// Middlewares defines the list of references to Middleware resources.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/middleware/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/
 	Middlewares []MiddlewareRef `json:"middlewares,omitempty"`
 	// Observability defines the observability configuration for a router.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/observability/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/
 	Observability *dynamic.RouterObservabilityConfig `json:"observability,omitempty"`
 }
 
 // TLS holds the TLS configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/overview/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/overview/
 type TLS struct {
 	// SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
 	SecretName string `json:"secretName,omitempty"`
 	// Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
 	// If not defined, the `default` TLSOption is used.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-options/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/
 	Options *TLSOptionRef `json:"options,omitempty"`
 	// Store defines the reference to the TLSStore, that will be used to store certificates.
 	// Please note that only `default` TLSStore can be used.
 	Store *TLSStoreRef `json:"store,omitempty"`
 	// CertResolver defines the name of the certificate resolver to use.
 	// Cert resolvers have to be configured in the static configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
 	CertResolver string `json:"certResolver,omitempty"`
 	// Domains defines the list of domains that will be used to issue certificates.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#domains
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains
 	Domains []types.Domain `json:"domains,omitempty"`
 }
 
 // TLSOptionRef is a reference to a TLSOption resource.
 type TLSOptionRef struct {
 	// Name defines the name of the referenced TLSOption.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
 	Name string `json:"name"`
 	// Namespace defines the namespace of the referenced TLSOption.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
 	Namespace string `json:"namespace,omitempty"`
 }
 
 // TLSStoreRef is a reference to a TLSStore resource.
 type TLSStoreRef struct {
 	// Name defines the name of the referenced TLSStore.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
 	Name string `json:"name"`
 	// Namespace defines the namespace of the referenced TLSStore.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
 	Namespace string `json:"namespace,omitempty"`
 }
 
@@ -104,7 +108,7 @@ type LoadBalancerSpec struct {
 	// Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
 	Namespace string `json:"namespace,omitempty"`
 	// Sticky defines the sticky sessions configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
 	Sticky *dynamic.Sticky `json:"sticky,omitempty"`
 	// Port defines the port of a Kubernetes Service.
 	// This can be a reference to a named port.
@@ -114,10 +118,10 @@ type LoadBalancerSpec struct {
 	// It defaults to https when Kubernetes Service port is 443, http otherwise.
 	Scheme string `json:"scheme,omitempty"`
 	// Strategy defines the load balancing strategy between the servers.
-	// Supported values are: wrr (Weighed round-robin) and p2c (Power of two choices).
+	// Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
 	// RoundRobin value is deprecated and supported for backward compatibility.
-	// TODO: when the deprecated RoundRobin value will be removed, set the default value to wrr.
-	// +kubebuilder:validation:Enum=wrr;p2c;RoundRobin
+	// TODO: when the deprecated RoundRobin value will be removed, set the default kubebuilder value to wrr.
+	// +kubebuilder:validation:Enum=wrr;p2c;hrw;leasttime;RoundRobin
 	Strategy dynamic.BalancerStrategy `json:"strategy,omitempty"`
 	// PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
 	// By default, passHostHeader is true.
@@ -144,6 +148,8 @@ type LoadBalancerSpec struct {
 	NodePortLB bool `json:"nodePortLB,omitempty"`
 	// Healthcheck defines health checks for ExternalName services.
 	HealthCheck *ServerHealthCheck `json:"healthCheck,omitempty"`
+	// PassiveHealthCheck defines passive health checks for ExternalName services.
+	PassiveHealthCheck *PassiveServerHealthCheck `json:"passiveHealthCheck,omitempty"`
 }
 
 type ResponseForwarding struct {
@@ -189,6 +195,13 @@ type ServerHealthCheck struct {
 	Headers map[string]string `json:"headers,omitempty"`
 }
 
+type PassiveServerHealthCheck struct {
+	// FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
+	FailureWindow *intstr.IntOrString `json:"failureWindow,omitempty"`
+	// MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
+	MaxFailedAttempts *int `json:"maxFailedAttempts,omitempty"`
+}
+
 // Service defines an upstream HTTP service to proxy traffic to.
 type Service struct {
 	LoadBalancerSpec `json:",inline"`
@@ -202,6 +215,14 @@ type MiddlewareRef struct {
 	Namespace string `json:"namespace,omitempty"`
 }
 
+// IngressRouteRef is a reference to an IngressRoute resource.
+type IngressRouteRef struct {
+	// Name defines the name of the referenced IngressRoute resource.
+	Name string `json:"name"`
+	// Namespace defines the namespace of the referenced IngressRoute resource.
+	Namespace string `json:"namespace,omitempty"`
+}
+
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +kubebuilder:storageversion
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroutetcp.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroutetcp.go
index 5ef08dc02..1d719ee9a 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroutetcp.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroutetcp.go
@@ -13,25 +13,25 @@ type IngressRouteTCPSpec struct {
 	Routes []RouteTCP `json:"routes"`
 	// EntryPoints defines the list of entry point names to bind to.
 	// Entry points have to be configured in the static configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
 	// Default: all.
 	EntryPoints []string `json:"entryPoints,omitempty"`
 	// TLS defines the TLS configuration on a layer 4 / TCP Route.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/router/#tls
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls
 	TLS *TLSTCP `json:"tls,omitempty"`
 }
 
 // RouteTCP holds the TCP route configuration.
 type RouteTCP struct {
 	// Match defines the router's rule.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/
 	Match string `json:"match"`
 	// Priority defines the router's priority.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
 	// +kubebuilder:validation:Maximum=9223372036854774807
 	Priority int `json:"priority,omitempty"`
 	// Syntax defines the router's rule syntax.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
 	// +kubebuilder:validation:Enum=v3;v2
 	// Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
 	Syntax string `json:"syntax,omitempty"`
@@ -42,7 +42,7 @@ type RouteTCP struct {
 }
 
 // TLSTCP holds the TLS configuration for an IngressRouteTCP.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/
 type TLSTCP struct {
 	// SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
 	SecretName string `json:"secretName,omitempty"`
@@ -50,17 +50,17 @@ type TLSTCP struct {
 	Passthrough bool `json:"passthrough,omitempty"`
 	// Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
 	// If not defined, the `default` TLSOption is used.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#tls-options
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options
 	Options *ObjectReference `json:"options,omitempty"`
 	// Store defines the reference to the TLSStore, that will be used to store certificates.
 	// Please note that only `default` TLSStore can be used.
 	Store *ObjectReference `json:"store,omitempty"`
 	// CertResolver defines the name of the certificate resolver to use.
 	// Cert resolvers have to be configured in the static configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
 	CertResolver string `json:"certResolver,omitempty"`
 	// Domains defines the list of domains that will be used to issue certificates.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#domains
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains
 	Domains []types.Domain `json:"domains,omitempty"`
 }
 
@@ -85,7 +85,7 @@ type ServiceTCP struct {
 	// Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.
 	TerminationDelay *int `json:"terminationDelay,omitempty"`
 	// ProxyProtocol defines the PROXY protocol configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/service/#proxy-protocol
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol
 	// Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
 	ProxyProtocol *dynamic.ProxyProtocol `json:"proxyProtocol,omitempty"`
 	// ServersTransport defines the name of ServersTransportTCP resource to use.
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressrouteudp.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressrouteudp.go
index 6e0038843..e7c8d1c6d 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressrouteudp.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressrouteudp.go
@@ -11,7 +11,7 @@ type IngressRouteUDPSpec struct {
 	Routes []RouteUDP `json:"routes"`
 	// EntryPoints defines the list of entry point names to bind to.
 	// Entry points have to be configured in the static configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
 	// Default: all.
 	EntryPoints []string `json:"entryPoints,omitempty"`
 }
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middleware.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middleware.go
index 32354e2b5..d00e839d1 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middleware.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middleware.go
@@ -12,7 +12,7 @@ import (
 // +kubebuilder:storageversion
 
 // Middleware is the CRD implementation of a Traefik Middleware.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/
 type Middleware struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
@@ -52,7 +52,7 @@ type MiddlewareSpec struct {
 	ContentType       *dynamic.ContentType       `json:"contentType,omitempty"`
 	GrpcWeb           *dynamic.GrpcWeb           `json:"grpcWeb,omitempty"`
 	// Plugin defines the middleware plugin configuration.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/#community-middlewares
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/overview/#community-middlewares
 	Plugin map[string]apiextensionv1.JSON `json:"plugin,omitempty"`
 }
 
@@ -60,7 +60,7 @@ type MiddlewareSpec struct {
 
 // ErrorPage holds the custom error middleware configuration.
 // This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/
 type ErrorPage struct {
 	// Status defines which status or range of statuses should result in an error page.
 	// It can be either a status code as a number (500),
@@ -73,7 +73,7 @@ type ErrorPage struct {
 	// For example: "418": 404 or "410-418": 404
 	StatusRewrites map[string]int `json:"statusRewrites,omitempty"`
 	// Service defines the reference to a Kubernetes Service that will serve the error page.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/#service
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/errorpages/#service
 	Service Service `json:"service,omitempty"`
 	// Query defines the URL for the error page (hosted by service).
 	// The {status} variable can be used in order to insert the status code in the URL.
@@ -108,7 +108,7 @@ type CircuitBreaker struct {
 
 // Chain holds the configuration of the chain middleware.
 // This middleware enables to define reusable combinations of other pieces of middleware.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/chain/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/chain/
 type Chain struct {
 	// Middlewares is the list of MiddlewareRef which composes the chain.
 	Middlewares []MiddlewareRef `json:"middlewares,omitempty"`
@@ -118,7 +118,7 @@ type Chain struct {
 
 // BasicAuth holds the basic auth middleware configuration.
 // This middleware restricts access to your services to known users.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/
 type BasicAuth struct {
 	// Secret is the name of the referenced Kubernetes Secret containing user credentials.
 	Secret string `json:"secret,omitempty"`
@@ -129,7 +129,7 @@ type BasicAuth struct {
 	// Default: false.
 	RemoveHeader bool `json:"removeHeader,omitempty"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/basicauth/#headerfield
 	HeaderField string `json:"headerField,omitempty"`
 }
 
@@ -137,7 +137,7 @@ type BasicAuth struct {
 
 // DigestAuth holds the digest auth middleware configuration.
 // This middleware restricts access to your services to known users.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/
 type DigestAuth struct {
 	// Secret is the name of the referenced Kubernetes Secret containing user credentials.
 	Secret string `json:"secret,omitempty"`
@@ -147,7 +147,7 @@ type DigestAuth struct {
 	// Default: traefik.
 	Realm string `json:"realm,omitempty"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/digestauth/#headerfield
 	HeaderField string `json:"headerField,omitempty"`
 }
 
@@ -155,7 +155,7 @@ type DigestAuth struct {
 
 // ForwardAuth holds the forward auth middleware configuration.
 // This middleware delegates the request authentication to a Service.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/
 type ForwardAuth struct {
 	// Address defines the authentication server address.
 	Address string `json:"address,omitempty"`
@@ -164,7 +164,7 @@ type ForwardAuth struct {
 	// AuthResponseHeaders defines the list of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers.
 	AuthResponseHeaders []string `json:"authResponseHeaders,omitempty"`
 	// AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
 	AuthResponseHeadersRegex string `json:"authResponseHeadersRegex,omitempty"`
 	// AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
 	// If not set or empty then all request headers are passed.
@@ -174,7 +174,7 @@ type ForwardAuth struct {
 	// AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.
 	AddAuthCookiesToResponse []string `json:"addAuthCookiesToResponse,omitempty"`
 	// HeaderField defines a header field to store the authenticated user.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
 	HeaderField string `json:"headerField,omitempty"`
 	// ForwardBody defines whether to send the request body to the authentication server.
 	ForwardBody bool `json:"forwardBody,omitempty"`
@@ -201,7 +201,7 @@ type ClientTLSWithCAOptional struct {
 
 // RateLimit holds the rate limit configuration.
 // This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/ratelimit/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/ratelimit/
 type RateLimit struct {
 	// Average is the maximum rate, by default in requests/s, allowed for the given source.
 	// It defaults to 0, which means no rate limiting.
@@ -286,7 +286,7 @@ type ClientTLS struct {
 
 // Compress holds the compress middleware configuration.
 // This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/compress/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/compress/
 type Compress struct {
 	// ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.
 	// `application/grpc` is always excluded.
@@ -308,7 +308,7 @@ type Compress struct {
 // Retry holds the retry middleware configuration.
 // This middleware reissues requests a given number of times to a backend server if that server does not reply.
 // As soon as the server answers, the middleware stops retrying, regardless of the response status.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/retry/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/middlewares/retry/
 type Retry struct {
 	// Attempts defines how many times the request should be retried.
 	// +kubebuilder:validation:Minimum=0
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middlewaretcp.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middlewaretcp.go
index 49309b02c..cf0e2a648 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middlewaretcp.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/middlewaretcp.go
@@ -9,7 +9,7 @@ import (
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/overview/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/
 type MiddlewareTCP struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
@@ -28,11 +28,11 @@ type MiddlewareTCPSpec struct {
 	// IPWhiteList defines the IPWhiteList middleware configuration.
 	// This middleware accepts/refuses connections based on the client IP.
 	// Deprecated: please use IPAllowList instead.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipwhitelist/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/
 	IPWhiteList *dynamic.TCPIPWhiteList `json:"ipWhiteList,omitempty"`
 	// IPAllowList defines the IPAllowList middleware configuration.
 	// This middleware accepts/refuses connections based on the client IP.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipallowlist/
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/
 	IPAllowList *dynamic.TCPIPAllowList `json:"ipAllowList,omitempty"`
 }
 
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransport.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransport.go
index f797671fc..8cfbb92be 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransport.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransport.go
@@ -13,7 +13,7 @@ import (
 // ServersTransport is the CRD implementation of a ServersTransport.
 // If no serversTransport is specified, the default@internal will be used.
 // The default@internal serversTransport is created from the static configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/serverstransport/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/
 type ServersTransport struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransporttcp.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransporttcp.go
index dfb2299be..374108d10 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransporttcp.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/serverstransporttcp.go
@@ -13,7 +13,7 @@ import (
 // ServersTransportTCP is the CRD implementation of a TCPServersTransport.
 // If no tcpServersTransport is specified, a default one named default@internal will be used.
 // The default@internal tcpServersTransport can be configured in the static configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/serverstransport/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/
 type ServersTransportTCP struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/service.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/service.go
index 8adce08ef..35d45bcfc 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/service.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/service.go
@@ -13,7 +13,7 @@ import (
 // TraefikService object allows to:
 // - Apply weight to Services on load-balancing
 // - Mirror traffic on services
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/
 type TraefikService struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
@@ -44,12 +44,14 @@ type TraefikServiceSpec struct {
 	Weighted *WeightedRoundRobin `json:"weighted,omitempty"`
 	// Mirroring defines the Mirroring service configuration.
 	Mirroring *Mirroring `json:"mirroring,omitempty"`
+	// HighestRandomWeight defines the highest random weight service configuration.
+	HighestRandomWeight *HighestRandomWeight `json:"highestRandomWeight,omitempty"`
 }
 
 // +k8s:deepcopy-gen=true
 
 // Mirroring holds the mirroring service configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#mirroring
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#mirroring
 type Mirroring struct {
 	LoadBalancerSpec `json:",inline"`
 
@@ -78,11 +80,20 @@ type MirrorService struct {
 // +k8s:deepcopy-gen=true
 
 // WeightedRoundRobin holds the weighted round-robin configuration.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#weighted-round-robin-wrr
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#weighted-round-robin-wrr
 type WeightedRoundRobin struct {
 	// Services defines the list of Kubernetes Service and/or TraefikService to load-balance, with weight.
 	Services []Service `json:"services,omitempty"`
 	// Sticky defines whether sticky sessions are enabled.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
 	Sticky *dynamic.Sticky `json:"sticky,omitempty"`
 }
+
+// +k8s:deepcopy-gen=true
+
+// HighestRandomWeight holds the highest random weight configuration.
+// More info: https://doc.traefik.io/traefik/v3.6/routing/services/#highest-random-configuration
+type HighestRandomWeight struct {
+	// Services defines the list of Kubernetes Service and/or TraefikService to load-balance, with weight.
+	Services []Service `json:"services,omitempty"`
+}
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsoption.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsoption.go
index 07ab9954d..b4eebf6b7 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsoption.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsoption.go
@@ -9,7 +9,7 @@ import (
 // +kubebuilder:storageversion
 
 // TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
 type TLSOption struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
@@ -32,17 +32,17 @@ type TLSOptionSpec struct {
 	// Default: None.
 	MaxVersion string `json:"maxVersion,omitempty"`
 	// CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
 	CipherSuites []string `json:"cipherSuites,omitempty"`
 	// CurvePreferences defines the preferred elliptic curves.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
 	CurvePreferences []string `json:"curvePreferences,omitempty"`
 	// ClientAuth defines the server's policy for TLS Client Authentication.
 	ClientAuth ClientAuth `json:"clientAuth,omitempty"`
 	// SniStrict defines whether Traefik allows connections from clients connections that do not specify a server_name extension.
 	SniStrict bool `json:"sniStrict,omitempty"`
 	// ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
-	// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
+	// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
 	ALPNProtocols []string `json:"alpnProtocols,omitempty"`
 	// DisableSessionTickets disables TLS session resumption via session tickets.
 	DisableSessionTickets bool `json:"disableSessionTickets,omitempty"`
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsstore.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsstore.go
index 23a5d1a9a..36a31ca65 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsstore.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/tlsstore.go
@@ -12,7 +12,7 @@ import (
 // TLSStore is the CRD implementation of a Traefik TLS Store.
 // For the time being, only the TLSStore named default is supported.
 // This means that you cannot have two stores that are named default in different Kubernetes namespaces.
-// More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
+// More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
 type TLSStore struct {
 	metav1.TypeMeta `json:",inline"`
 	// Standard object's metadata.
diff --git a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/zz_generated.deepcopy.go b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/zz_generated.deepcopy.go
index c4f898635..3137d46ec 100644
--- a/pkg/provider/kubernetes/crd/traefikio/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/provider/kubernetes/crd/traefikio/v1alpha1/zz_generated.deepcopy.go
@@ -4,7 +4,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -349,6 +349,29 @@ func (in *ForwardingTimeouts) DeepCopy() *ForwardingTimeouts {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HighestRandomWeight) DeepCopyInto(out *HighestRandomWeight) {
+	*out = *in
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make([]Service, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HighestRandomWeight.
+func (in *HighestRandomWeight) DeepCopy() *HighestRandomWeight {
+	if in == nil {
+		return nil
+	}
+	out := new(HighestRandomWeight)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressRoute) DeepCopyInto(out *IngressRoute) {
 	*out = *in
@@ -409,6 +432,22 @@ func (in *IngressRouteList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressRouteRef) DeepCopyInto(out *IngressRouteRef) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressRouteRef.
+func (in *IngressRouteRef) DeepCopy() *IngressRouteRef {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressRouteRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressRouteSpec) DeepCopyInto(out *IngressRouteSpec) {
 	*out = *in
@@ -429,6 +468,11 @@ func (in *IngressRouteSpec) DeepCopyInto(out *IngressRouteSpec) {
 		*out = new(TLS)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ParentRefs != nil {
+		in, out := &in.ParentRefs, &out.ParentRefs
+		*out = make([]IngressRouteRef, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -657,6 +701,11 @@ func (in *LoadBalancerSpec) DeepCopyInto(out *LoadBalancerSpec) {
 		*out = new(ServerHealthCheck)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.PassiveHealthCheck != nil {
+		in, out := &in.PassiveHealthCheck, &out.PassiveHealthCheck
+		*out = new(PassiveServerHealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -1047,6 +1096,32 @@ func (in *ObjectReference) DeepCopy() *ObjectReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PassiveServerHealthCheck) DeepCopyInto(out *PassiveServerHealthCheck) {
+	*out = *in
+	if in.FailureWindow != nil {
+		in, out := &in.FailureWindow, &out.FailureWindow
+		*out = new(intstr.IntOrString)
+		**out = **in
+	}
+	if in.MaxFailedAttempts != nil {
+		in, out := &in.MaxFailedAttempts, &out.MaxFailedAttempts
+		*out = new(int)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PassiveServerHealthCheck.
+func (in *PassiveServerHealthCheck) DeepCopy() *PassiveServerHealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(PassiveServerHealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RateLimit) DeepCopyInto(out *RateLimit) {
 	*out = *in
@@ -1997,6 +2072,11 @@ func (in *TraefikServiceSpec) DeepCopyInto(out *TraefikServiceSpec) {
 		*out = new(Mirroring)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.HighestRandomWeight != nil {
+		in, out := &in.HighestRandomWeight, &out.HighestRandomWeight
+		*out = new(HighestRandomWeight)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
diff --git a/pkg/provider/kubernetes/gateway/client.go b/pkg/provider/kubernetes/gateway/client.go
index 109a0f9d7..50cf789d3 100644
--- a/pkg/provider/kubernetes/gateway/client.go
+++ b/pkg/provider/kubernetes/gateway/client.go
@@ -14,7 +14,6 @@ import (
 	"github.com/traefik/traefik/v3/pkg/types"
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
-	kerror "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
@@ -26,7 +25,6 @@ import (
 	"k8s.io/client-go/util/retry"
 	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
 	gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatev1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	gatev1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 	gateclientset "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
 	gateinformers "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions"
@@ -187,6 +185,14 @@ func (c *clientWrapper) WatchAll(namespaces []string, stopCh <-chan struct{}) (<
 		if err != nil {
 			return nil, err
 		}
+		_, err = factoryGateway.Gateway().V1().BackendTLSPolicies().Informer().AddEventHandler(eventHandler)
+		if err != nil {
+			return nil, err
+		}
+		_, err = factoryKube.Core().V1().ConfigMaps().Informer().AddEventHandler(eventHandler)
+		if err != nil {
+			return nil, err
+		}
 
 		if c.experimentalChannel {
 			_, err = factoryGateway.Gateway().V1alpha2().TCPRoutes().Informer().AddEventHandler(eventHandler)
@@ -197,14 +203,6 @@ func (c *clientWrapper) WatchAll(namespaces []string, stopCh <-chan struct{}) (<
 			if err != nil {
 				return nil, err
 			}
-			_, err = factoryGateway.Gateway().V1alpha3().BackendTLSPolicies().Informer().AddEventHandler(eventHandler)
-			if err != nil {
-				return nil, err
-			}
-			_, err = factoryKube.Core().V1().ConfigMaps().Informer().AddEventHandler(eventHandler)
-			if err != nil {
-				return nil, err
-			}
 		}
 
 		factorySecret := kinformers.NewSharedInformerFactoryWithOptions(c.csKube, resyncPeriod, kinformers.WithNamespace(ns), kinformers.WithTweakListOptions(notOwnedByHelm))
@@ -367,6 +365,72 @@ func (c *clientWrapper) ListGatewayClasses() ([]*gatev1.GatewayClass, error) {
 	return c.factoryGatewayClass.Gateway().V1().GatewayClasses().Lister().List(labels.Everything())
 }
 
+// ListEndpointSlicesForService returns the EndpointSlices for the given service name in the given namespace.
+func (c *clientWrapper) ListEndpointSlicesForService(namespace, serviceName string) ([]*discoveryv1.EndpointSlice, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("failed to get endpointslices for service %s/%s: namespace is not within watched namespaces", namespace, serviceName)
+	}
+
+	serviceLabelRequirement, err := labels.NewRequirement(discoveryv1.LabelServiceName, selection.Equals, []string{serviceName})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create service label selector requirement: %w", err)
+	}
+	serviceSelector := labels.NewSelector()
+	serviceSelector = serviceSelector.Add(*serviceLabelRequirement)
+
+	return c.factoriesKube[c.lookupNamespace(namespace)].Discovery().V1().EndpointSlices().Lister().EndpointSlices(namespace).List(serviceSelector)
+}
+
+// ListBackendTLSPoliciesForService returns the BackendTLSPolicy for the given service name in the given namespace.
+func (c *clientWrapper) ListBackendTLSPoliciesForService(namespace, serviceName string) ([]*gatev1.BackendTLSPolicy, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("failed to get BackendTLSPolicies for service %s/%s: namespace is not within watched namespaces", namespace, serviceName)
+	}
+
+	policies, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1().BackendTLSPolicies().Lister().BackendTLSPolicies(namespace).List(labels.Everything())
+	if err != nil {
+		return nil, fmt.Errorf("failed to list BackendTLSPolicies in namespace %s", namespace)
+	}
+
+	var servicePolicies []*gatev1.BackendTLSPolicy
+	for _, policy := range policies {
+		for _, ref := range policy.Spec.TargetRefs {
+			// The policy does not target the service.
+			if (ref.Group != "" && ref.Group != groupCore) || ref.Kind != kindService || string(ref.Name) != serviceName {
+				continue
+			}
+
+			servicePolicies = append(servicePolicies, policy)
+		}
+	}
+
+	return servicePolicies, nil
+}
+
+// GetService returns the named service from the given namespace.
+func (c *clientWrapper) GetService(namespace, name string) (*corev1.Service, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("failed to get service %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+	return c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
+}
+
+// GetSecret returns the named secret from the given namespace.
+func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("failed to get secret %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+	return c.factoriesSecret[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
+}
+
+// GetConfigMap returns the named configMap from the given namespace.
+func (c *clientWrapper) GetConfigMap(namespace, name string) (*corev1.ConfigMap, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("failed to get configMap %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+	return c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().ConfigMaps().Lister().ConfigMaps(namespace).Get(name)
+}
+
 func (c *clientWrapper) UpdateGatewayClassStatus(ctx context.Context, name string, status gatev1.GatewayClassStatus) error {
 	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		currentGatewayClass, err := c.factoryGatewayClass.Gateway().V1().GatewayClasses().Lister().Get(name)
@@ -637,20 +701,20 @@ func (c *clientWrapper) UpdateTLSRouteStatus(ctx context.Context, route ktypes.N
 	return nil
 }
 
-func (c *clientWrapper) UpdateBackendTLSPolicyStatus(ctx context.Context, policy ktypes.NamespacedName, status gatev1alpha2.PolicyStatus) error {
+func (c *clientWrapper) UpdateBackendTLSPolicyStatus(ctx context.Context, policy ktypes.NamespacedName, status gatev1.PolicyStatus) error {
 	if !c.isWatchedNamespace(policy.Namespace) {
 		return fmt.Errorf("updating BackendTLSPolicy status %s/%s: namespace is not within watched namespaces", policy.Namespace, policy.Name)
 	}
 
 	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
-		currentPolicy, err := c.factoriesGateway[c.lookupNamespace(policy.Namespace)].Gateway().V1alpha3().BackendTLSPolicies().Lister().BackendTLSPolicies(policy.Namespace).Get(policy.Name)
+		currentPolicy, err := c.factoriesGateway[c.lookupNamespace(policy.Namespace)].Gateway().V1().BackendTLSPolicies().Lister().BackendTLSPolicies(policy.Namespace).Get(policy.Name)
 		if err != nil {
 			// We have to return err itself here (not wrapped inside another error)
 			// so that RetryOnConflict can identify it correctly.
 			return err
 		}
 
-		ancestorStatuses := make([]gatev1alpha2.PolicyAncestorStatus, len(status.Ancestors))
+		ancestorStatuses := make([]gatev1.PolicyAncestorStatus, len(status.Ancestors))
 		copy(ancestorStatuses, status.Ancestors)
 
 		// keep statuses added by other gateway controllers,
@@ -660,14 +724,6 @@ func (c *clientWrapper) UpdateBackendTLSPolicyStatus(ctx context.Context, policy
 				ancestorStatuses = append(ancestorStatuses, ancestorStatus)
 				continue
 			}
-
-			if slices.ContainsFunc(status.Ancestors, func(status gatev1alpha2.PolicyAncestorStatus) bool {
-				return reflect.DeepEqual(ancestorStatus.AncestorRef, status.AncestorRef)
-			}) {
-				continue
-			}
-
-			ancestorStatuses = append(ancestorStatuses, ancestorStatus)
 		}
 
 		if len(ancestorStatuses) > 16 {
@@ -680,11 +736,11 @@ func (c *clientWrapper) UpdateBackendTLSPolicyStatus(ctx context.Context, policy
 		}
 
 		currentPolicy = currentPolicy.DeepCopy()
-		currentPolicy.Status = gatev1alpha2.PolicyStatus{
+		currentPolicy.Status = gatev1.PolicyStatus{
 			Ancestors: ancestorStatuses,
 		}
 
-		if _, err = c.csGateway.GatewayV1alpha3().BackendTLSPolicies(policy.Namespace).UpdateStatus(ctx, currentPolicy, metav1.UpdateOptions{}); err != nil {
+		if _, err = c.csGateway.GatewayV1().BackendTLSPolicies(policy.Namespace).UpdateStatus(ctx, currentPolicy, metav1.UpdateOptions{}); err != nil {
 			// We have to return err itself here (not wrapped inside another error)
 			// so that RetryOnConflict can identify it correctly.
 			return err
@@ -699,85 +755,7 @@ func (c *clientWrapper) UpdateBackendTLSPolicyStatus(ctx context.Context, policy
 	return nil
 }
 
-// GetService returns the named service from the given namespace.
-func (c *clientWrapper) GetService(namespace, name string) (*corev1.Service, bool, error) {
-	if !c.isWatchedNamespace(namespace) {
-		return nil, false, fmt.Errorf("failed to get service %s/%s: namespace is not within watched namespaces", namespace, name)
-	}
-
-	service, err := c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
-	exist, err := translateNotFoundError(err)
-
-	return service, exist, err
-}
-
-// ListEndpointSlicesForService returns the EndpointSlices for the given service name in the given namespace.
-func (c *clientWrapper) ListEndpointSlicesForService(namespace, serviceName string) ([]*discoveryv1.EndpointSlice, error) {
-	if !c.isWatchedNamespace(namespace) {
-		return nil, fmt.Errorf("failed to get endpointslices for service %s/%s: namespace is not within watched namespaces", namespace, serviceName)
-	}
-
-	serviceLabelRequirement, err := labels.NewRequirement(discoveryv1.LabelServiceName, selection.Equals, []string{serviceName})
-	if err != nil {
-		return nil, fmt.Errorf("failed to create service label selector requirement: %w", err)
-	}
-	serviceSelector := labels.NewSelector()
-	serviceSelector = serviceSelector.Add(*serviceLabelRequirement)
-
-	return c.factoriesKube[c.lookupNamespace(namespace)].Discovery().V1().EndpointSlices().Lister().EndpointSlices(namespace).List(serviceSelector)
-}
-
-// ListBackendTLSPoliciesForService returns the BackendTLSPolicy for the given service name in the given namespace.
-func (c *clientWrapper) ListBackendTLSPoliciesForService(namespace, serviceName string) ([]*gatev1alpha3.BackendTLSPolicy, error) {
-	if !c.isWatchedNamespace(namespace) {
-		return nil, fmt.Errorf("failed to get BackendTLSPolicies for service %s/%s: namespace is not within watched namespaces", namespace, serviceName)
-	}
-
-	policies, err := c.factoriesGateway[c.lookupNamespace(namespace)].Gateway().V1alpha3().BackendTLSPolicies().Lister().BackendTLSPolicies(namespace).List(labels.Everything())
-	if err != nil {
-		return nil, fmt.Errorf("failed to list BackendTLSPolicies in namespace %s", namespace)
-	}
-
-	var servicePolicies []*gatev1alpha3.BackendTLSPolicy
-	for _, policy := range policies {
-		for _, ref := range policy.Spec.TargetRefs {
-			// The policy does not target the service.
-			if (ref.Group != "" && ref.Group != groupCore) || ref.Kind != kindService || string(ref.Name) != serviceName {
-				continue
-			}
-
-			servicePolicies = append(servicePolicies, policy)
-		}
-	}
-
-	return servicePolicies, nil
-}
-
-// GetSecret returns the named secret from the given namespace.
-func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
-	if !c.isWatchedNamespace(namespace) {
-		return nil, false, fmt.Errorf("failed to get secret %s/%s: namespace is not within watched namespaces", namespace, name)
-	}
-
-	secret, err := c.factoriesSecret[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
-	exist, err := translateNotFoundError(err)
-
-	return secret, exist, err
-}
-
-// GetConfigMap returns the named configMap from the given namespace.
-func (c *clientWrapper) GetConfigMap(namespace, name string) (*corev1.ConfigMap, bool, error) {
-	if !c.isWatchedNamespace(namespace) {
-		return nil, false, fmt.Errorf("failed to get configMap %s/%s: namespace is not within watched namespaces", namespace, name)
-	}
-
-	configMap, err := c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().ConfigMaps().Lister().ConfigMaps(namespace).Get(name)
-	exist, err := translateNotFoundError(err)
-
-	return configMap, exist, err
-}
-
-// lookupNamespace returns the lookup namespace key for the given namespace.
+// lookupNamespace returns the lookup namespace listenerKey for the given namespace.
 // When listening on all namespaces, it returns the client-go identifier ("")
 // for all-namespaces. Otherwise, it returns the given namespace.
 // The distinction is necessary because we index all informers on the special
@@ -800,28 +778,19 @@ func (c *clientWrapper) isWatchedNamespace(namespace string) bool {
 	return slices.Contains(c.watchedNamespaces, namespace)
 }
 
-// translateNotFoundError will translate a "not found" error to a boolean return
-// value which indicates if the resource exists and a nil error.
-func translateNotFoundError(err error) (bool, error) {
-	if kerror.IsNotFound(err) {
-		return false, nil
-	}
-	return err == nil, err
-}
-
 func gatewayStatusEqual(statusA, statusB gatev1.GatewayStatus) bool {
 	return reflect.DeepEqual(statusA.Addresses, statusB.Addresses) &&
 		listenersStatusEqual(statusA.Listeners, statusB.Listeners) &&
 		conditionsEqual(statusA.Conditions, statusB.Conditions)
 }
 
-func policyAncestorStatusesEqual(policyAncestorStatusesA, policyAncestorStatusesB []gatev1alpha2.PolicyAncestorStatus) bool {
+func policyAncestorStatusesEqual(policyAncestorStatusesA, policyAncestorStatusesB []gatev1.PolicyAncestorStatus) bool {
 	if len(policyAncestorStatusesA) != len(policyAncestorStatusesB) {
 		return false
 	}
 
 	for _, sA := range policyAncestorStatusesA {
-		if !slices.ContainsFunc(policyAncestorStatusesB, func(sB gatev1alpha2.PolicyAncestorStatus) bool {
+		if !slices.ContainsFunc(policyAncestorStatusesB, func(sB gatev1.PolicyAncestorStatus) bool {
 			return policyAncestorStatusEqual(sB, sA)
 		}) {
 			return false
@@ -829,7 +798,7 @@ func policyAncestorStatusesEqual(policyAncestorStatusesA, policyAncestorStatuses
 	}
 
 	for _, sB := range policyAncestorStatusesB {
-		if !slices.ContainsFunc(policyAncestorStatusesA, func(sA gatev1alpha2.PolicyAncestorStatus) bool {
+		if !slices.ContainsFunc(policyAncestorStatusesA, func(sA gatev1.PolicyAncestorStatus) bool {
 			return policyAncestorStatusEqual(sA, sB)
 		}) {
 			return false
@@ -839,7 +808,7 @@ func policyAncestorStatusesEqual(policyAncestorStatusesA, policyAncestorStatuses
 	return true
 }
 
-func policyAncestorStatusEqual(sA, sB gatev1alpha2.PolicyAncestorStatus) bool {
+func policyAncestorStatusEqual(sA, sB gatev1.PolicyAncestorStatus) bool {
 	return sA.ControllerName == sB.ControllerName &&
 		reflect.DeepEqual(sA.AncestorRef, sB.AncestorRef) &&
 		conditionsEqual(sA.Conditions, sB.Conditions)
diff --git a/pkg/provider/kubernetes/gateway/features.go b/pkg/provider/kubernetes/gateway/features.go
index eb3a433d8..88dedd573 100644
--- a/pkg/provider/kubernetes/gateway/features.go
+++ b/pkg/provider/kubernetes/gateway/features.go
@@ -1,24 +1,48 @@
 package gateway
 
-import "sigs.k8s.io/gateway-api/pkg/features"
+import (
+	"sync"
 
-func SupportedFeatures() []features.FeatureName {
-	return []features.FeatureName{
-		features.GatewayFeature.Name,
-		features.GatewayPort8080Feature.Name,
-		features.GRPCRouteFeature.Name,
-		features.HTTPRouteFeature.Name,
-		features.HTTPRouteQueryParamMatchingFeature.Name,
-		features.HTTPRouteMethodMatchingFeature.Name,
-		features.HTTPRoutePortRedirectFeature.Name,
-		features.HTTPRouteSchemeRedirectFeature.Name,
-		features.HTTPRouteHostRewriteFeature.Name,
-		features.HTTPRoutePathRewriteFeature.Name,
-		features.HTTPRoutePathRedirectFeature.Name,
-		features.HTTPRouteResponseHeaderModificationFeature.Name,
-		features.HTTPRouteBackendProtocolH2CFeature.Name,
-		features.HTTPRouteBackendProtocolWebSocketFeature.Name,
-		features.HTTPRouteDestinationPortMatchingFeature.Name,
-		features.TLSRouteFeature.Name,
+	"k8s.io/apimachinery/pkg/util/sets"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+var SupportedFeatures = sync.OnceValue(func() []features.FeatureName {
+	featureSet := sets.New[features.Feature]().
+		Insert(features.GatewayCoreFeatures.UnsortedList()...).
+		Insert(features.GatewayExtendedFeatures.Intersection(extendedGatewayFeatures()).UnsortedList()...).
+		Insert(features.HTTPRouteCoreFeatures.UnsortedList()...).
+		Insert(features.HTTPRouteExtendedFeatures.Intersection(extendedHTTPRouteFeatures()).UnsortedList()...).
+		Insert(features.ReferenceGrantCoreFeatures.UnsortedList()...).
+		Insert(features.BackendTLSPolicyCoreFeatures.UnsortedList()...).
+		Insert(features.GRPCRouteCoreFeatures.UnsortedList()...).
+		Insert(features.TLSRouteCoreFeatures.UnsortedList()...)
+
+	featureNames := make([]features.FeatureName, 0, featureSet.Len())
+	for f := range featureSet {
+		featureNames = append(featureNames, f.Name)
 	}
+	return featureNames
+})
+
+// extendedGatewayFeatures returns the supported extended Gateway features.
+func extendedGatewayFeatures() sets.Set[features.Feature] {
+	return sets.New(features.GatewayPort8080Feature)
+}
+
+// extendedHTTPRouteFeatures returns the supported extended HTTP Route features.
+func extendedHTTPRouteFeatures() sets.Set[features.Feature] {
+	return sets.New(
+		features.HTTPRouteQueryParamMatchingFeature,
+		features.HTTPRouteMethodMatchingFeature,
+		features.HTTPRoutePortRedirectFeature,
+		features.HTTPRouteSchemeRedirectFeature,
+		features.HTTPRouteHostRewriteFeature,
+		features.HTTPRoutePathRewriteFeature,
+		features.HTTPRoutePathRedirectFeature,
+		features.HTTPRouteResponseHeaderModificationFeature,
+		features.HTTPRouteBackendProtocolH2CFeature,
+		features.HTTPRouteBackendProtocolWebSocketFeature,
+		features.HTTPRouteDestinationPortMatchingFeature,
+	)
 }
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy.yml
index 7748aee47..f183c92d8 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy.yml
@@ -52,7 +52,7 @@ spec:
 
 ---
 kind: BackendTLSPolicy
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 metadata:
   name: policy-1
   namespace: default
@@ -78,7 +78,7 @@ metadata:
   name: ca-file
   namespace: default
 data:
-  ca.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0="
+  ca.crt: "CA1"
 
 ---
 apiVersion: v1
@@ -87,4 +87,4 @@ metadata:
   name: ca-file-2
   namespace: default
 data:
-  ca.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0="
+  ca.crt: "CA2"
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy_system.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy_system.yml
index cc36c0468..05b28bd9c 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy_system.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_backend_tls_policy_system.yml
@@ -52,7 +52,7 @@ spec:
 
 ---
 kind: BackendTLSPolicy
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 metadata:
   name: policy-1
   namespace: default
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml
index cd4abdec1..bb160e469 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml
index 9804bc80d..73cbc8e82 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml
index bace669a0..552e32c95 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml
index 934b67f82..b5c5c832f 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml
index ca1c1a90e..f86f94346 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml
index 0fd6ee36e..35bd833e4 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_core_group.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_core_group.yml
index dcef7966d..3294e3a73 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_core_group.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_core_group.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_listeners_using_same_hostname_port_protocol.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_listeners_using_same_hostname_port_protocol.yml
index 272e363d7..cb0e19a60 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_listeners_using_same_hostname_port_protocol.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_listeners_using_same_hostname_port_protocol.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_all.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_all.yml
index c2b525044..263302204 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_all.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_all.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_same.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_same.yml
index 8d470e749..6bf1df73b 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_same.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_same.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_selector.yml b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_selector.yml
index a46e3dab6..7fa26a504 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_selector.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_namespace_selector.yml
@@ -14,8 +14,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret.yml b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret.yml
index ba5f1a9fb..d76fb2065 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret.yml
@@ -20,8 +20,8 @@ metadata:
   namespace: secret-namespace
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_missing.yml b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_missing.yml
index 660ff18b6..e73e55a24 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_missing.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_missing.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: secret-namespace
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_from.yml b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_from.yml
index 47aba19d8..e3662e9f2 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_from.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_from.yml
@@ -20,8 +20,8 @@ metadata:
   namespace: secret-namespace
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_to.yml b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_to.yml
index e08fa7a42..2b336f6ea 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_to.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/referencegrant/for_secret_not_matching_to.yml
@@ -21,8 +21,8 @@ metadata:
   namespace: secret-namespace
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml
index ceb2f0bb0..5bbebbfca 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml
index 05e3fc5ae..ac6b60bee 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml b/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml
index 67e8f584d..23a1860b4 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml
index 0e9c8f448..b5ce33ede 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml
index 4a2dc107f..7f30bf92d 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml
index e41a60aa7..b908be3f0 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml
index 46c588590..636673c68 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_nativelb.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_nativelb.yml
index 253e59b9b..fde70d51e 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_nativelb.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_nativelb.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml
index c88672329..3c6afe86e 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml
index e04d4e362..9ffc3a200 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml
index c5d904baa..2b424d065 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml
index 5d296c248..37fafa2ad 100644
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml
@@ -6,8 +6,8 @@ metadata:
   namespace: default
 
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJxRENDQVU2Z0F3SUJBZ0lVWU9zcjBRZ0hPQnE0a1lSQ0w1K1REZFZ0NmJRd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFpYaGhiWEJzWlM1amIyMHdIaGNOTWpVeE1ERXdNRGN4TnpNd1doY05NelV4TURBNApNRGN4TnpNd1dqQVdNUlF3RWdZRFZRUUREQXRsZUdGdGNHeGxMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJET3JpdzNaUTd3SWhXcmJQUzZKRlFUM2JUb05DRjAwdlNWNWZhYjZUYlh5TDh0bHNHcmUKVFJJRjJFd2dzdGVNT2t4R0tLU2xEdnVhRHdxOHAvcVYrMHVqZWpCNE1CMEdBMVVkRGdRV0JCUk1Fa3VleFhRaApVdERnUmcxS0J2NzJDRHErRXpBZkJnTlZIU01FR0RBV2dCUk1Fa3VleFhRaFV0RGdSZzFLQnY3MkNEcStFekFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUNVR0ExVWRFUVFlTUJ5Q0MyVjRZVzF3YkdVdVkyOXRnZzBxTG1WNFlXMXcKYkdVdVkyOXRNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURzODdWazBzd0E2SGdPSmpST3llMW14RDgzcWNHeQpwZUZnb3hWOTNEeStjd0lnVjBNTUVKSmJWc1R5WkszRVErK1hjNXJFTDc4bnJKK1lJRVYrckNVV2o1VT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ253Z0w1RFk0VUIxNHNNNmYKRGlrUWR0cWgyUVcxQXJmRjRmYzFVRnppZmRHaFJBTkNBQVF6cTRzTjJVTzhDSVZxMnowdWlSVUU5MjA2RFFoZApOTDBsZVgybStrMjE4aS9MWmJCcTNrMFNCZGhNSUxMWGpEcE1SaWlrcFE3N21nOEt2S2Y2bGZ0TAotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
 
 ---
 kind: GatewayClass
diff --git a/pkg/provider/kubernetes/gateway/httproute.go b/pkg/provider/kubernetes/gateway/httproute.go
index ebee5fd1f..863c2f093 100644
--- a/pkg/provider/kubernetes/gateway/httproute.go
+++ b/pkg/provider/kubernetes/gateway/httproute.go
@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -19,8 +20,6 @@ import (
 	ktypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 	gatev1 "sigs.k8s.io/gateway-api/apis/v1"
-	gatev1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatev1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 )
 
 func (p *Provider) loadHTTPRoutes(ctx context.Context, gatewayListeners []gatewayListener, conf *dynamic.Configuration) {
@@ -412,85 +411,125 @@ func (p *Provider) loadHTTPServers(ctx context.Context, namespace string, route
 		}
 	}
 
-	var st *dynamic.ServersTransport
-	var protocol string
-	if p.ExperimentalChannel {
-		servicePolicies, err := p.client.ListBackendTLSPoliciesForService(namespace, string(backendRef.Name))
-		if err != nil {
-			return nil, nil, &metav1.Condition{
-				Type:               string(gatev1.RouteConditionResolvedRefs),
-				Status:             metav1.ConditionFalse,
-				ObservedGeneration: route.Generation,
-				LastTransitionTime: metav1.Now(),
-				Reason:             string(gatev1.RouteReasonRefNotPermitted),
-				Message:            fmt.Sprintf("Cannot list BackendTLSPolicies for Service %s/%s: %s", namespace, string(backendRef.Name), err),
-			}
+	backendTLSPolicies, err := p.client.ListBackendTLSPoliciesForService(namespace, string(backendRef.Name))
+	if err != nil {
+		return nil, nil, &metav1.Condition{
+			Type:               string(gatev1.RouteConditionResolvedRefs),
+			Status:             metav1.ConditionFalse,
+			ObservedGeneration: route.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.RouteReasonRefNotPermitted),
+			Message:            fmt.Sprintf("Cannot list BackendTLSPolicies for Service %s/%s: %s", namespace, string(backendRef.Name), err),
 		}
+	}
 
-		var matchedPolicy *gatev1alpha3.BackendTLSPolicy
-		for _, policy := range servicePolicies {
-			matched := false
-			for _, targetRef := range policy.Spec.TargetRefs {
-				if targetRef.SectionName == nil || svcPort.Name == string(*targetRef.SectionName) {
-					matchedPolicy = policy
-					matched = true
-					break
-				}
+	// Sort BackendTLSPolicies by creation timestamp, then by name to match the BackendTLSPolicy requirements.
+	slices.SortStableFunc(backendTLSPolicies, func(a, b *gatev1.BackendTLSPolicy) int {
+		cmpTime := a.CreationTimestamp.Time.Compare(b.CreationTimestamp.Time)
+		if cmpTime == 0 {
+			return strings.Compare(a.Name, b.Name)
+		}
+		return cmpTime
+	})
+
+	var serversTransport *dynamic.ServersTransport
+	for _, policy := range backendTLSPolicies {
+		for _, targetRef := range policy.Spec.TargetRefs {
+			if targetRef.SectionName != nil && svcPort.Name != string(*targetRef.SectionName) {
+				continue
 			}
 
-			// If the policy targets the service, but doesn't match any port.
-			if !matched {
-				// update policy status
-				status := gatev1alpha2.PolicyStatus{
-					Ancestors: []gatev1alpha2.PolicyAncestorStatus{{
-						AncestorRef: gatev1alpha2.ParentReference{
-							Group:       ptr.To(gatev1.Group(groupGateway)),
-							Kind:        ptr.To(gatev1.Kind(kindGateway)),
-							Namespace:   ptr.To(gatev1.Namespace(namespace)),
-							Name:        gatev1.ObjectName(listener.GWName),
-							SectionName: ptr.To(gatev1.SectionName(listener.Name)),
-						},
-						ControllerName: controllerName,
-						Conditions: []metav1.Condition{{
-							Type:               string(gatev1.RouteConditionResolvedRefs),
-							Status:             metav1.ConditionFalse,
-							ObservedGeneration: route.Generation,
-							LastTransitionTime: metav1.Now(),
-							Reason:             string(gatev1.RouteReasonBackendNotFound),
-							Message:            fmt.Sprintf("BackendTLSPolicy has no valid TargetRef for Service %s/%s", namespace, string(backendRef.Name)),
-						}},
-					}},
-				}
+			policyAncestorStatus := gatev1.PolicyAncestorStatus{
+				AncestorRef: gatev1.ParentReference{
+					Group:       ptr.To(gatev1.Group(groupGateway)),
+					Kind:        ptr.To(gatev1.Kind(kindGateway)),
+					Namespace:   ptr.To(gatev1.Namespace(namespace)),
+					Name:        gatev1.ObjectName(listener.GWName),
+					SectionName: ptr.To(gatev1.SectionName(listener.Name)),
+				},
+				ControllerName: controllerName,
+			}
 
+			// Multiple BackendTLSPolicies can match the same service port, meaning that there is a conflict.
+			if serversTransport != nil {
+				policyAncestorStatus.Conditions = append(policyAncestorStatus.Conditions,
+					metav1.Condition{
+						Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: policy.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.BackendTLSPolicyReasonResolvedRefs),
+					},
+					metav1.Condition{
+						Type:               string(gatev1.PolicyConditionAccepted),
+						Status:             metav1.ConditionFalse,
+						ObservedGeneration: policy.Generation,
+						LastTransitionTime: metav1.Now(),
+						Reason:             string(gatev1.PolicyReasonConflicted),
+					},
+				)
+
+				status := gatev1.PolicyStatus{
+					Ancestors: []gatev1.PolicyAncestorStatus{policyAncestorStatus},
+				}
 				if err := p.client.UpdateBackendTLSPolicyStatus(ctx, ktypes.NamespacedName{Namespace: policy.Namespace, Name: policy.Name}, status); err != nil {
-					log.Ctx(ctx).Warn().Err(err).
-						Msg("Unable to update BackendTLSPolicy status")
+					log.Ctx(ctx).Warn().Err(err).Msg("Unable to update conflicting BackendTLSPolicy status")
 				}
-			}
-		}
 
-		if matchedPolicy != nil {
-			st, err = p.loadServersTransport(namespace, *matchedPolicy)
-			if err != nil {
+				continue
+			}
+
+			var resolvedRefCondition metav1.Condition
+			serversTransport, resolvedRefCondition = p.loadServersTransport(namespace, policy)
+
+			policyAncestorStatus.Conditions = append(policyAncestorStatus.Conditions, resolvedRefCondition)
+			if resolvedRefCondition.Status == metav1.ConditionFalse {
+				policyAncestorStatus.Conditions = append(policyAncestorStatus.Conditions, metav1.Condition{
+					Type:               string(gatev1.PolicyConditionAccepted),
+					Status:             metav1.ConditionFalse,
+					ObservedGeneration: policy.Generation,
+					LastTransitionTime: metav1.Now(),
+					Reason:             string(gatev1.BackendTLSPolicyReasonNoValidCACertificate),
+				})
+			} else {
+				policyAncestorStatus.Conditions = append(policyAncestorStatus.Conditions, metav1.Condition{
+					Type:               string(gatev1.PolicyConditionAccepted),
+					Status:             metav1.ConditionTrue,
+					ObservedGeneration: policy.Generation,
+					LastTransitionTime: metav1.Now(),
+					Reason:             string(gatev1.PolicyReasonAccepted),
+				})
+			}
+
+			status := gatev1.PolicyStatus{
+				Ancestors: []gatev1.PolicyAncestorStatus{policyAncestorStatus},
+			}
+			if err := p.client.UpdateBackendTLSPolicyStatus(ctx, ktypes.NamespacedName{Namespace: policy.Namespace, Name: policy.Name}, status); err != nil {
+				log.Ctx(ctx).Warn().Err(err).Msg("Unable to update BackendTLSPolicy status")
+			}
+
+			// When something wen wrong during the loading of a ServersTransport,
+			// we stop here and return a route condition error.
+			if resolvedRefCondition.Status == metav1.ConditionFalse {
 				return nil, nil, &metav1.Condition{
 					Type:               string(gatev1.RouteConditionResolvedRefs),
 					Status:             metav1.ConditionFalse,
 					ObservedGeneration: route.Generation,
 					LastTransitionTime: metav1.Now(),
 					Reason:             string(gatev1.RouteReasonRefNotPermitted),
-					Message:            fmt.Sprintf("Cannot apply BackendTLSPolicy for Service %s/%s: %s", namespace, string(backendRef.Name), err),
+					Message:            fmt.Sprintf("Cannot apply BackendTLSPolicy for Service %s/%s: %s", namespace, string(backendRef.Name), resolvedRefCondition.Message),
 				}
 			}
-			// A backend TLS policy has been found for the service, a serversTransport configuration has been created, use/force HTTPS.
-			protocol = "https"
 		}
 	}
 
 	lb := &dynamic.ServersLoadBalancer{}
 	lb.SetDefaults()
 
-	// Guess the protocol from the service port if not set by the backend TLS policy
-	if protocol == "" {
+	// If a ServersTransport is set, it means a BackendTLSPolicy matched the service port, and we can safely assume the protocol is HTTPS.
+	// When no ServersTransport is set, we need to determine the protocol based on the service port.
+	protocol := "https"
+	if serversTransport == nil {
 		protocol, err = getHTTPServiceProtocol(svcPort)
 		if err != nil {
 			return nil, nil, &metav1.Condition{
@@ -509,40 +548,70 @@ func (p *Provider) loadHTTPServers(ctx context.Context, namespace string, route
 			URL: fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(ba.IP, strconv.Itoa(int(ba.Port)))),
 		})
 	}
-	return lb, st, nil
+	return lb, serversTransport, nil
 }
 
-func (p *Provider) loadServersTransport(namespace string, policy gatev1alpha3.BackendTLSPolicy) (*dynamic.ServersTransport, error) {
+func (p *Provider) loadServersTransport(namespace string, policy *gatev1.BackendTLSPolicy) (*dynamic.ServersTransport, metav1.Condition) {
 	st := &dynamic.ServersTransport{
 		ServerName: string(policy.Spec.Validation.Hostname),
 	}
 
 	if policy.Spec.Validation.WellKnownCACertificates != nil {
-		return st, nil
+		return st, metav1.Condition{
+			Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+			Status:             metav1.ConditionTrue,
+			ObservedGeneration: policy.Generation,
+			LastTransitionTime: metav1.Now(),
+			Reason:             string(gatev1.BackendTLSPolicyReasonResolvedRefs),
+		}
 	}
 
 	for _, caCertRef := range policy.Spec.Validation.CACertificateRefs {
 		if (caCertRef.Group != "" && caCertRef.Group != groupCore) || caCertRef.Kind != "ConfigMap" {
-			continue
+			return nil, metav1.Condition{
+				Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: policy.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.BackendTLSPolicyReasonInvalidKind),
+				Message:            "Only ConfigMaps are supported",
+			}
 		}
 
-		configMap, exists, err := p.client.GetConfigMap(namespace, string(caCertRef.Name))
+		configMap, err := p.client.GetConfigMap(namespace, string(caCertRef.Name))
 		if err != nil {
-			return nil, fmt.Errorf("getting configmap: %w", err)
-		}
-		if !exists {
-			return nil, fmt.Errorf("configmap %s/%s not found", namespace, string(caCertRef.Name))
+			return nil, metav1.Condition{
+				Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: policy.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.BackendTLSPolicyReasonInvalidCACertificateRef),
+				Message:            fmt.Sprintf("getting configmap %s/%s: %s", namespace, string(caCertRef.Name), err),
+			}
 		}
 
 		caCRT, ok := configMap.Data["ca.crt"]
 		if !ok {
-			return nil, fmt.Errorf("configmap %s/%s does not have ca.crt", namespace, string(caCertRef.Name))
+			return nil, metav1.Condition{
+				Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+				Status:             metav1.ConditionFalse,
+				ObservedGeneration: policy.Generation,
+				LastTransitionTime: metav1.Now(),
+				Reason:             string(gatev1.BackendTLSPolicyReasonInvalidCACertificateRef),
+				Message:            fmt.Sprintf("configmap %s/%s does not have a ca.crt", namespace, string(caCertRef.Name)),
+			}
 		}
 
 		st.RootCAs = append(st.RootCAs, types.FileOrContent(caCRT))
 	}
 
-	return st, nil
+	return st, metav1.Condition{
+		Type:               string(gatev1.BackendTLSPolicyConditionResolvedRefs),
+		Status:             metav1.ConditionTrue,
+		ObservedGeneration: policy.Generation,
+		LastTransitionTime: metav1.Now(),
+		Reason:             string(gatev1.BackendTLSPolicyReasonResolvedRefs),
+	}
 }
 
 func buildHostRule(hostnames []gatev1.Hostname) (string, int) {
@@ -746,7 +815,7 @@ func createRequestRedirect(filter *gatev1.HTTPRequestRedirectFilter, pathMatch g
 		port = ptr.To("")
 	}
 	if filter.Port != nil {
-		port = ptr.To(fmt.Sprintf("%d", *filter.Port))
+		port = ptr.To(strconv.Itoa(int(*filter.Port)))
 	}
 
 	var path *string
diff --git a/pkg/provider/kubernetes/gateway/kubernetes.go b/pkg/provider/kubernetes/gateway/kubernetes.go
index 3010f6bc0..0c50b76a8 100644
--- a/pkg/provider/kubernetes/gateway/kubernetes.go
+++ b/pkg/provider/kubernetes/gateway/kubernetes.go
@@ -121,7 +121,7 @@ type gatewayListener struct {
 
 	Port              gatev1.PortNumber
 	Protocol          gatev1.ProtocolType
-	TLS               *gatev1.GatewayTLSConfig
+	TLS               *gatev1.ListenerTLSConfig
 	Hostname          *gatev1.Hostname
 	Status            *gatev1.ListenerStatus
 	AllowedNamespaces []string
@@ -325,14 +325,12 @@ func (p *Provider) loadConfigurationFromGateways(ctx context.Context) *dynamic.C
 	}
 
 	var supportedFeatures []gatev1.SupportedFeature
-	if p.ExperimentalChannel {
-		for _, feature := range SupportedFeatures() {
-			supportedFeatures = append(supportedFeatures, gatev1.SupportedFeature{Name: gatev1.FeatureName(feature)})
-		}
-		slices.SortFunc(supportedFeatures, func(a, b gatev1.SupportedFeature) int {
-			return strings.Compare(string(a.Name), string(b.Name))
-		})
+	for _, feature := range SupportedFeatures() {
+		supportedFeatures = append(supportedFeatures, gatev1.SupportedFeature{Name: gatev1.FeatureName(feature)})
 	}
+	slices.SortFunc(supportedFeatures, func(a, b gatev1.SupportedFeature) int {
+		return strings.Compare(string(a.Name), string(b.Name))
+	})
 
 	gatewayClassNames := map[string]struct{}{}
 	for _, gatewayClass := range gatewayClasses {
@@ -768,12 +766,9 @@ func (p *Provider) gatewayAddresses() ([]gatev1.GatewayStatusAddress, error) {
 
 	svcRef := p.StatusAddress.Service
 	if svcRef.Name != "" && svcRef.Namespace != "" {
-		svc, exists, err := p.client.GetService(svcRef.Namespace, svcRef.Name)
+		svc, err := p.client.GetService(svcRef.Namespace, svcRef.Name)
 		if err != nil {
-			return nil, fmt.Errorf("unable to get service: %w", err)
-		}
-		if !exists {
-			return nil, fmt.Errorf("could not find a service with name %s in namespace %s", svcRef.Name, svcRef.Namespace)
+			return nil, fmt.Errorf("getting service: %w", err)
 		}
 
 		var addresses []gatev1.GatewayStatusAddress
@@ -836,25 +831,27 @@ func (p *Provider) isReferenceGranted(fromKind, fromNamespace, toGroup, toKind,
 }
 
 func (p *Provider) getTLS(secretName gatev1.ObjectName, namespace string) (*tls.CertAndStores, error) {
-	secret, exists, err := p.client.GetSecret(namespace, string(secretName))
+	secret, err := p.client.GetSecret(namespace, string(secretName))
 	if err != nil {
-		return nil, fmt.Errorf("failed to fetch secret %s/%s: %w", namespace, secretName, err)
-	}
-	if !exists {
-		return nil, fmt.Errorf("secret %s/%s does not exist", namespace, secretName)
+		return nil, fmt.Errorf("getting secret: %w", err)
 	}
 
 	cert, key, err := getCertificateBlocks(secret, namespace, string(secretName))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("getting certificate blocks: %w", err)
 	}
 
-	return &tls.CertAndStores{
+	certAndStore := &tls.CertAndStores{
 		Certificate: tls.Certificate{
 			CertFile: types.FileOrContent(cert),
 			KeyFile:  types.FileOrContent(key),
 		},
-	}, nil
+	}
+	if _, err := certAndStore.GetCertificate(); err != nil {
+		return nil, fmt.Errorf("validating certificate: %w", err)
+	}
+
+	return certAndStore, nil
 }
 
 func (p *Provider) allowedNamespaces(gatewayNamespace string, routeNamespaces *gatev1.RouteNamespaces) ([]string, error) {
@@ -891,20 +888,17 @@ func (p *Provider) getBackendAddresses(namespace string, ref gatev1.BackendRef)
 		return nil, corev1.ServicePort{}, errors.New("port is required for Kubernetes Service reference")
 	}
 
-	service, exists, err := p.client.GetService(namespace, string(ref.Name))
+	service, err := p.client.GetService(namespace, string(ref.Name))
 	if err != nil {
 		return nil, corev1.ServicePort{}, fmt.Errorf("getting service: %w", err)
 	}
-	if !exists {
-		return nil, corev1.ServicePort{}, errors.New("service not found")
-	}
 	if service.Spec.Type == corev1.ServiceTypeExternalName {
 		return nil, corev1.ServicePort{}, errors.New("type ExternalName is not supported for Kubernetes Service reference")
 	}
 
 	var svcPort *corev1.ServicePort
 	for _, p := range service.Spec.Ports {
-		if p.Port == int32(*ref.Port) {
+		if p.Port == *ref.Port {
 			svcPort = &p
 			break
 		}
diff --git a/pkg/provider/kubernetes/gateway/kubernetes_test.go b/pkg/provider/kubernetes/gateway/kubernetes_test.go
index 90e93f64f..1f5c1df8f 100644
--- a/pkg/provider/kubernetes/gateway/kubernetes_test.go
+++ b/pkg/provider/kubernetes/gateway/kubernetes_test.go
@@ -49,10 +49,29 @@ func init() {
 	}
 }
 
+const (
+	listenerCert string = `-----BEGIN CERTIFICATE-----
+MIIBqDCCAU6gAwIBAgIUYOsr0QgHOBq4kYRCL5+TDdVt6bQwCgYIKoZIzj0EAwIw
+FjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcNMjUxMDEwMDcxNzMwWhcNMzUxMDA4
+MDcxNzMwWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABDOriw3ZQ7wIhWrbPS6JFQT3bToNCF00vSV5fab6TbXyL8tlsGre
+TRIF2EwgsteMOkxGKKSlDvuaDwq8p/qV+0ujejB4MB0GA1UdDgQWBBRMEkuexXQh
+UtDgRg1KBv72CDq+EzAfBgNVHSMEGDAWgBRMEkuexXQhUtDgRg1KBv72CDq+EzAP
+BgNVHRMBAf8EBTADAQH/MCUGA1UdEQQeMByCC2V4YW1wbGUuY29tgg0qLmV4YW1w
+bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIQDs87Vk0swA6HgOJjROye1mxD83qcGy
+peFgoxV93Dy+cwIgV0MMEJJbVsTyZK3EQ++Xc5rEL78nrJ+YIEV+rCUWj5U=
+-----END CERTIFICATE-----`
+	listenerKey string = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgnwgL5DY4UB14sM6f
+DikQdtqh2QW1ArfF4fc1UFzifdGhRANCAAQzq4sN2UO8CIVq2z0uiRUE9206DQhd
+NL0leX2m+k218i/LZbBq3k0SBdhMILLXjDpMRiikpQ77mg8KvKf6lftL
+-----END PRIVATE KEY-----`
+)
+
 func TestGatewayClassLabelSelector(t *testing.T) {
 	k8sObjects, gwObjects := readResources(t, []string{"gatewayclass_labelselector.yaml"})
 
-	kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+	kubeClient := kubefake.NewClientset(k8sObjects...)
 	gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 	client := newClientImpl(kubeClient, gwClient)
@@ -561,8 +580,8 @@ func TestLoadHTTPRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -755,8 +774,8 @@ func TestLoadHTTPRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -1214,8 +1233,8 @@ func TestLoadHTTPRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -1308,8 +1327,8 @@ func TestLoadHTTPRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -2202,74 +2221,11 @@ func TestLoadHTTPRoutes(t *testing.T) {
 			},
 		},
 		{
-			desc:  "Simple HTTPRoute and BackendTLSPolicy, experimental channel disabled",
+			desc:  "Simple HTTPRoute and BackendTLSPolicy with CA certificate",
 			paths: []string{"services.yml", "httproute/with_backend_tls_policy.yml"},
 			entryPoints: map[string]Entrypoint{"web": {
 				Address: ":80",
 			}},
-			expected: &dynamic.Configuration{
-				UDP: &dynamic.UDPConfiguration{
-					Routers:  map[string]*dynamic.UDPRouter{},
-					Services: map[string]*dynamic.UDPService{},
-				},
-				TCP: &dynamic.TCPConfiguration{
-					Routers:           map[string]*dynamic.TCPRouter{},
-					Middlewares:       map[string]*dynamic.TCPMiddleware{},
-					Services:          map[string]*dynamic.TCPService{},
-					ServersTransports: map[string]*dynamic.TCPServersTransport{},
-				},
-				HTTP: &dynamic.HTTPConfiguration{
-					Routers: map[string]*dynamic.Router{
-						"httproute-default-http-app-1-gw-default-my-gateway-ep-web-0-1c0cf64bde37d9d0df06": {
-							EntryPoints: []string{"web"},
-							Service:     "httproute-default-http-app-1-gw-default-my-gateway-ep-web-0-1c0cf64bde37d9d0df06-wrr",
-							Rule:        "Host(`foo.com`) && Path(`/bar`)",
-							Priority:    100008,
-							RuleSyntax:  "default",
-						},
-					},
-					Middlewares: map[string]*dynamic.Middleware{},
-					Services: map[string]*dynamic.Service{
-						"httproute-default-http-app-1-gw-default-my-gateway-ep-web-0-1c0cf64bde37d9d0df06-wrr": {
-							Weighted: &dynamic.WeightedRoundRobin{
-								Services: []dynamic.WRRService{
-									{
-										Name:   "default-whoami-http-80",
-										Weight: ptr.To(1),
-									},
-								},
-							},
-						},
-						"default-whoami-http-80": {
-							LoadBalancer: &dynamic.ServersLoadBalancer{
-								Strategy: dynamic.BalancerStrategyWRR,
-								Servers: []dynamic.Server{
-									{
-										URL: "http://10.10.0.1:80",
-									},
-									{
-										URL: "http://10.10.0.2:80",
-									},
-								},
-								PassHostHeader: ptr.To(true),
-								ResponseForwarding: &dynamic.ResponseForwarding{
-									FlushInterval: ptypes.Duration(100 * time.Millisecond),
-								},
-							},
-						},
-					},
-					ServersTransports: map[string]*dynamic.ServersTransport{},
-				},
-				TLS: &dynamic.TLSConfiguration{},
-			},
-		},
-		{
-			desc:  "Simple HTTPRoute and BackendTLSPolicy with CA certificate, experimental channel enabled",
-			paths: []string{"services.yml", "httproute/with_backend_tls_policy.yml"},
-			entryPoints: map[string]Entrypoint{"web": {
-				Address: ":80",
-			}},
-			experimentalChannel: true,
 			expected: &dynamic.Configuration{
 				UDP: &dynamic.UDPConfiguration{
 					Routers:  map[string]*dynamic.UDPRouter{},
@@ -2326,8 +2282,8 @@ func TestLoadHTTPRoutes(t *testing.T) {
 						"default-whoami-http-80": {
 							ServerName: "whoami",
 							RootCAs: []types.FileOrContent{
-								"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=",
-								"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=",
+								"CA1",
+								"CA2",
 							},
 						},
 					},
@@ -2336,12 +2292,11 @@ func TestLoadHTTPRoutes(t *testing.T) {
 			},
 		},
 		{
-			desc:  "Simple HTTPRoute and BackendTLSPolicy with System CA, experimental channel enabled",
+			desc:  "Simple HTTPRoute and BackendTLSPolicy with System CA",
 			paths: []string{"services.yml", "httproute/with_backend_tls_policy_system.yml"},
 			entryPoints: map[string]Entrypoint{"web": {
 				Address: ":80",
 			}},
-			experimentalChannel: true,
 			expected: &dynamic.Configuration{
 				UDP: &dynamic.UDPConfiguration{
 					Routers:  map[string]*dynamic.UDPRouter{},
@@ -2597,7 +2552,7 @@ func TestLoadHTTPRoutes(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -3058,7 +3013,7 @@ func TestLoadHTTPRoutes_backendExtensionRef(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -3344,7 +3299,7 @@ func TestLoadHTTPRoutes_filterExtensionRef(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, []string{"services.yml", "httproute/filter_extension_ref.yml"})
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -3636,7 +3591,7 @@ func TestLoadGRPCRoutes_filterExtensionRef(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, []string{"services.yml", "grpcroute/filter_extension_ref.yml"})
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -4217,8 +4172,8 @@ func TestLoadTCPRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -4597,7 +4552,7 @@ func TestLoadTCPRoutes(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -4809,8 +4764,8 @@ func TestLoadTLSRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -4909,8 +4864,8 @@ func TestLoadTLSRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -5127,8 +5082,8 @@ func TestLoadTLSRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -5197,8 +5152,8 @@ func TestLoadTLSRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -5876,7 +5831,7 @@ func TestLoadTLSRoutes(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -6165,8 +6120,8 @@ func TestLoadMixedRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -6354,8 +6309,8 @@ func TestLoadMixedRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -6612,8 +6567,8 @@ func TestLoadMixedRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -6773,8 +6728,8 @@ func TestLoadMixedRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -6913,8 +6868,8 @@ func TestLoadMixedRoutes(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -6933,7 +6888,7 @@ func TestLoadMixedRoutes(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -7125,8 +7080,8 @@ func TestLoadRoutesWithReferenceGrants(t *testing.T) {
 					Certificates: []*tls.CertAndStores{
 						{
 							Certificate: tls.Certificate{
-								CertFile: types.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
-								KeyFile:  types.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+								CertFile: types.FileOrContent(listenerCert),
+								KeyFile:  types.FileOrContent(listenerKey),
 							},
 						},
 					},
@@ -7269,7 +7224,7 @@ func TestLoadRoutesWithReferenceGrants(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -8174,7 +8129,7 @@ func Test_gatewayAddresses(t *testing.T) {
 
 			k8sObjects, gwObjects := readResources(t, test.paths)
 
-			kubeClient := kubefake.NewSimpleClientset(k8sObjects...)
+			kubeClient := kubefake.NewClientset(k8sObjects...)
 			gwClient := newGatewaySimpleClientSet(t, gwObjects...)
 
 			client := newClientImpl(kubeClient, gwClient)
@@ -8330,7 +8285,7 @@ func Test_upsertRouteConditionResolvedRefs(t *testing.T) {
 	}
 }
 
-// We cannot use the gateway-api fake.NewSimpleClientset due to Gateway being pluralized as "gatewaies" instead of "gateways".
+// We cannot use the gateway-api fake.NewClientset due to Gateway being pluralized as "gatewaies" instead of "gateways".
 func newGatewaySimpleClientSet(t *testing.T, objects ...runtime.Object) *gatefake.Clientset {
 	t.Helper()
 
diff --git a/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/00-ingress-with-no-annotation.yml b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/00-ingress-with-no-annotation.yml
new file mode 100644
index 000000000..8b92a5958
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/00-ingress-with-no-annotation.yml
@@ -0,0 +1,23 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress-with-no-annotation
+  namespace: default
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: whoami.localhost
+      http:
+        paths:
+          - backend:
+              service:
+                name: whoami
+                port:
+                  number: 80
+            path: /
+            pathType: Prefix
+  tls:
+    - hosts:
+        - whoami.localhost
+      secretName: whoami-tls
diff --git a/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/10-ingress-with-use-regex.yml b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/10-ingress-with-use-regex.yml
new file mode 100644
index 000000000..4cd26cff9
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/10-ingress-with-use-regex.yml
@@ -0,0 +1,22 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress-with-use-regex
+  namespace: default
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: use-regex.localhost
+      http:
+        paths:
+          - path: /test(.*)
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: whoami
+                port:
+                  number: 80
diff --git a/pkg/provider/kubernetes/ingress-nginx/kubernetes.go b/pkg/provider/kubernetes/ingress-nginx/kubernetes.go
index e8f583ba0..268db6ef7 100644
--- a/pkg/provider/kubernetes/ingress-nginx/kubernetes.go
+++ b/pkg/provider/kubernetes/ingress-nginx/kubernetes.go
@@ -22,7 +22,6 @@ import (
 	"github.com/traefik/traefik/v3/pkg/job"
 	"github.com/traefik/traefik/v3/pkg/observability/logs"
 	"github.com/traefik/traefik/v3/pkg/provider"
-	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/k8s"
 	"github.com/traefik/traefik/v3/pkg/safe"
 	"github.com/traefik/traefik/v3/pkg/tls"
 	"github.com/traefik/traefik/v3/pkg/types"
@@ -80,6 +79,9 @@ type Provider struct {
 	DefaultBackendService  string `description:"Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'." json:"defaultBackendService,omitempty" toml:"defaultBackendService,omitempty" yaml:"defaultBackendService,omitempty" export:"true"`
 	DisableSvcExternalName bool   `description:"Disable support for Services of type ExternalName." json:"disableSvcExternalName,omitempty" toml:"disableSvcExternalName,omitempty" yaml:"disableSvcExternalName,omitempty" export:"true"`
 
+	// NonTLSEntryPoints contains the names of entrypoints that are configured without TLS.
+	NonTLSEntryPoints []string `json:"-" toml:"-" yaml:"-" label:"-" file:"-"`
+
 	defaultBackendServiceNamespace string
 	defaultBackendServiceName      string
 
@@ -453,7 +455,7 @@ func (p *Provider) loadConfiguration(ctx context.Context) *dynamic.Configuration
 				}
 
 				// TODO: if no service, do not add middlewares and 503.
-				serviceName := provider.Normalize(ingress.Namespace + "-" + pa.Backend.Service.Name + "-" + portString)
+				serviceName := provider.Normalize(ingress.Namespace + "-" + ingress.Name + "-" + pa.Backend.Service.Name + "-" + portString)
 
 				service, err := p.buildService(ingress.Namespace, pa.Backend, ingressConfig)
 				if err != nil {
@@ -509,7 +511,7 @@ func (p *Provider) buildServersTransport(namespace, name string, cfg ingressConf
 		Name: provider.Normalize(namespace + "-" + name),
 		ServersTransport: &dynamic.ServersTransport{
 			ServerName:         ptr.Deref(cfg.ProxySSLName, ptr.Deref(cfg.ProxySSLServerName, "")),
-			InsecureSkipVerify: strings.ToLower(ptr.Deref(cfg.ProxySSLVerify, "off")) == "on",
+			InsecureSkipVerify: strings.ToLower(ptr.Deref(cfg.ProxySSLVerify, "off")) == "off",
 		},
 	}
 
@@ -643,7 +645,10 @@ func (p *Provider) getBackendAddresses(namespace string, backend netv1.IngressBa
 		}
 
 		for _, endpoint := range endpointSlice.Endpoints {
-			if !k8s.EndpointServing(endpoint) {
+			// The Serving condition allows to track if the Pod can receive traffic.
+			// It is set to true when the Pod is Ready or Terminating.
+			// From the go documentation, a nil value should be interpreted as "true".
+			if !ptr.Deref(endpoint.Conditions.Serving, true) {
 				continue
 			}
 
@@ -655,7 +660,7 @@ func (p *Provider) getBackendAddresses(namespace string, backend netv1.IngressBa
 				uniqAddresses[address] = struct{}{}
 				addresses = append(addresses, backendAddress{
 					Address: net.JoinHostPort(address, strconv.Itoa(int(port))),
-					Fenced:  ptr.Deref(endpoint.Conditions.Terminating, false) && ptr.Deref(endpoint.Conditions.Serving, false),
+					Fenced:  ptr.Deref(endpoint.Conditions.Terminating, false),
 				})
 			}
 		}
@@ -798,7 +803,7 @@ func (p *Provider) applyMiddlewares(namespace, routerKey string, ingressConfig i
 
 	// Apply SSL redirect is mandatory to be applied after all other middlewares.
 	// TODO: check how to remove this, and create the HTTP router elsewhere.
-	applySSLRedirectConfiguration(routerKey, ingressConfig, hasTLS, rt, conf)
+	p.applySSLRedirectConfiguration(routerKey, ingressConfig, hasTLS, rt, conf)
 
 	return nil
 }
@@ -934,7 +939,7 @@ func applyCORSConfiguration(routerName string, ingressConfig ingressConfig, rt *
 	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
 }
 
-func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
+func (p *Provider) applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
 	var forceSSLRedirect bool
 	if ingressConfig.ForceSSLRedirect != nil {
 		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
@@ -942,39 +947,52 @@ func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfi
 
 	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)
 
-	if !forceSSLRedirect && !sslRedirect {
-		if hasTLS {
-			httpRouter := &dynamic.Router{
-				Rule: rt.Rule,
-				// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.
-				RuleSyntax:  "default",
-				Middlewares: rt.Middlewares,
-				Service:     rt.Service,
-			}
+	if hasTLS {
+		// An Ingress with TLS configuration creates only a Traefik router with a TLS configuration,
+		// so no Non-TLS router exists to handle HTTP traffic, and we should create it.
+		httpRouter := &dynamic.Router{
+			// Only attach to entryPoint which do not activate TLS.
+			EntryPoints: p.NonTLSEntryPoints,
+			Rule:        rt.Rule,
+			// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.
+			RuleSyntax:  "default",
+			Middlewares: rt.Middlewares,
+			Service:     rt.Service,
+		}
+		conf.HTTP.Routers[routerName+"-http"] = httpRouter
 
-			conf.HTTP.Routers[routerName+"-http"] = httpRouter
+		// If either forceSSLRedirect or sslRedirect are enabled,
+		// the HTTP router needs to redirect to HTTPS.
+		if forceSSLRedirect || sslRedirect {
+			redirectMiddlewareName := routerName + "-redirect-scheme"
+			conf.HTTP.Middlewares[redirectMiddlewareName] = &dynamic.Middleware{
+				RedirectScheme: &dynamic.RedirectScheme{
+					Scheme:                 "https",
+					ForcePermanentRedirect: true,
+				},
+			}
+			httpRouter.Middlewares = []string{redirectMiddlewareName}
+			httpRouter.Service = "noop@internal"
 		}
 
 		return
 	}
 
-	redirectRouter := &dynamic.Router{
-		Rule: rt.Rule,
-		// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.
-		RuleSyntax: "default",
-		Service:    "noop@internal",
+	// An Ingress with no TLS configuration and forceSSLRedirect annotation should always redirect on HTTPS,
+	// even if no route exists for HTTPS.
+	if forceSSLRedirect {
+		redirectMiddlewareName := routerName + "-redirect-scheme"
+		conf.HTTP.Middlewares[redirectMiddlewareName] = &dynamic.Middleware{
+			RedirectScheme: &dynamic.RedirectScheme{
+				Scheme:                 "https",
+				ForcePermanentRedirect: true,
+			},
+		}
+		rt.Middlewares = append([]string{redirectMiddlewareName}, rt.Middlewares...)
 	}
 
-	redirectMiddlewareName := routerName + "-redirect-scheme"
-	conf.HTTP.Middlewares[redirectMiddlewareName] = &dynamic.Middleware{
-		RedirectScheme: &dynamic.RedirectScheme{
-			Scheme:    "https",
-			Permanent: true,
-		},
-	}
-	redirectRouter.Middlewares = append(redirectRouter.Middlewares, redirectMiddlewareName)
-
-	conf.HTTP.Routers[routerName+"-redirect"] = redirectRouter
+	// An Ingress that is not forcing sslRedirect and has no TLS configuration does not redirect,
+	// even if sslRedirect is enabled.
 }
 
 func applyForwardAuthConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) error {
@@ -1049,7 +1067,7 @@ func buildRule(host string, pa netv1.HTTPIngressPath, config ingressConfig) stri
 			rules = append(rules, fmt.Sprintf("Path(`%s`)", pa.Path))
 		case netv1.PathTypePrefix:
 			if ptr.Deref(config.UseRegex, false) {
-				rules = append(rules, fmt.Sprintf("PathRegexp(`^%s`)", regexp.QuoteMeta(pa.Path)))
+				rules = append(rules, fmt.Sprintf("PathRegexp(`^%s`)", pa.Path))
 			} else {
 				rules = append(rules, buildPrefixRule(pa.Path))
 			}
diff --git a/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go b/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go
index 37f819300..95781e8c8 100644
--- a/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go
+++ b/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go
@@ -46,6 +46,76 @@ func TestLoadIngresses(t *testing.T) {
 				TLS: &dynamic.TLSConfiguration{},
 			},
 		},
+		{
+			desc: "No annotation",
+			paths: []string{
+				"ingresses/00-ingress-with-no-annotation.yml",
+				"ingressclasses.yml",
+				"services.yml",
+				"secrets.yml",
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:  map[string]*dynamic.TCPRouter{},
+					Services: map[string]*dynamic.TCPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-ingress-with-no-annotation-rule-0-path-0": {
+							Rule:       "Host(`whoami.localhost`) && PathPrefix(`/`)",
+							RuleSyntax: "default",
+							TLS:        &dynamic.RouterTLSConfig{},
+							Service:    "default-ingress-with-no-annotation-whoami-80",
+						},
+						"default-ingress-with-no-annotation-rule-0-path-0-http": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`whoami.localhost`) && PathPrefix(`/`)",
+							RuleSyntax:  "default",
+							Middlewares: []string{"default-ingress-with-no-annotation-rule-0-path-0-redirect-scheme"},
+							Service:     "noop@internal",
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{
+						"default-ingress-with-no-annotation-rule-0-path-0-redirect-scheme": {
+							RedirectScheme: &dynamic.RedirectScheme{
+								Scheme:                 "https",
+								ForcePermanentRedirect: true,
+							},
+						},
+					},
+					Services: map[string]*dynamic.Service{
+						"default-ingress-with-no-annotation-whoami-80": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.1:80",
+									},
+									{
+										URL: "http://10.10.0.2:80",
+									},
+								},
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: dynamic.DefaultFlushInterval,
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{
+					Certificates: []*tls.CertAndStores{
+						{
+							Certificate: tls.Certificate{
+								CertFile: "-----BEGIN CERTIFICATE-----",
+								KeyFile:  "-----BEGIN CERTIFICATE-----",
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			desc: "Basic Auth",
 			paths: []string{
@@ -64,7 +134,7 @@ func TestLoadIngresses(t *testing.T) {
 							Rule:        "Host(`whoami.localhost`) && Path(`/basicauth`)",
 							RuleSyntax:  "default",
 							Middlewares: []string{"default-ingress-with-basicauth-rule-0-path-0-basic-auth"},
-							Service:     "default-whoami-80",
+							Service:     "default-ingress-with-basicauth-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{
@@ -78,7 +148,7 @@ func TestLoadIngresses(t *testing.T) {
 						},
 					},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-basicauth-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -119,7 +189,7 @@ func TestLoadIngresses(t *testing.T) {
 							Rule:        "Host(`whoami.localhost`) && Path(`/forwardauth`)",
 							RuleSyntax:  "default",
 							Middlewares: []string{"default-ingress-with-forwardauth-rule-0-path-0-forward-auth"},
-							Service:     "default-whoami-80",
+							Service:     "default-ingress-with-forwardauth-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{
@@ -131,7 +201,7 @@ func TestLoadIngresses(t *testing.T) {
 						},
 					},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-forwardauth-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -173,53 +243,84 @@ func TestLoadIngresses(t *testing.T) {
 							Rule:       "Host(`sslredirect.localhost`) && Path(`/`)",
 							RuleSyntax: "default",
 							TLS:        &dynamic.RouterTLSConfig{},
-							Service:    "default-whoami-80",
+							Service:    "default-ingress-with-ssl-redirect-whoami-80",
 						},
-						"default-ingress-with-ssl-redirect-rule-0-path-0-redirect": {
+						"default-ingress-with-ssl-redirect-rule-0-path-0-http": {
+							EntryPoints: []string{"web"},
 							Rule:        "Host(`sslredirect.localhost`) && Path(`/`)",
 							RuleSyntax:  "default",
 							Middlewares: []string{"default-ingress-with-ssl-redirect-rule-0-path-0-redirect-scheme"},
 							Service:     "noop@internal",
 						},
 						"default-ingress-without-ssl-redirect-rule-0-path-0-http": {
-							Rule:       "Host(`withoutsslredirect.localhost`) && Path(`/`)",
-							RuleSyntax: "default",
-							Service:    "default-whoami-80",
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`withoutsslredirect.localhost`) && Path(`/`)",
+							RuleSyntax:  "default",
+							Service:     "default-ingress-without-ssl-redirect-whoami-80",
 						},
 						"default-ingress-without-ssl-redirect-rule-0-path-0": {
 							Rule:       "Host(`withoutsslredirect.localhost`) && Path(`/`)",
 							RuleSyntax: "default",
 							TLS:        &dynamic.RouterTLSConfig{},
-							Service:    "default-whoami-80",
+							Service:    "default-ingress-without-ssl-redirect-whoami-80",
 						},
 						"default-ingress-with-force-ssl-redirect-rule-0-path-0": {
-							Rule:       "Host(`forcesslredirect.localhost`) && Path(`/`)",
-							RuleSyntax: "default",
-							Service:    "default-whoami-80",
-						},
-						"default-ingress-with-force-ssl-redirect-rule-0-path-0-redirect": {
 							Rule:        "Host(`forcesslredirect.localhost`) && Path(`/`)",
 							RuleSyntax:  "default",
 							Middlewares: []string{"default-ingress-with-force-ssl-redirect-rule-0-path-0-redirect-scheme"},
-							Service:     "noop@internal",
+							Service:     "default-ingress-with-force-ssl-redirect-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{
 						"default-ingress-with-ssl-redirect-rule-0-path-0-redirect-scheme": {
 							RedirectScheme: &dynamic.RedirectScheme{
-								Scheme:    "https",
-								Permanent: true,
+								Scheme:                 "https",
+								ForcePermanentRedirect: true,
 							},
 						},
 						"default-ingress-with-force-ssl-redirect-rule-0-path-0-redirect-scheme": {
 							RedirectScheme: &dynamic.RedirectScheme{
-								Scheme:    "https",
-								Permanent: true,
+								Scheme:                 "https",
+								ForcePermanentRedirect: true,
 							},
 						},
 					},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-ssl-redirect-whoami-80": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.1:80",
+									},
+									{
+										URL: "http://10.10.0.2:80",
+									},
+								},
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: dynamic.DefaultFlushInterval,
+								},
+							},
+						},
+						"default-ingress-without-ssl-redirect-whoami-80": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.1:80",
+									},
+									{
+										URL: "http://10.10.0.2:80",
+									},
+								},
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: dynamic.DefaultFlushInterval,
+								},
+							},
+						},
+						"default-ingress-with-force-ssl-redirect-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -313,12 +414,12 @@ func TestLoadIngresses(t *testing.T) {
 						"default-ingress-with-sticky-rule-0-path-0": {
 							Rule:       "Host(`sticky.localhost`) && Path(`/`)",
 							RuleSyntax: "default",
-							Service:    "default-whoami-80",
+							Service:    "default-ingress-with-sticky-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-sticky-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -370,12 +471,12 @@ func TestLoadIngresses(t *testing.T) {
 						"default-ingress-with-proxy-ssl-rule-0-path-0": {
 							Rule:       "Host(`proxy-ssl.localhost`) && Path(`/`)",
 							RuleSyntax: "default",
-							Service:    "default-whoami-tls-443",
+							Service:    "default-ingress-with-proxy-ssl-whoami-tls-443",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-tls-443": {
+						"default-ingress-with-proxy-ssl-whoami-tls-443": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -397,7 +498,7 @@ func TestLoadIngresses(t *testing.T) {
 					ServersTransports: map[string]*dynamic.ServersTransport{
 						"default-ingress-with-proxy-ssl": {
 							ServerName:         "whoami.localhost",
-							InsecureSkipVerify: true,
+							InsecureSkipVerify: false,
 							RootCAs:            []types.FileOrContent{"-----BEGIN CERTIFICATE-----"},
 						},
 					},
@@ -423,7 +524,7 @@ func TestLoadIngresses(t *testing.T) {
 							Rule:        "Host(`cors.localhost`) && Path(`/`)",
 							RuleSyntax:  "default",
 							Middlewares: []string{"default-ingress-with-cors-rule-0-path-0-cors"},
-							Service:     "default-whoami-80",
+							Service:     "default-ingress-with-cors-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{
@@ -439,7 +540,7 @@ func TestLoadIngresses(t *testing.T) {
 						},
 					},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-cors-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -479,12 +580,12 @@ func TestLoadIngresses(t *testing.T) {
 						"default-ingress-with-service-upstream-rule-0-path-0": {
 							Rule:       "Host(`service-upstream.localhost`) && Path(`/`)",
 							RuleSyntax: "default",
-							Service:    "default-whoami-80",
+							Service:    "default-ingress-with-service-upstream-whoami-80",
 						},
 					},
 					Middlewares: map[string]*dynamic.Middleware{},
 					Services: map[string]*dynamic.Service{
-						"default-whoami-80": {
+						"default-ingress-with-service-upstream-whoami-80": {
 							LoadBalancer: &dynamic.ServersLoadBalancer{
 								Servers: []dynamic.Server{
 									{
@@ -504,6 +605,51 @@ func TestLoadIngresses(t *testing.T) {
 				TLS: &dynamic.TLSConfiguration{},
 			},
 		},
+		{
+			desc: "Use Regex",
+			paths: []string{
+				"services.yml",
+				"ingressclasses.yml",
+				"ingresses/10-ingress-with-use-regex.yml",
+			},
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{
+					Routers:  map[string]*dynamic.TCPRouter{},
+					Services: map[string]*dynamic.TCPService{},
+				},
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-ingress-with-use-regex-rule-0-path-0": {
+							Rule:       "Host(`use-regex.localhost`) && PathRegexp(`^/test(.*)`)",
+							RuleSyntax: "default",
+							Service:    "default-ingress-with-use-regex-whoami-80",
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services: map[string]*dynamic.Service{
+						"default-ingress-with-use-regex-whoami-80": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.10.0.1:80",
+									},
+									{
+										URL: "http://10.10.0.2:80",
+									},
+								},
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: dynamic.DefaultFlushInterval,
+								},
+							},
+						},
+					},
+					ServersTransports: map[string]*dynamic.ServersTransport{},
+				},
+				TLS: &dynamic.TLSConfiguration{},
+			},
+		},
 		{
 			desc:                           "Default Backend",
 			defaultBackendServiceName:      "whoami",
@@ -579,6 +725,7 @@ func TestLoadIngresses(t *testing.T) {
 				k8sClient:                      client,
 				defaultBackendServiceName:      test.defaultBackendServiceName,
 				defaultBackendServiceNamespace: test.defaultBackendServiceNamespace,
+				NonTLSEntryPoints:              []string{"web"},
 			}
 			p.SetDefaults()
 
diff --git a/pkg/provider/kubernetes/ingress/client_test.go b/pkg/provider/kubernetes/ingress/client_test.go
index 9014265bd..38b7e475b 100644
--- a/pkg/provider/kubernetes/ingress/client_test.go
+++ b/pkg/provider/kubernetes/ingress/client_test.go
@@ -149,7 +149,7 @@ func TestClientIgnoresHelmOwnedSecrets(t *testing.T) {
 		},
 	}
 
-	kubeClient := kubefake.NewSimpleClientset(helmSecret, secret)
+	kubeClient := kubefake.NewClientset(helmSecret, secret)
 
 	discovery, _ := kubeClient.Discovery().(*discoveryfake.FakeDiscovery)
 	discovery.FakedServerVersion = &kversion.Info{
@@ -224,7 +224,7 @@ func TestClientIgnoresEmptyEndpointSliceUpdates(t *testing.T) {
 		}},
 	}
 
-	kubeClient := kubefake.NewSimpleClientset(emptyEndpointSlice, filledEndpointSlice)
+	kubeClient := kubefake.NewClientset(emptyEndpointSlice, filledEndpointSlice)
 
 	discovery, _ := kubeClient.Discovery().(*discoveryfake.FakeDiscovery)
 	discovery.FakedServerVersion = &kversion.Info{
diff --git a/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-defaultbackend-with-resource.yml b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-defaultbackend-with-resource.yml
new file mode 100644
index 000000000..2d21ccab4
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-defaultbackend-with-resource.yml
@@ -0,0 +1,12 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: defaultbackend
+  namespace: testing
+
+spec:
+  defaultBackend:
+    resource:
+      apiGroup: example.com
+      kind: SomeBackend
+      name: foo
diff --git a/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-empty-defaultbackend.yml b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-empty-defaultbackend.yml
new file mode 100644
index 000000000..9eff4acd5
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-empty-defaultbackend.yml
@@ -0,0 +1,8 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: defaultbackend
+  namespace: testing
+
+spec:
+  defaultBackend: {}
diff --git a/pkg/provider/kubernetes/ingress/fixtures/Published-Service-ExternalName.yml b/pkg/provider/kubernetes/ingress/fixtures/Published-Service-ExternalName.yml
new file mode 100644
index 000000000..150c3b7c8
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress/fixtures/Published-Service-ExternalName.yml
@@ -0,0 +1,83 @@
+---
+kind: Node
+apiVersion: v1
+metadata:
+  name: node1
+
+status:
+  addresses:
+    - type: ExternalIP
+      address: 1.2.3.4
+
+---
+kind: Node
+apiVersion: v1
+metadata:
+  name: node2
+
+status:
+  addresses:
+    - type: ExternalIP
+      address: 5.6.7.8
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: published-service
+  namespace: default
+
+spec:
+  type: ExternalName
+  externalName: example.com
+
+---
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: foo
+  namespace: default
+
+spec:
+  rules:
+  - host: "*.foo.com"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: service1
+            port:
+              number: 80
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: default
+
+spec:
+  ports:
+    - port: 80
+
+  clusterIP: 10.0.0.1
+
+---
+kind: EndpointSlice
+apiVersion: discovery.k8s.io/v1
+metadata:
+  name: service1-abc
+  labels:
+    kubernetes.io/service-name: service1
+
+addressType: IPv4
+ports:
+  - port: 8080
+    name: ""
+endpoints:
+  - addresses:
+      - 10.10.0.1
+    conditions:
+      ready: true
diff --git a/pkg/provider/kubernetes/ingress/kubernetes.go b/pkg/provider/kubernetes/ingress/kubernetes.go
index 7a1919b3e..55d2ec6db 100644
--- a/pkg/provider/kubernetes/ingress/kubernetes.go
+++ b/pkg/provider/kubernetes/ingress/kubernetes.go
@@ -269,6 +269,17 @@ func (p *Provider) loadConfigurationFromIngresses(ctx context.Context, client Cl
 				continue
 			}
 
+			if ingress.Spec.DefaultBackend.Resource != nil {
+				// https://kubernetes.io/docs/concepts/services-networking/ingress/#resource-backend
+				logger.Error().Msg("Resource is not supported for default backend")
+				continue
+			}
+
+			if ingress.Spec.DefaultBackend.Service == nil {
+				logger.Error().Msg("Default backend is missing service definition")
+				continue
+			}
+
 			service, err := p.loadService(client, ingress.Namespace, *ingress.Spec.DefaultBackend)
 			if err != nil {
 				logger.Error().
@@ -484,6 +495,11 @@ func (p *Provider) updateIngressStatus(ing *netv1.Ingress, k8sClient Client) err
 			}
 		}
 
+	case corev1.ServiceTypeExternalName:
+		ingressStatus = []netv1.IngressLoadBalancerIngress{{
+			Hostname: service.Spec.ExternalName,
+		}}
+
 	default:
 		return fmt.Errorf("unsupported service type: %s", service.Spec.Type)
 	}
@@ -646,7 +662,10 @@ func (p *Provider) loadService(client Client, namespace string, backend netv1.In
 		protocol := getProtocol(portSpec, portName, svcConfig)
 
 		for _, endpoint := range endpointSlice.Endpoints {
-			if !k8s.EndpointServing(endpoint) {
+			// The Serving condition allows to track if the Pod can receive traffic.
+			// It is set to true when the Pod is Ready or Terminating.
+			// From the go documentation, a nil value should be interpreted as "true".
+			if !ptr.Deref(endpoint.Conditions.Serving, true) {
 				continue
 			}
 
@@ -658,7 +677,7 @@ func (p *Provider) loadService(client Client, namespace string, backend netv1.In
 				addresses[address] = struct{}{}
 				svc.LoadBalancer.Servers = append(svc.LoadBalancer.Servers, dynamic.Server{
 					URL:    fmt.Sprintf("%s://%s", protocol, net.JoinHostPort(address, strconv.Itoa(int(port)))),
-					Fenced: ptr.Deref(endpoint.Conditions.Terminating, false) && ptr.Deref(endpoint.Conditions.Serving, false),
+					Fenced: ptr.Deref(endpoint.Conditions.Terminating, false),
 				})
 			}
 		}
diff --git a/pkg/provider/kubernetes/ingress/kubernetes_test.go b/pkg/provider/kubernetes/ingress/kubernetes_test.go
index d965e68a2..c67e84e57 100644
--- a/pkg/provider/kubernetes/ingress/kubernetes_test.go
+++ b/pkg/provider/kubernetes/ingress/kubernetes_test.go
@@ -550,6 +550,26 @@ func TestLoadConfigurationFromIngresses(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "Ingress with defaultbackend with resource",
+			expected: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Middlewares: map[string]*dynamic.Middleware{},
+					Routers:     map[string]*dynamic.Router{},
+					Services:    map[string]*dynamic.Service{},
+				},
+			},
+		},
+		{
+			desc: "Ingress with empty defaultbackend",
+			expected: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Middlewares: map[string]*dynamic.Middleware{},
+					Routers:     map[string]*dynamic.Router{},
+					Services:    map[string]*dynamic.Service{},
+				},
+			},
+		},
 		{
 			desc: "Ingress with one service without endpoint",
 			expected: &dynamic.Configuration{
@@ -2298,6 +2318,14 @@ func TestIngressEndpointPublishedService(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "Published Service ExternalName",
+			expected: []netv1.IngressLoadBalancerIngress{
+				{
+					Hostname: "example.com",
+				},
+			},
+		},
 	}
 
 	for _, test := range testCases {
diff --git a/pkg/provider/kubernetes/k8s/endpoint.go b/pkg/provider/kubernetes/k8s/endpoint.go
deleted file mode 100644
index 415613de3..000000000
--- a/pkg/provider/kubernetes/k8s/endpoint.go
+++ /dev/null
@@ -1,11 +0,0 @@
-package k8s
-
-import (
-	v1 "k8s.io/api/discovery/v1"
-	"k8s.io/utils/ptr"
-)
-
-// EndpointServing returns true if the endpoint is still serving the service.
-func EndpointServing(endpoint v1.Endpoint) bool {
-	return ptr.Deref(endpoint.Conditions.Ready, false) || ptr.Deref(endpoint.Conditions.Serving, false)
-}
diff --git a/pkg/provider/kubernetes/k8s/endpoint_test.go b/pkg/provider/kubernetes/k8s/endpoint_test.go
deleted file mode 100644
index 9eba33f3a..000000000
--- a/pkg/provider/kubernetes/k8s/endpoint_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package k8s
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	v1 "k8s.io/api/discovery/v1"
-)
-
-func TestEndpointServing(t *testing.T) {
-	tests := []struct {
-		name     string
-		endpoint v1.Endpoint
-		want     bool
-	}{
-		{
-			name: "no status",
-			endpoint: v1.Endpoint{
-				Conditions: v1.EndpointConditions{
-					Ready:   nil,
-					Serving: nil,
-				},
-			},
-			want: false,
-		},
-		{
-			name: "ready",
-			endpoint: v1.Endpoint{
-				Conditions: v1.EndpointConditions{
-					Ready:   pointer(true),
-					Serving: nil,
-				},
-			},
-			want: true,
-		},
-		{
-			name: "not ready",
-			endpoint: v1.Endpoint{
-				Conditions: v1.EndpointConditions{
-					Ready:   pointer(false),
-					Serving: nil,
-				},
-			},
-			want: false,
-		},
-		{
-			name: "not ready and serving",
-			endpoint: v1.Endpoint{
-				Conditions: v1.EndpointConditions{
-					Ready:   pointer(false),
-					Serving: pointer(true),
-				},
-			},
-			want: true,
-		},
-		{
-			name: "not ready and not serving",
-			endpoint: v1.Endpoint{
-				Conditions: v1.EndpointConditions{
-					Ready:   pointer(false),
-					Serving: pointer(false),
-				},
-			},
-			want: false,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			got := EndpointServing(test.endpoint)
-			assert.Equal(t, test.want, got)
-		})
-	}
-}
-
-func pointer[T any](v T) *T { return &v }
diff --git a/pkg/provider/kubernetes/knative/client.go b/pkg/provider/kubernetes/knative/client.go
new file mode 100644
index 000000000..bfb87c332
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/client.go
@@ -0,0 +1,232 @@
+package knative
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/k8s"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	kinformers "k8s.io/client-go/informers"
+	kclientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	knativenetworkingv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	knativenetworkingclientset "knative.dev/networking/pkg/client/clientset/versioned"
+	knativenetworkinginformers "knative.dev/networking/pkg/client/informers/externalversions"
+)
+
+const resyncPeriod = 10 * time.Minute
+
+type clientWrapper struct {
+	csKnativeNetworking knativenetworkingclientset.Interface
+	csKube              kclientset.Interface
+
+	factoriesKnativeNetworking map[string]knativenetworkinginformers.SharedInformerFactory
+	factoriesKube              map[string]kinformers.SharedInformerFactory
+
+	labelSelector string
+
+	isNamespaceAll    bool
+	watchedNamespaces []string
+}
+
+func createClientFromConfig(c *rest.Config) (*clientWrapper, error) {
+	csKnativeNetworking, err := knativenetworkingclientset.NewForConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	csKube, err := kclientset.NewForConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return newClientImpl(csKnativeNetworking, csKube), nil
+}
+
+func newClientImpl(csKnativeNetworking knativenetworkingclientset.Interface, csKube kclientset.Interface) *clientWrapper {
+	return &clientWrapper{
+		csKnativeNetworking:        csKnativeNetworking,
+		csKube:                     csKube,
+		factoriesKnativeNetworking: make(map[string]knativenetworkinginformers.SharedInformerFactory),
+		factoriesKube:              make(map[string]kinformers.SharedInformerFactory),
+	}
+}
+
+// newInClusterClient returns a new Provider client that is expected to run
+// inside the cluster.
+func newInClusterClient(endpoint string) (*clientWrapper, error) {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("creating in-cluster configuration: %w", err)
+	}
+
+	if endpoint != "" {
+		config.Host = endpoint
+	}
+
+	return createClientFromConfig(config)
+}
+
+func newExternalClusterClientFromFile(file string) (*clientWrapper, error) {
+	configFromFlags, err := clientcmd.BuildConfigFromFlags("", file)
+	if err != nil {
+		return nil, err
+	}
+	return createClientFromConfig(configFromFlags)
+}
+
+// newExternalClusterClient returns a new Provider client that may run outside
+// of the cluster.
+// The endpoint parameter must not be empty.
+func newExternalClusterClient(endpoint, token, caFilePath string) (*clientWrapper, error) {
+	if endpoint == "" {
+		return nil, errors.New("endpoint missing for external cluster client")
+	}
+
+	config := &rest.Config{
+		Host:        endpoint,
+		BearerToken: token,
+	}
+
+	if caFilePath != "" {
+		caData, err := os.ReadFile(caFilePath)
+		if err != nil {
+			return nil, fmt.Errorf("reading CA file %s: %w", caFilePath, err)
+		}
+
+		config.TLSClientConfig = rest.TLSClientConfig{CAData: caData}
+	}
+
+	return createClientFromConfig(config)
+}
+
+// WatchAll starts namespace-specific controllers for all relevant kinds.
+func (c *clientWrapper) WatchAll(namespaces []string, stopCh <-chan struct{}) (<-chan interface{}, error) {
+	eventCh := make(chan interface{}, 1)
+	eventHandler := &k8s.ResourceEventHandler{Ev: eventCh}
+
+	if len(namespaces) == 0 {
+		namespaces = []string{metav1.NamespaceAll}
+		c.isNamespaceAll = true
+	}
+	c.watchedNamespaces = namespaces
+
+	for _, ns := range namespaces {
+		factory := knativenetworkinginformers.NewSharedInformerFactoryWithOptions(c.csKnativeNetworking, resyncPeriod, knativenetworkinginformers.WithNamespace(ns), knativenetworkinginformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
+			opts.LabelSelector = c.labelSelector
+		}))
+		_, err := factory.Networking().V1alpha1().Ingresses().Informer().AddEventHandler(eventHandler)
+		if err != nil {
+			return nil, err
+		}
+
+		factoryKube := kinformers.NewSharedInformerFactoryWithOptions(c.csKube, resyncPeriod, kinformers.WithNamespace(ns))
+		_, err = factoryKube.Core().V1().Services().Informer().AddEventHandler(eventHandler)
+		if err != nil {
+			return nil, err
+		}
+		_, err = factoryKube.Core().V1().Secrets().Informer().AddEventHandler(eventHandler)
+		if err != nil {
+			return nil, err
+		}
+
+		c.factoriesKube[ns] = factoryKube
+		c.factoriesKnativeNetworking[ns] = factory
+	}
+
+	for _, ns := range namespaces {
+		c.factoriesKnativeNetworking[ns].Start(stopCh)
+		c.factoriesKube[ns].Start(stopCh)
+	}
+
+	for _, ns := range namespaces {
+		for t, ok := range c.factoriesKnativeNetworking[ns].WaitForCacheSync(stopCh) {
+			if !ok {
+				return nil, fmt.Errorf("timed out waiting for controller caches to sync %s in namespace %q", t.String(), ns)
+			}
+		}
+		for t, ok := range c.factoriesKube[ns].WaitForCacheSync(stopCh) {
+			if !ok {
+				return nil, fmt.Errorf("timed out waiting for controller caches to sync %s in namespace %q", t.String(), ns)
+			}
+		}
+	}
+
+	return eventCh, nil
+}
+
+func (c *clientWrapper) ListIngresses() []*knativenetworkingv1alpha1.Ingress {
+	var result []*knativenetworkingv1alpha1.Ingress
+
+	for ns, factory := range c.factoriesKnativeNetworking {
+		ings, err := factory.Networking().V1alpha1().Ingresses().Lister().List(labels.Everything()) // todo: label selector
+		if err != nil {
+			log.Error().Msgf("Failed to list ingresses in namespace %s: %s", ns, err)
+		}
+		result = append(result, ings...)
+	}
+
+	return result
+}
+
+func (c *clientWrapper) UpdateIngressStatus(ingress *knativenetworkingv1alpha1.Ingress) error {
+	_, err := c.csKnativeNetworking.NetworkingV1alpha1().Ingresses(ingress.Namespace).UpdateStatus(context.TODO(), ingress, metav1.UpdateOptions{})
+	if err != nil {
+		return fmt.Errorf("updating knative ingress status %s/%s: %w", ingress.Namespace, ingress.Name, err)
+	}
+
+	log.Info().Msgf("Updated status on knative ingress %s/%s", ingress.Namespace, ingress.Name)
+	return nil
+}
+
+// GetService returns the named service from the given namespace.
+func (c *clientWrapper) GetService(namespace, name string) (*corev1.Service, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("getting service %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	return c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
+}
+
+// GetSecret returns the named secret from the given namespace.
+func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, fmt.Errorf("getting secret %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	return c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
+}
+
+// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+// it to ensure we don't panic by requesting an out-of-watch object.
+func (c *clientWrapper) isWatchedNamespace(ns string) bool {
+	if c.isNamespaceAll {
+		return true
+	}
+	for _, watchedNamespace := range c.watchedNamespaces {
+		if watchedNamespace == ns {
+			return true
+		}
+	}
+	return false
+}
+
+// lookupNamespace returns the lookup namespace key for the given namespace.
+// When listening on all namespaces, it returns the client-go identifier ("")
+// for all-namespaces. Otherwise, it returns the given namespace.
+// The distinction is necessary because we index all informers on the special
+// identifier iff all-namespaces are requested but receive specific namespace
+// identifiers from the Kubernetes API, so we have to bridge this gap.
+func (c *clientWrapper) lookupNamespace(ns string) string {
+	if c.isNamespaceAll {
+		return metav1.NamespaceAll
+	}
+	return ns
+}
diff --git a/pkg/provider/kubernetes/knative/fixtures/cluster_local.yaml b/pkg/provider/kubernetes/knative/fixtures/cluster_local.yaml
new file mode 100644
index 000000000..0d9c0fcea
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/fixtures/cluster_local.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: networking.internal.knative.dev/v1alpha1
+kind: Ingress
+metadata:
+  annotations:
+    networking.knative.dev/ingress.class: traefik.ingress.networking.knative.dev
+  name: helloworld-go
+  namespace: default
+spec:
+  httpOption: Enabled
+  rules:
+    - hosts:
+        - helloworld-go.default
+        - helloworld-go.default.svc
+        - helloworld-go.default.svc.cluster.local
+      http:
+        paths:
+          - splits:
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00001
+                percent: 50
+                serviceName: helloworld-go-00001
+                serviceNamespace: default
+                servicePort: 80
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00002
+                percent: 50
+                serviceName: helloworld-go-00002
+                serviceNamespace: default
+                servicePort: 80
+      visibility: ClusterLocal
diff --git a/pkg/provider/kubernetes/knative/fixtures/external_ip.yaml b/pkg/provider/kubernetes/knative/fixtures/external_ip.yaml
new file mode 100644
index 000000000..0ddd4fe06
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/fixtures/external_ip.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: networking.internal.knative.dev/v1alpha1
+kind: Ingress
+metadata:
+  annotations:
+    networking.knative.dev/ingress.class: traefik.ingress.networking.knative.dev
+  name: helloworld-go
+  namespace: default
+spec:
+  httpOption: Enabled
+  rules:
+    - hosts:
+        - helloworld-go.default
+        - helloworld-go.default.svc
+        - helloworld-go.default.svc.cluster.local
+      http:
+        paths:
+          - splits:
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00001
+                percent: 50
+                serviceName: helloworld-go-00001
+                serviceNamespace: default
+                servicePort: 80
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00002
+                percent: 50
+                serviceName: helloworld-go-00002
+                serviceNamespace: default
+                servicePort: 80
+      visibility: ExternalIP
diff --git a/pkg/provider/kubernetes/knative/fixtures/services.yaml b/pkg/provider/kubernetes/knative/fixtures/services.yaml
new file mode 100644
index 000000000..d2d69ce83
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/fixtures/services.yaml
@@ -0,0 +1,39 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helloworld-go-00001
+  namespace: default
+spec:
+  clusterIP: 10.43.38.208
+  clusterIPs:
+    - 10.43.38.208
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 8012
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 8112
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helloworld-go-00002
+  namespace: default
+spec:
+  clusterIP: 10.43.44.18
+  clusterIPs:
+    - 10.43.44.18
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 8012
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 8112
diff --git a/pkg/provider/kubernetes/knative/fixtures/tls.yaml b/pkg/provider/kubernetes/knative/fixtures/tls.yaml
new file mode 100644
index 000000000..3d85ad696
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/fixtures/tls.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: networking.internal.knative.dev/v1alpha1
+kind: Ingress
+metadata:
+  annotations:
+    networking.knative.dev/ingress.class: traefik.ingress.networking.knative.dev
+  name: helloworld-go
+  namespace: default
+spec:
+  httpOption: Enabled
+  tls:
+    - hosts:
+        - helloworld-go.default.svc.cluster.local
+      secretName: secretName
+      secretNamespace: secretNamespace
+  rules:
+    - hosts:
+        - helloworld-go.default
+        - helloworld-go.default.svc
+        - helloworld-go.default.svc.cluster.local
+      http:
+        paths:
+          - splits:
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00001
+                percent: 50
+                serviceName: helloworld-go-00001
+                serviceNamespace: default
+                servicePort: 80
+              - appendHeaders:
+                  Knative-Serving-Namespace: default
+                  Knative-Serving-Revision: helloworld-go-00002
+                percent: 50
+                serviceName: helloworld-go-00002
+                serviceNamespace: default
+                servicePort: 80
+      visibility: ExternalIP
diff --git a/pkg/provider/kubernetes/knative/fixtures/wrong_ingress_class.yaml b/pkg/provider/kubernetes/knative/fixtures/wrong_ingress_class.yaml
new file mode 100644
index 000000000..aaaff85a0
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/fixtures/wrong_ingress_class.yaml
@@ -0,0 +1,8 @@
+---
+apiVersion: networking.internal.knative.dev/v1alpha1
+kind: Ingress
+metadata:
+  annotations:
+    networking.knative.dev/ingress.class: foo.ingress.networking.knative.dev
+  name: helloworld-go
+  namespace: default
diff --git a/pkg/provider/kubernetes/knative/kubernetes.go b/pkg/provider/kubernetes/knative/kubernetes.go
new file mode 100644
index 000000000..ae9c636d3
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/kubernetes.go
@@ -0,0 +1,531 @@
+package knative
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/mitchellh/hashstructure"
+	"github.com/rs/zerolog/log"
+	ptypes "github.com/traefik/paerser/types"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/job"
+	"github.com/traefik/traefik/v3/pkg/observability/logs"
+	"github.com/traefik/traefik/v3/pkg/safe"
+	"github.com/traefik/traefik/v3/pkg/tls"
+	"github.com/traefik/traefik/v3/pkg/types"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+	knativenetworking "knative.dev/networking/pkg/apis/networking"
+	knativenetworkingv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	"knative.dev/pkg/network"
+)
+
+const (
+	providerName            = "knative"
+	traefikIngressClassName = "traefik.ingress.networking.knative.dev"
+)
+
+// ServiceRef holds a Kubernetes service reference.
+type ServiceRef struct {
+	Name      string `description:"Name of the Kubernetes service." json:"desc,omitempty" toml:"desc,omitempty" yaml:"desc,omitempty"`
+	Namespace string `description:"Namespace of the Kubernetes service." json:"namespace,omitempty" toml:"namespace,omitempty" yaml:"namespace,omitempty"`
+}
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	Endpoint           string          `description:"Kubernetes server endpoint (required for external cluster client)." json:"endpoint,omitempty" toml:"endpoint,omitempty" yaml:"endpoint,omitempty"`
+	Token              string          `description:"Kubernetes bearer token (not needed for in-cluster client)." json:"token,omitempty" toml:"token,omitempty" yaml:"token,omitempty"`
+	CertAuthFilePath   string          `description:"Kubernetes certificate authority file path (not needed for in-cluster client)." json:"certAuthFilePath,omitempty" toml:"certAuthFilePath,omitempty" yaml:"certAuthFilePath,omitempty"`
+	Namespaces         []string        `description:"Kubernetes namespaces." json:"namespaces,omitempty" toml:"namespaces,omitempty" yaml:"namespaces,omitempty" export:"true"`
+	LabelSelector      string          `description:"Kubernetes label selector to use." json:"labelSelector,omitempty" toml:"labelSelector,omitempty" yaml:"labelSelector,omitempty" export:"true"`
+	PublicEntrypoints  []string        `description:"Entrypoint names used to expose the Ingress publicly. If empty an Ingress is exposed on all entrypoints." json:"publicEntrypoints,omitempty" toml:"publicEntrypoints,omitempty" yaml:"publicEntrypoints,omitempty" export:"true"`
+	PublicService      ServiceRef      `description:"Kubernetes service used to expose the networking controller publicly." json:"publicService,omitempty" toml:"publicService,omitempty" yaml:"publicService,omitempty" export:"true"`
+	PrivateEntrypoints []string        `description:"Entrypoint names used to expose the Ingress privately. If empty local Ingresses are skipped." json:"privateEntrypoints,omitempty" toml:"privateEntrypoints,omitempty" yaml:"privateEntrypoints,omitempty" export:"true"`
+	PrivateService     ServiceRef      `description:"Kubernetes service used to expose the networking controller privately." json:"privateService,omitempty" toml:"privateService,omitempty" yaml:"privateService,omitempty" export:"true"`
+	ThrottleDuration   ptypes.Duration `description:"Ingress refresh throttle duration" json:"throttleDuration,omitempty" toml:"throttleDuration,omitempty" yaml:"throttleDuration,omitempty"`
+
+	client            *clientWrapper
+	lastConfiguration safe.Safe
+}
+
+// Init the provider.
+func (p *Provider) Init() error {
+	logger := log.With().Str(logs.ProviderName, providerName).Logger()
+
+	// Initializes Kubernetes client.
+	var err error
+	p.client, err = p.newK8sClient(logger.WithContext(context.Background()))
+	if err != nil {
+		return fmt.Errorf("creating kubernetes client: %w", err)
+	}
+
+	return nil
+}
+
+// Provide allows the knative provider to provide configurations to traefik using the given configuration channel.
+func (p *Provider) Provide(configurationChan chan<- dynamic.Message, pool *safe.Pool) error {
+	logger := log.With().Str(logs.ProviderName, providerName).Logger()
+	ctxLog := logger.WithContext(context.Background())
+
+	pool.GoCtx(func(ctxPool context.Context) {
+		operation := func() error {
+			eventsChan, err := p.client.WatchAll(p.Namespaces, ctxPool.Done())
+			if err != nil {
+				logger.Error().Msgf("Error watching kubernetes events: %v", err)
+				timer := time.NewTimer(1 * time.Second)
+				select {
+				case <-timer.C:
+					return err
+				case <-ctxPool.Done():
+					return nil
+				}
+			}
+
+			throttleDuration := time.Duration(p.ThrottleDuration)
+			throttledChan := throttleEvents(ctxLog, throttleDuration, pool, eventsChan)
+			if throttledChan != nil {
+				eventsChan = throttledChan
+			}
+
+			for {
+				select {
+				case <-ctxPool.Done():
+					return nil
+				case event := <-eventsChan:
+					// Note that event is the *first* event that came in during this throttling interval -- if we're hitting our throttle, we may have dropped events.
+					// This is fine, because we don't treat different event types differently.
+					// But if we do in the future, we'll need to track more information about the dropped events.
+					conf, ingressStatuses := p.loadConfiguration(ctxLog)
+
+					confHash, err := hashstructure.Hash(conf, nil)
+					switch {
+					case err != nil:
+						logger.Error().Msg("Unable to hash the configuration")
+					case p.lastConfiguration.Get() == confHash:
+						logger.Debug().Msgf("Skipping Kubernetes event kind %T", event)
+					default:
+						p.lastConfiguration.Set(confHash)
+						configurationChan <- dynamic.Message{
+							ProviderName:  providerName,
+							Configuration: conf,
+						}
+					}
+
+					// If we're throttling,
+					// we sleep here for the throttle duration to enforce that we don't refresh faster than our throttle.
+					// time.Sleep returns immediately if p.ThrottleDuration is 0 (no throttle).
+					time.Sleep(throttleDuration)
+
+					// Updating the ingress status after the throttleDuration allows to wait to make sure that the dynamic conf is updated before updating the status.
+					// This is needed for the conformance tests to pass, for example.
+					for _, ingress := range ingressStatuses {
+						if err := p.updateKnativeIngressStatus(ctxLog, ingress); err != nil {
+							logger.Error().Err(err).Msgf("Error updating status for Ingress %s/%s", ingress.Namespace, ingress.Name)
+						}
+					}
+				}
+			}
+		}
+
+		notify := func(err error, time time.Duration) {
+			logger.Error().Msgf("Provider connection error: %v; retrying in %s", err, time)
+		}
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), backoff.WithContext(job.NewBackOff(backoff.NewExponentialBackOff()), ctxPool), notify)
+		if err != nil {
+			logger.Error().Msgf("Cannot connect to Provider: %v", err)
+		}
+	})
+
+	return nil
+}
+
+func (p *Provider) newK8sClient(ctx context.Context) (*clientWrapper, error) {
+	logger := log.Ctx(ctx).With().Logger()
+
+	_, err := labels.Parse(p.LabelSelector)
+	if err != nil {
+		return nil, fmt.Errorf("parsing label selector: %q", p.LabelSelector)
+	}
+	logger.Info().Msgf("Label selector is: %q", p.LabelSelector)
+
+	withEndpoint := ""
+	if p.Endpoint != "" {
+		withEndpoint = fmt.Sprintf(" with endpoint %s", p.Endpoint)
+	}
+
+	var client *clientWrapper
+	switch {
+	case os.Getenv("KUBERNETES_SERVICE_HOST") != "" && os.Getenv("KUBERNETES_SERVICE_PORT") != "":
+		logger.Info().Msgf("Creating in-cluster Provider client%s", withEndpoint)
+		client, err = newInClusterClient(p.Endpoint)
+	case os.Getenv("KUBECONFIG") != "":
+		logger.Info().Msgf("Creating cluster-external Provider client from KUBECONFIG %s", os.Getenv("KUBECONFIG"))
+		client, err = newExternalClusterClientFromFile(os.Getenv("KUBECONFIG"))
+	default:
+		logger.Info().Msgf("Creating cluster-external Provider client%s", withEndpoint)
+		client, err = newExternalClusterClient(p.Endpoint, p.Token, p.CertAuthFilePath)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	client.labelSelector = p.LabelSelector
+	return client, nil
+}
+
+func (p *Provider) loadConfiguration(ctx context.Context) (*dynamic.Configuration, []*knativenetworkingv1alpha1.Ingress) {
+	conf := &dynamic.Configuration{
+		HTTP: &dynamic.HTTPConfiguration{
+			Routers:     make(map[string]*dynamic.Router),
+			Middlewares: make(map[string]*dynamic.Middleware),
+			Services:    make(map[string]*dynamic.Service),
+		},
+	}
+
+	var ingressStatuses []*knativenetworkingv1alpha1.Ingress
+
+	uniqCerts := make(map[string]*tls.CertAndStores)
+	for _, ingress := range p.client.ListIngresses() {
+		logger := log.Ctx(ctx).With().
+			Str("ingress", ingress.Name).
+			Str("namespace", ingress.Namespace).
+			Logger()
+
+		if ingress.Annotations[knativenetworking.IngressClassAnnotationKey] != traefikIngressClassName {
+			logger.Debug().Msgf("Skipping Ingress %s/%s", ingress.Namespace, ingress.Name)
+			continue
+		}
+
+		if err := p.loadCertificates(ctx, ingress, uniqCerts); err != nil {
+			logger.Error().Err(err).Msg("Error loading TLS certificates")
+			continue
+		}
+
+		conf.HTTP = mergeHTTPConfigs(conf.HTTP, p.buildRouters(ctx, ingress))
+
+		// TODO: should we handle configuration errors?
+		ingressStatuses = append(ingressStatuses, ingress)
+	}
+
+	if len(uniqCerts) > 0 {
+		conf.TLS = &dynamic.TLSConfiguration{
+			Certificates: slices.Collect(maps.Values(uniqCerts)),
+		}
+	}
+
+	return conf, ingressStatuses
+}
+
+// loadCertificates loads the TLS certificates for the given Knative Ingress.
+// This method mutates the uniqCerts map to add the loaded certificates.
+func (p *Provider) loadCertificates(ctx context.Context, ingress *knativenetworkingv1alpha1.Ingress, uniqCerts map[string]*tls.CertAndStores) error {
+	for _, t := range ingress.Spec.TLS {
+		// TODO: maybe this could be allowed with an allowCrossNamespace option in the future.
+		if t.SecretNamespace != ingress.Namespace {
+			log.Ctx(ctx).Debug().Msg("TLS secret namespace has to be the same as the Ingress one")
+			continue
+		}
+
+		key := ingress.Namespace + "-" + t.SecretName
+
+		// TODO: as specified in the GoDoc we should validate that the certificates contain the configured Hosts.
+		if _, exists := uniqCerts[key]; !exists {
+			cert, err := p.loadCertificate(ingress.Namespace, t.SecretName)
+			if err != nil {
+				return fmt.Errorf("getting certificate: %w", err)
+			}
+			uniqCerts[key] = &tls.CertAndStores{Certificate: cert}
+		}
+	}
+
+	return nil
+}
+
+func (p *Provider) loadCertificate(namespace, secretName string) (tls.Certificate, error) {
+	secret, err := p.client.GetSecret(namespace, secretName)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("getting secret %s/%s: %w", namespace, secretName, err)
+	}
+
+	certBytes, hasCert := secret.Data[corev1.TLSCertKey]
+	keyBytes, hasKey := secret.Data[corev1.TLSPrivateKeyKey]
+
+	if (!hasCert || len(certBytes) == 0) || (!hasKey || len(keyBytes) == 0) {
+		return tls.Certificate{}, errors.New("secret does not contain a keypair")
+	}
+
+	return tls.Certificate{
+		CertFile: types.FileOrContent(certBytes),
+		KeyFile:  types.FileOrContent(keyBytes),
+	}, nil
+}
+
+func (p *Provider) buildRouters(ctx context.Context, ingress *knativenetworkingv1alpha1.Ingress) *dynamic.HTTPConfiguration {
+	logger := log.Ctx(ctx).With().Logger()
+
+	conf := &dynamic.HTTPConfiguration{
+		Routers:     make(map[string]*dynamic.Router),
+		Middlewares: make(map[string]*dynamic.Middleware),
+		Services:    make(map[string]*dynamic.Service),
+	}
+
+	for ri, rule := range ingress.Spec.Rules {
+		if rule.HTTP == nil {
+			logger.Debug().Msgf("No HTTP rule defined for rule %d in Ingress %s", ri, ingress.Name)
+			continue
+		}
+
+		entrypoints := p.PublicEntrypoints
+		if rule.Visibility == knativenetworkingv1alpha1.IngressVisibilityClusterLocal {
+			if p.PrivateEntrypoints == nil {
+				// Skip route creation as no internal entrypoints are defined for cluster local visibility.
+				continue
+			}
+			entrypoints = p.PrivateEntrypoints
+		}
+
+		// TODO: support rewrite host
+		for pi, path := range rule.HTTP.Paths {
+			routerKey := fmt.Sprintf("%s-%s-rule-%d-path-%d", ingress.Namespace, ingress.Name, ri, pi)
+			router := &dynamic.Router{
+				EntryPoints: entrypoints,
+				Rule:        buildRule(rule.Hosts, path.Headers, path.Path),
+				Middlewares: make([]string, 0),
+				Service:     routerKey + "-wrr",
+			}
+
+			if len(path.AppendHeaders) > 0 {
+				midKey := fmt.Sprintf("%s-append-headers", routerKey)
+
+				router.Middlewares = append(router.Middlewares, midKey)
+				conf.Middlewares[midKey] = &dynamic.Middleware{
+					Headers: &dynamic.Headers{
+						CustomRequestHeaders: path.AppendHeaders,
+					},
+				}
+			}
+
+			wrr, services, err := p.buildWeightedRoundRobin(routerKey, path.Splits)
+			if err != nil {
+				logger.Error().Err(err).Msg("Error building weighted round robin")
+				continue
+			}
+
+			// TODO: support Ingress#HTTPOption to check if HTTP router should redirect to the HTTPS one.
+			conf.Routers[routerKey] = router
+
+			// TODO: at some point we should allow to define a default TLS secret at the provider level to enable TLS with a custom cert when external-domain-tls is disabled.
+			//       see https://knative.dev/docs/serving/encryption/external-domain-tls/#manually-obtain-and-renew-certificates
+			if len(ingress.Spec.TLS) > 0 {
+				conf.Routers[routerKey+"-tls"] = &dynamic.Router{
+					EntryPoints: router.EntryPoints,
+					Rule:        router.Rule, // TODO: maybe the rule should be a new one containing the TLS hosts injected by Knative.
+					Middlewares: router.Middlewares,
+					Service:     router.Service,
+					TLS:         &dynamic.RouterTLSConfig{},
+				}
+			}
+
+			conf.Services[routerKey+"-wrr"] = &dynamic.Service{Weighted: wrr}
+			for k, v := range services {
+				conf.Services[k] = v
+			}
+		}
+	}
+
+	return conf
+}
+
+func (p *Provider) buildWeightedRoundRobin(routerKey string, splits []knativenetworkingv1alpha1.IngressBackendSplit) (*dynamic.WeightedRoundRobin, map[string]*dynamic.Service, error) {
+	wrr := &dynamic.WeightedRoundRobin{
+		Services: make([]dynamic.WRRService, 0),
+	}
+
+	services := make(map[string]*dynamic.Service)
+	for si, split := range splits {
+		serviceKey := fmt.Sprintf("%s-split-%d", routerKey, si)
+
+		var err error
+		services[serviceKey], err = p.buildService(split.ServiceNamespace, split.ServiceName, split.ServicePort)
+		if err != nil {
+			return nil, nil, fmt.Errorf("building service: %w", err)
+		}
+
+		// As described in the spec if there is only one split it defaults to 100.
+		percent := split.Percent
+		if len(splits) == 1 {
+			percent = 100
+		}
+
+		wrr.Services = append(wrr.Services, dynamic.WRRService{
+			Name:    serviceKey,
+			Weight:  ptr.To(percent),
+			Headers: split.AppendHeaders,
+		})
+	}
+
+	return wrr, services, nil
+}
+
+func (p *Provider) buildService(namespace, serviceName string, port intstr.IntOrString) (*dynamic.Service, error) {
+	servers, err := p.buildServers(namespace, serviceName, port)
+	if err != nil {
+		return nil, fmt.Errorf("building servers: %w", err)
+	}
+
+	var lb dynamic.ServersLoadBalancer
+	lb.SetDefaults()
+	lb.Servers = servers
+
+	return &dynamic.Service{LoadBalancer: &lb}, nil
+}
+
+func (p *Provider) buildServers(namespace, serviceName string, port intstr.IntOrString) ([]dynamic.Server, error) {
+	service, err := p.client.GetService(namespace, serviceName)
+	if err != nil {
+		return nil, fmt.Errorf("getting service %s/%s: %w", namespace, serviceName, err)
+	}
+
+	var svcPort *corev1.ServicePort
+	for _, p := range service.Spec.Ports {
+		if p.Name == port.String() || strconv.Itoa(int(p.Port)) == port.String() {
+			svcPort = &p
+			break
+		}
+	}
+	if svcPort == nil {
+		return nil, errors.New("service port not found")
+	}
+
+	if service.Spec.ClusterIP == "" {
+		return nil, errors.New("service does not have a ClusterIP")
+	}
+
+	scheme := "http"
+	if svcPort.AppProtocol != nil && *svcPort.AppProtocol == knativenetworking.AppProtocolH2C {
+		scheme = "h2c"
+	}
+
+	hostPort := net.JoinHostPort(service.Spec.ClusterIP, strconv.Itoa(int(svcPort.Port)))
+	return []dynamic.Server{{URL: fmt.Sprintf("%s://%s", scheme, hostPort)}}, nil
+}
+
+func (p *Provider) updateKnativeIngressStatus(ctx context.Context, ingress *knativenetworkingv1alpha1.Ingress) error {
+	log.Ctx(ctx).Debug().Msgf("Updating status for Ingress %s/%s", ingress.Namespace, ingress.Name)
+
+	var publicLbs []knativenetworkingv1alpha1.LoadBalancerIngressStatus
+	if p.PublicService.Name != "" && p.PublicService.Namespace != "" {
+		publicLbs = append(publicLbs, knativenetworkingv1alpha1.LoadBalancerIngressStatus{
+			DomainInternal: network.GetServiceHostname(p.PublicService.Name, p.PublicService.Namespace),
+		})
+	}
+
+	var privateLbs []knativenetworkingv1alpha1.LoadBalancerIngressStatus
+	if p.PrivateService.Name != "" && p.PrivateService.Namespace != "" {
+		privateLbs = append(privateLbs, knativenetworkingv1alpha1.LoadBalancerIngressStatus{
+			DomainInternal: network.GetServiceHostname(p.PrivateService.Name, p.PrivateService.Namespace),
+		})
+	}
+
+	if ingress.GetStatus() == nil || !ingress.GetStatus().GetCondition(knativenetworkingv1alpha1.IngressConditionNetworkConfigured).IsTrue() || ingress.GetGeneration() != ingress.GetStatus().ObservedGeneration {
+		ingress.Status.MarkNetworkConfigured()
+		ingress.Status.MarkLoadBalancerReady(publicLbs, privateLbs)
+		ingress.Status.ObservedGeneration = ingress.GetGeneration()
+
+		return p.client.UpdateIngressStatus(ingress)
+	}
+	return nil
+}
+
+func buildRule(hosts []string, headers map[string]knativenetworkingv1alpha1.HeaderMatch, path string) string {
+	var operands []string
+
+	if len(hosts) > 0 {
+		var hostRules []string
+		for _, host := range hosts {
+			hostRules = append(hostRules, fmt.Sprintf("Host(`%v`)", host))
+		}
+		operands = append(operands, fmt.Sprintf("(%s)", strings.Join(hostRules, " || ")))
+	}
+
+	if len(headers) > 0 {
+		headerKeys := slices.Collect(maps.Keys(headers))
+		slices.Sort(headerKeys)
+
+		var headerRules []string
+		for _, key := range headerKeys {
+			headerRules = append(headerRules, fmt.Sprintf("Header(`%s`,`%s`)", key, headers[key].Exact))
+		}
+		operands = append(operands, fmt.Sprintf("(%s)", strings.Join(headerRules, " && ")))
+	}
+
+	if len(path) > 0 {
+		operands = append(operands, fmt.Sprintf("PathPrefix(`%s`)", path))
+	}
+
+	return strings.Join(operands, " && ")
+}
+
+func mergeHTTPConfigs(confs ...*dynamic.HTTPConfiguration) *dynamic.HTTPConfiguration {
+	conf := &dynamic.HTTPConfiguration{
+		Routers:     map[string]*dynamic.Router{},
+		Middlewares: map[string]*dynamic.Middleware{},
+		Services:    map[string]*dynamic.Service{},
+	}
+
+	for _, c := range confs {
+		for k, v := range c.Routers {
+			conf.Routers[k] = v
+		}
+		for k, v := range c.Middlewares {
+			conf.Middlewares[k] = v
+		}
+		for k, v := range c.Services {
+			conf.Services[k] = v
+		}
+	}
+
+	return conf
+}
+
+func throttleEvents(ctx context.Context, throttleDuration time.Duration, pool *safe.Pool, eventsChan <-chan interface{}) chan interface{} {
+	logger := log.Ctx(ctx).With().Logger()
+	if throttleDuration == 0 {
+		return nil
+	}
+	// Create a buffered channel to hold the pending event (if we're delaying processing the event due to throttling)
+	eventsChanBuffered := make(chan interface{}, 1)
+
+	// Run a goroutine that reads events from eventChan and does a non-blocking write to pendingEvent.
+	// This guarantees that writing to eventChan will never block,
+	// and that pendingEvent will have something in it if there's been an event since we read from that channel.
+	pool.GoCtx(func(ctxPool context.Context) {
+		for {
+			select {
+			case <-ctxPool.Done():
+				return
+			case nextEvent := <-eventsChan:
+				select {
+				case eventsChanBuffered <- nextEvent:
+				default:
+					// We already have an event in eventsChanBuffered, so we'll do a refresh as soon as our throttle allows us to.
+					// It's fine to drop the event and keep whatever's in the buffer -- we don't do different things for different events
+					logger.Debug().Msgf("Dropping event kind %T due to throttling", nextEvent)
+				}
+			}
+		}
+	})
+
+	return eventsChanBuffered
+}
diff --git a/pkg/provider/kubernetes/knative/kubernetes_test.go b/pkg/provider/kubernetes/knative/kubernetes_test.go
new file mode 100644
index 000000000..08ea0e2c3
--- /dev/null
+++ b/pkg/provider/kubernetes/knative/kubernetes_test.go
@@ -0,0 +1,478 @@
+package knative
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/traefik/paerser/types"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/provider/kubernetes/k8s"
+	"k8s.io/apimachinery/pkg/runtime"
+	kubefake "k8s.io/client-go/kubernetes/fake"
+	kscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/utils/ptr"
+	knativenetworkingv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
+	knfake "knative.dev/networking/pkg/client/clientset/versioned/fake"
+)
+
+func init() {
+	// required by k8s.MustParseYaml
+	if err := knativenetworkingv1alpha1.AddToScheme(kscheme.Scheme); err != nil {
+		panic(err)
+	}
+}
+
+func Test_loadConfiguration(t *testing.T) {
+	testCases := []struct {
+		desc    string
+		paths   []string
+		want    *dynamic.Configuration
+		wantLen int
+	}{
+		{
+			desc:    "Wrong ingress class",
+			paths:   []string{"wrong_ingress_class.yaml"},
+			wantLen: 0,
+			want: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers:     map[string]*dynamic.Router{},
+					Services:    map[string]*dynamic.Service{},
+					Middlewares: map[string]*dynamic.Middleware{},
+				},
+			},
+		},
+		{
+			desc:    "Cluster Local",
+			paths:   []string{"cluster_local.yaml", "services.yaml"},
+			wantLen: 1,
+			want: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-helloworld-go-rule-0-path-0": {
+							EntryPoints: []string{"priv-http", "priv-https"},
+							Service:     "default-helloworld-go-rule-0-path-0-wrr",
+							Rule:        "(Host(`helloworld-go.default`) || Host(`helloworld-go.default.svc`) || Host(`helloworld-go.default.svc.cluster.local`))",
+							Middlewares: []string{},
+						},
+					},
+					Services: map[string]*dynamic.Service{
+						"default-helloworld-go-rule-0-path-0-split-0": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.38.208:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-split-1": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.44.18:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-wrr": {
+							Weighted: &dynamic.WeightedRoundRobin{
+								Services: []dynamic.WRRService{
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-0",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00001",
+										},
+									},
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-1",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00002",
+										},
+									},
+								},
+							},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+				},
+			},
+		},
+		{
+			desc:    "External IP",
+			paths:   []string{"external_ip.yaml", "services.yaml"},
+			wantLen: 1,
+			want: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-helloworld-go-rule-0-path-0": {
+							EntryPoints: []string{"http", "https"},
+							Service:     "default-helloworld-go-rule-0-path-0-wrr",
+							Rule:        "(Host(`helloworld-go.default`) || Host(`helloworld-go.default.svc`) || Host(`helloworld-go.default.svc.cluster.local`))",
+							Middlewares: []string{},
+						},
+					},
+					Services: map[string]*dynamic.Service{
+						"default-helloworld-go-rule-0-path-0-split-0": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.38.208:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-split-1": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.44.18:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-wrr": {
+							Weighted: &dynamic.WeightedRoundRobin{
+								Services: []dynamic.WRRService{
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-0",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00001",
+										},
+									},
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-1",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00002",
+										},
+									},
+								},
+							},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+				},
+			},
+		},
+		{
+			desc:    "TLS",
+			paths:   []string{"tls.yaml", "services.yaml"},
+			wantLen: 1,
+			want: &dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"default-helloworld-go-rule-0-path-0": {
+							EntryPoints: []string{"http", "https"},
+							Service:     "default-helloworld-go-rule-0-path-0-wrr",
+							Rule:        "(Host(`helloworld-go.default`) || Host(`helloworld-go.default.svc`) || Host(`helloworld-go.default.svc.cluster.local`))",
+							Middlewares: []string{},
+						},
+						"default-helloworld-go-rule-0-path-0-tls": {
+							EntryPoints: []string{"http", "https"},
+							Service:     "default-helloworld-go-rule-0-path-0-wrr",
+							Rule:        "(Host(`helloworld-go.default`) || Host(`helloworld-go.default.svc`) || Host(`helloworld-go.default.svc.cluster.local`))",
+							Middlewares: []string{},
+							TLS:         &dynamic.RouterTLSConfig{},
+						},
+					},
+					Services: map[string]*dynamic.Service{
+						"default-helloworld-go-rule-0-path-0-split-0": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.38.208:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-split-1": {
+							LoadBalancer: &dynamic.ServersLoadBalancer{
+								Strategy:       "wrr",
+								PassHostHeader: ptr.To(true),
+								ResponseForwarding: &dynamic.ResponseForwarding{
+									FlushInterval: types.Duration(100 * time.Millisecond),
+								},
+								Servers: []dynamic.Server{
+									{
+										URL: "http://10.43.44.18:80",
+									},
+								},
+							},
+						},
+						"default-helloworld-go-rule-0-path-0-wrr": {
+							Weighted: &dynamic.WeightedRoundRobin{
+								Services: []dynamic.WRRService{
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-0",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00001",
+										},
+									},
+									{
+										Name:   "default-helloworld-go-rule-0-path-0-split-1",
+										Weight: ptr.To(50),
+										Headers: map[string]string{
+											"Knative-Serving-Namespace": "default",
+											"Knative-Serving-Revision":  "helloworld-go-00002",
+										},
+									},
+								},
+							},
+						},
+					},
+					Middlewares: map[string]*dynamic.Middleware{},
+				},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.desc, func(t *testing.T) {
+			t.Parallel()
+
+			k8sObjects, knObjects := readResources(t, testCase.paths)
+
+			k8sClient := kubefake.NewClientset(k8sObjects...)
+			knClient := knfake.NewSimpleClientset(knObjects...)
+
+			client := newClientImpl(knClient, k8sClient)
+
+			eventCh, err := client.WatchAll(nil, make(chan struct{}))
+			require.NoError(t, err)
+
+			if len(k8sObjects) > 0 || len(knObjects) > 0 {
+				// just wait for the first event
+				<-eventCh
+			}
+
+			p := Provider{
+				PublicEntrypoints:  []string{"http", "https"},
+				PrivateEntrypoints: []string{"priv-http", "priv-https"},
+				client:             client,
+			}
+
+			got, gotIngresses := p.loadConfiguration(t.Context())
+			assert.Len(t, gotIngresses, testCase.wantLen)
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func Test_buildRule(t *testing.T) {
+	testCases := []struct {
+		desc    string
+		hosts   []string
+		headers map[string]knativenetworkingv1alpha1.HeaderMatch
+		path    string
+		want    string
+	}{
+		{
+			desc:  "single host, no headers, no path",
+			hosts: []string{"example.com"},
+			want:  "(Host(`example.com`))",
+		},
+		{
+			desc:  "multiple hosts, no headers, no path",
+			hosts: []string{"example.com", "foo.com"},
+			want:  "(Host(`example.com`) || Host(`foo.com`))",
+		},
+		{
+			desc:  "single host, single header, no path",
+			hosts: []string{"example.com"},
+			headers: map[string]knativenetworkingv1alpha1.HeaderMatch{
+				"X-Header": {Exact: "value"},
+			},
+			want: "(Host(`example.com`)) && (Header(`X-Header`,`value`))",
+		},
+		{
+			desc:  "single host, multiple headers, no path",
+			hosts: []string{"example.com"},
+			headers: map[string]knativenetworkingv1alpha1.HeaderMatch{
+				"X-Header":  {Exact: "value"},
+				"X-Header2": {Exact: "value2"},
+			},
+			want: "(Host(`example.com`)) && (Header(`X-Header`,`value`) && Header(`X-Header2`,`value2`))",
+		},
+		{
+			desc:  "single host, multiple headers, with path",
+			hosts: []string{"example.com"},
+			headers: map[string]knativenetworkingv1alpha1.HeaderMatch{
+				"X-Header":  {Exact: "value"},
+				"X-Header2": {Exact: "value2"},
+			},
+			path: "/foo",
+			want: "(Host(`example.com`)) && (Header(`X-Header`,`value`) && Header(`X-Header2`,`value2`)) && PathPrefix(`/foo`)",
+		},
+		{
+			desc:  "single host, no headers, with path",
+			hosts: []string{"example.com"},
+			path:  "/foo",
+			want:  "(Host(`example.com`)) && PathPrefix(`/foo`)",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			got := buildRule(test.hosts, test.headers, test.path)
+			assert.Equal(t, test.want, got)
+		})
+	}
+}
+
+func Test_mergeHTTPConfigs(t *testing.T) {
+	testCases := []struct {
+		desc    string
+		configs []*dynamic.HTTPConfiguration
+		want    *dynamic.HTTPConfiguration
+	}{
+		{
+			desc: "one empty configuration",
+			configs: []*dynamic.HTTPConfiguration{
+				{
+					Routers: map[string]*dynamic.Router{
+						"router1": {Rule: "Host(`example.com`)"},
+					},
+					Middlewares: map[string]*dynamic.Middleware{
+						"middleware1": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+					},
+					Services: map[string]*dynamic.Service{
+						"service1": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+					},
+				},
+				{
+					Routers:     map[string]*dynamic.Router{},
+					Middlewares: map[string]*dynamic.Middleware{},
+					Services:    map[string]*dynamic.Service{},
+				},
+			},
+			want: &dynamic.HTTPConfiguration{
+				Routers: map[string]*dynamic.Router{
+					"router1": {Rule: "Host(`example.com`)"},
+				},
+				Middlewares: map[string]*dynamic.Middleware{
+					"middleware1": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+				},
+				Services: map[string]*dynamic.Service{
+					"service1": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+				},
+			},
+		},
+		{
+			desc: "merging two non-empty configurations",
+			configs: []*dynamic.HTTPConfiguration{
+				{
+					Routers: map[string]*dynamic.Router{
+						"router1": {Rule: "Host(`example.com`)"},
+					},
+					Middlewares: map[string]*dynamic.Middleware{
+						"middleware1": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+					},
+					Services: map[string]*dynamic.Service{
+						"service1": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+					},
+				},
+				{
+					Routers: map[string]*dynamic.Router{
+						"router2": {Rule: "PathPrefix(`/test`)"},
+					},
+					Middlewares: map[string]*dynamic.Middleware{
+						"middleware2": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+					},
+					Services: map[string]*dynamic.Service{
+						"service2": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+					},
+				},
+			},
+			want: &dynamic.HTTPConfiguration{
+				Routers: map[string]*dynamic.Router{
+					"router1": {Rule: "Host(`example.com`)"},
+					"router2": {Rule: "PathPrefix(`/test`)"},
+				},
+				Middlewares: map[string]*dynamic.Middleware{
+					"middleware1": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+					"middleware2": {Headers: &dynamic.Headers{CustomRequestHeaders: map[string]string{"X-Test": "value"}}},
+				},
+				Services: map[string]*dynamic.Service{
+					"service1": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+					"service2": {LoadBalancer: &dynamic.ServersLoadBalancer{Servers: []dynamic.Server{{URL: "http://example.com"}}}},
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			got := mergeHTTPConfigs(test.configs...)
+			assert.Equal(t, test.want, got)
+		})
+	}
+}
+
+func readResources(t *testing.T, paths []string) ([]runtime.Object, []runtime.Object) {
+	t.Helper()
+
+	var (
+		k8sObjects []runtime.Object
+		knObjects  []runtime.Object
+	)
+	for _, path := range paths {
+		yamlContent, err := os.ReadFile(filepath.FromSlash("./fixtures/" + path))
+		if err != nil {
+			panic(err)
+		}
+
+		objects := k8s.MustParseYaml(yamlContent)
+		for _, obj := range objects {
+			switch obj.GetObjectKind().GroupVersionKind().Group {
+			case "networking.internal.knative.dev":
+				knObjects = append(knObjects, obj)
+			default:
+				k8sObjects = append(k8sObjects, obj)
+			}
+		}
+	}
+
+	return k8sObjects, knObjects
+}
diff --git a/pkg/provider/kv/consul/consul.go b/pkg/provider/kv/consul/consul.go
index 2a5fdfd49..14d8e82b6 100644
--- a/pkg/provider/kv/consul/consul.go
+++ b/pkg/provider/kv/consul/consul.go
@@ -97,3 +97,8 @@ func (p *Provider) Init() error {
 
 	return p.Provider.Init(consul.StoreName, p.name, config)
 }
+
+// Namespace returns the namespace of the Consul provider.
+func (p *Provider) Namespace() string {
+	return p.namespace
+}
diff --git a/pkg/provider/kv/redis/redis.go b/pkg/provider/kv/redis/redis.go
index c6e357f03..930cf087d 100644
--- a/pkg/provider/kv/redis/redis.go
+++ b/pkg/provider/kv/redis/redis.go
@@ -60,10 +60,20 @@ func (p *Provider) Init() error {
 	}
 
 	if p.Sentinel != nil {
-		switch {
-		case p.Sentinel.LatencyStrategy && !(p.Sentinel.RandomStrategy || p.Sentinel.ReplicaStrategy):
-		case p.Sentinel.RandomStrategy && !(p.Sentinel.LatencyStrategy || p.Sentinel.ReplicaStrategy):
-		case p.Sentinel.ReplicaStrategy && !(p.Sentinel.RandomStrategy || p.Sentinel.LatencyStrategy):
+		count := 0
+		if p.Sentinel.LatencyStrategy {
+			count++
+		}
+
+		if p.Sentinel.ReplicaStrategy {
+			count++
+		}
+
+		if p.Sentinel.RandomStrategy {
+			count++
+		}
+
+		if count > 1 {
 			return errors.New("latencyStrategy, randomStrategy and replicaStrategy options are mutually exclusive, please use only one of those options")
 		}
 
diff --git a/pkg/provider/nomad/nomad.go b/pkg/provider/nomad/nomad.go
index 77876468e..c9581a036 100644
--- a/pkg/provider/nomad/nomad.go
+++ b/pkg/provider/nomad/nomad.go
@@ -571,3 +571,8 @@ func throttleEvents(ctx context.Context, throttleDuration time.Duration, pool *s
 
 	return eventsChanBuffered
 }
+
+// Namespace returns the namespace of the Nomad provider.
+func (p *Provider) Namespace() string {
+	return p.namespace
+}
diff --git a/pkg/provider/provider.go b/pkg/provider/provider.go
index 2597a05e6..8ebe66055 100644
--- a/pkg/provider/provider.go
+++ b/pkg/provider/provider.go
@@ -12,3 +12,14 @@ type Provider interface {
 	Provide(configurationChan chan<- dynamic.Message, pool *safe.Pool) error
 	Init() error
 }
+
+// NamespacedProvider is implemented by providers that support namespace-scoped configurations,
+// where each configured namespace results in a dedicated provider instance.
+// This enables clear identification of which namespace each provider instance serves during
+// startup logging and operational monitoring.
+type NamespacedProvider interface {
+	Provider
+
+	// Namespace returns the specific namespace this provider instance is configured for.
+	Namespace() string
+}
diff --git a/pkg/provider/traefik/internal.go b/pkg/provider/traefik/internal.go
index 73d17d63f..7c99f977e 100644
--- a/pkg/provider/traefik/internal.go
+++ b/pkg/provider/traefik/internal.go
@@ -231,7 +231,7 @@ func (i *Provider) entryPointModels(cfg *dynamic.Configuration) {
 			}
 		}
 
-		if len(ep.HTTP.Middlewares) == 0 && ep.HTTP.TLS == nil && defaultRuleSyntax == "" && ep.Observability == nil {
+		if len(ep.HTTP.Middlewares) == 0 && ep.HTTP.TLS == nil && defaultRuleSyntax == "" && ep.Observability == nil && ep.HTTP.EncodedCharacters == nil {
 			continue
 		}
 
@@ -240,6 +240,18 @@ func (i *Provider) entryPointModels(cfg *dynamic.Configuration) {
 			Middlewares:       ep.HTTP.Middlewares,
 		}
 
+		if ep.HTTP.EncodedCharacters != nil {
+			httpModel.DeniedEncodedPathCharacters = &dynamic.RouterDeniedEncodedPathCharacters{
+				AllowEncodedSlash:         ep.HTTP.EncodedCharacters.AllowEncodedSlash,
+				AllowEncodedBackSlash:     ep.HTTP.EncodedCharacters.AllowEncodedBackSlash,
+				AllowEncodedPercent:       ep.HTTP.EncodedCharacters.AllowEncodedPercent,
+				AllowEncodedQuestionMark:  ep.HTTP.EncodedCharacters.AllowEncodedQuestionMark,
+				AllowEncodedSemicolon:     ep.HTTP.EncodedCharacters.AllowEncodedSemicolon,
+				AllowEncodedHash:          ep.HTTP.EncodedCharacters.AllowEncodedHash,
+				AllowEncodedNullCharacter: ep.HTTP.EncodedCharacters.AllowEncodedNullCharacter,
+			}
+		}
+
 		if ep.Observability != nil {
 			httpModel.Observability = dynamic.RouterObservabilityConfig{
 				AccessLogs:     ep.Observability.AccessLogs,
diff --git a/pkg/server/aggregator.go b/pkg/server/aggregator.go
index 8f22474fe..36326af76 100644
--- a/pkg/server/aggregator.go
+++ b/pkg/server/aggregator.go
@@ -46,7 +46,9 @@ func mergeConfiguration(configurations dynamic.Configurations, defaultEntryPoint
 	for pvd, configuration := range configurations {
 		if configuration.HTTP != nil {
 			for routerName, router := range configuration.HTTP.Routers {
-				if len(router.EntryPoints) == 0 {
+				// If no entrypoint is defined, and the router has no parentRefs (i.e. is not a child router),
+				// we set the default entrypoints.
+				if len(router.EntryPoints) == 0 && router.ParentRefs == nil {
 					log.Debug().
 						Str(logs.RouterName, routerName).
 						Strs(logs.EntryPointName, defaultEntryPoints).
@@ -63,6 +65,16 @@ func mergeConfiguration(configurations dynamic.Configurations, defaultEntryPoint
 						Msg("Router's `ruleSyntax` option is deprecated, please remove any usage of this option.")
 				}
 
+				var qualifiedParentRefs []string
+				for _, parentRef := range router.ParentRefs {
+					if parts := strings.Split(parentRef, "@"); len(parts) == 1 {
+						parentRef = provider.MakeQualifiedName(pvd, parentRef)
+					}
+
+					qualifiedParentRefs = append(qualifiedParentRefs, parentRef)
+				}
+				router.ParentRefs = qualifiedParentRefs
+
 				conf.HTTP.Routers[provider.MakeQualifiedName(pvd, routerName)] = router
 			}
 			for middlewareName, middleware := range configuration.HTTP.Middlewares {
@@ -163,7 +175,14 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration {
 	if cfg.HTTP != nil && len(cfg.HTTP.Models) > 0 {
 		rts := make(map[string]*dynamic.Router)
 
+		modelRouterNames := make(map[string][]string)
 		for name, rt := range cfg.HTTP.Routers {
+			// Only root routers can have models applied.
+			if rt.ParentRefs != nil {
+				rts[name] = rt
+				continue
+			}
+
 			router := rt.DeepCopy()
 
 			if !router.DefaultRule && router.RuleSyntax == "" {
@@ -193,6 +212,12 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration {
 
 					cp.Middlewares = append(m.Middlewares, cp.Middlewares...)
 
+					if m.DeniedEncodedPathCharacters != nil {
+						// As the denied encoded path characters option is not configurable at the router level,
+						// we can simply copy the whole structure to override the router's default config.
+						cp.DeniedEncodedPathCharacters = m.DeniedEncodedPathCharacters
+					}
+
 					if cp.Observability == nil {
 						cp.Observability = &dynamic.RouterObservabilityConfig{}
 					}
@@ -216,7 +241,9 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration {
 					rtName := name
 					if len(eps) > 1 {
 						rtName = epName + "-" + name
+						modelRouterNames[name] = append(modelRouterNames[name], rtName)
 					}
+
 					rts[rtName] = cp
 				} else {
 					router.EntryPoints = append(router.EntryPoints, epName)
@@ -226,6 +253,26 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration {
 			}
 		}
 
+		for _, rt := range rts {
+			if rt.ParentRefs == nil {
+				continue
+			}
+
+			var parentRefs []string
+			for _, ref := range rt.ParentRefs {
+				// Only add the initial parent ref if it still exists.
+				if _, ok := rts[ref]; ok {
+					parentRefs = append(parentRefs, ref)
+				}
+
+				if names, ok := modelRouterNames[ref]; ok {
+					parentRefs = append(parentRefs, names...)
+				}
+			}
+
+			rt.ParentRefs = parentRefs
+		}
+
 		cfg.HTTP.Routers = rts
 	}
 
@@ -265,6 +312,11 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration {
 func applyDefaultObservabilityModel(cfg dynamic.Configuration) {
 	if cfg.HTTP != nil {
 		for _, router := range cfg.HTTP.Routers {
+			// Only root routers can have models applied.
+			if router.ParentRefs != nil {
+				continue
+			}
+
 			if router.Observability == nil {
 				router.Observability = &dynamic.RouterObservabilityConfig{
 					AccessLogs:     pointer(true),
diff --git a/pkg/server/aggregator_test.go b/pkg/server/aggregator_test.go
index e33ef7ae1..8d78447d2 100644
--- a/pkg/server/aggregator_test.go
+++ b/pkg/server/aggregator_test.go
@@ -810,6 +810,414 @@ func Test_applyModel(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "child router with parentRefs, parent not split",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"web"},
+						},
+						"child": {
+							ParentRefs: []string{"parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models:      make(map[string]*dynamic.Model),
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child": {
+							ParentRefs: []string{"parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models:      make(map[string]*dynamic.Model),
+				},
+			},
+		},
+		{
+			desc: "child router with parentRefs, parent split by model",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"websecure", "web"},
+						},
+						"child": {
+							ParentRefs: []string{"parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							Middlewares: []string{"test"},
+							TLS:         &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"websecure-parent": {
+							EntryPoints: []string{"websecure"},
+							Middlewares: []string{"test"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child": {
+							ParentRefs: []string{"parent", "websecure-parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							Middlewares: []string{"test"},
+							TLS:         &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "multiple child routers with parentRefs, parent split by model",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"websecure", "web"},
+						},
+						"child1": {
+							ParentRefs: []string{"parent"},
+						},
+						"child2": {
+							ParentRefs: []string{"parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							Middlewares: []string{"auth"},
+						},
+					},
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"websecure-parent": {
+							EntryPoints: []string{"websecure"},
+							Middlewares: []string{"auth"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child1": {
+							ParentRefs: []string{"parent", "websecure-parent"},
+						},
+						"child2": {
+							ParentRefs: []string{"parent", "websecure-parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							Middlewares: []string{"auth"},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "child router with parentRefs to non-existing parent",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"child": {
+							ParentRefs: []string{"nonexistent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models:      make(map[string]*dynamic.Model),
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"child": {
+							ParentRefs: []string{"nonexistent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models:      make(map[string]*dynamic.Model),
+				},
+			},
+		},
+		{
+			desc: "child router with multiple parentRefs, some split",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent1": {
+							EntryPoints: []string{"websecure", "web"},
+						},
+						"parent2": {
+							EntryPoints: []string{"web"},
+						},
+						"child": {
+							ParentRefs: []string{"parent1", "parent2"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent1": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"websecure-parent1": {
+							EntryPoints: []string{"websecure"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"parent2": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child": {
+							ParentRefs: []string{"parent1", "websecure-parent1", "parent2"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "child router with multiple parentRefs, all split",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent1": {
+							EntryPoints: []string{"websecure", "web"},
+						},
+						"parent2": {
+							EntryPoints: []string{"web"},
+						},
+						"child": {
+							ParentRefs: []string{"parent1", "parent2"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"web@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"web-parent1": {
+							EntryPoints: []string{"web"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"websecure-parent1": {
+							EntryPoints: []string{"websecure"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"parent2": {
+							EntryPoints: []string{"web"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child": {
+							ParentRefs: []string{"websecure-parent1", "web-parent1", "parent2"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"web@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "child router with parentRefs, parent split into three routers",
+			input: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"websecure", "web", "admin"},
+						},
+						"child": {
+							ParentRefs: []string{"parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+						"admin@internal": {
+							Middlewares: []string{"admin-auth"},
+						},
+					},
+				},
+			},
+			expected: dynamic.Configuration{
+				HTTP: &dynamic.HTTPConfiguration{
+					Routers: map[string]*dynamic.Router{
+						"parent": {
+							EntryPoints: []string{"web"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"websecure-parent": {
+							EntryPoints: []string{"websecure"},
+							TLS:         &dynamic.RouterTLSConfig{},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"admin-parent": {
+							EntryPoints: []string{"admin"},
+							Middlewares: []string{"admin-auth"},
+							Observability: &dynamic.RouterObservabilityConfig{
+								AccessLogs:     pointer(true),
+								Metrics:        pointer(true),
+								Tracing:        pointer(true),
+								TraceVerbosity: otypes.MinimalVerbosity,
+							},
+						},
+						"child": {
+							ParentRefs: []string{"parent", "websecure-parent", "admin-parent"},
+						},
+					},
+					Middlewares: make(map[string]*dynamic.Middleware),
+					Services:    make(map[string]*dynamic.Service),
+					Models: map[string]*dynamic.Model{
+						"websecure@internal": {
+							TLS: &dynamic.RouterTLSConfig{},
+						},
+						"admin@internal": {
+							Middlewares: []string{"admin-auth"},
+						},
+					},
+				},
+			},
+		},
 	}
 
 	for _, test := range testCases {
diff --git a/pkg/server/router/deny.go b/pkg/server/router/deny.go
new file mode 100644
index 000000000..154370e83
--- /dev/null
+++ b/pkg/server/router/deny.go
@@ -0,0 +1,43 @@
+package router
+
+import (
+	"net/http"
+
+	"github.com/rs/zerolog/log"
+)
+
+// denyEncodedPathCharacters reject the request if the escaped path contains encoded characters in the given list.
+func denyEncodedPathCharacters(encodedCharacters map[string]struct{}, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		if len(encodedCharacters) == 0 {
+			h.ServeHTTP(rw, req)
+			return
+		}
+
+		escapedPath := req.URL.EscapedPath()
+
+		for i := 0; i < len(escapedPath); i++ {
+			if escapedPath[i] != '%' {
+				continue
+			}
+
+			// This should never happen as the standard library will reject requests containing invalid percent-encodings.
+			// This discards URLs with a percent character at the end.
+			if i+2 >= len(escapedPath) {
+				rw.WriteHeader(http.StatusBadRequest)
+				return
+			}
+
+			// This rejects a request with a path containing the given encoded characters.
+			if _, exists := encodedCharacters[escapedPath[i:i+3]]; exists {
+				log.Debug().Msgf("Rejecting request because it contains encoded character %s in the URL path: %s", escapedPath[i:i+3], escapedPath)
+				rw.WriteHeader(http.StatusBadRequest)
+				return
+			}
+
+			i += 2
+		}
+
+		h.ServeHTTP(rw, req)
+	})
+}
diff --git a/pkg/server/router/deny_test.go b/pkg/server/router/deny_test.go
new file mode 100644
index 000000000..de17fe5fc
--- /dev/null
+++ b/pkg/server/router/deny_test.go
@@ -0,0 +1,62 @@
+package router
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_denyEncodedPathCharacters(t *testing.T) {
+	tests := []struct {
+		name       string
+		encoded    map[string]struct{}
+		url        string
+		wantStatus int
+	}{
+		{
+			name: "Rejects disallowed characters",
+			encoded: map[string]struct{}{
+				"%0A": {},
+				"%0D": {},
+			},
+			url:        "http://example.com/foo%0Abar",
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "Allows valid paths",
+			encoded: map[string]struct{}{
+				"%0A": {},
+				"%0D": {},
+			},
+			url:        "http://example.com/foo%20bar",
+			wantStatus: http.StatusOK,
+		},
+		{
+			name: "Handles empty path",
+			encoded: map[string]struct{}{
+				"%0A": {},
+			},
+			url:        "http://example.com/",
+			wantStatus: http.StatusOK,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			handler := denyEncodedPathCharacters(test.encoded, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			}))
+
+			req := httptest.NewRequest(http.MethodGet, test.url, nil)
+			res := httptest.NewRecorder()
+
+			handler.ServeHTTP(res, req)
+
+			assert.Equal(t, test.wantStatus, res.Code)
+		})
+	}
+}
diff --git a/pkg/server/router/router.go b/pkg/server/router/router.go
index bac2d5c48..a1bd011a0 100644
--- a/pkg/server/router/router.go
+++ b/pkg/server/router/router.go
@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"math"
 	"net/http"
+	"slices"
+	"sort"
 	"strings"
 
 	"github.com/containous/alice"
@@ -47,7 +49,13 @@ type Manager struct {
 }
 
 // NewManager creates a new Manager.
-func NewManager(conf *runtime.Configuration, serviceManager serviceManager, middlewaresBuilder middlewareBuilder, observabilityMgr *middleware.ObservabilityMgr, tlsManager *tls.Manager, parser httpmuxer.SyntaxParser) *Manager {
+func NewManager(conf *runtime.Configuration,
+	serviceManager serviceManager,
+	middlewaresBuilder middlewareBuilder,
+	observabilityMgr *middleware.ObservabilityMgr,
+	tlsManager *tls.Manager,
+	parser httpmuxer.SyntaxParser,
+) *Manager {
 	return &Manager{
 		routerHandlers:     make(map[string]http.Handler),
 		serviceManager:     serviceManager,
@@ -149,7 +157,13 @@ func (m *Manager) buildEntryPointHandler(ctx context.Context, entryPointName str
 			continue
 		}
 
-		handler, err := m.buildRouterHandler(ctxRouter, routerName, routerConfig)
+		// Only build handlers for root routers (routers without ParentRefs).
+		// Routers with ParentRefs will be built as part of their parent router's muxer.
+		if len(routerConfig.ParentRefs) > 0 {
+			continue
+		}
+
+		handler, err := m.buildRouterHandler(ctxRouter, entryPointName, routerName, routerConfig)
 		if err != nil {
 			routerConfig.AddError(err, true)
 			logger.Error().Err(err).Send()
@@ -183,7 +197,7 @@ func (m *Manager) buildEntryPointHandler(ctx context.Context, entryPointName str
 	return chain.Then(muxer)
 }
 
-func (m *Manager) buildRouterHandler(ctx context.Context, routerName string, routerConfig *runtime.RouterInfo) (http.Handler, error) {
+func (m *Manager) buildRouterHandler(ctx context.Context, entryPointName, routerName string, routerConfig *runtime.RouterInfo) (http.Handler, error) {
 	if handler, ok := m.routerHandlers[routerName]; ok {
 		return handler, nil
 	}
@@ -199,49 +213,296 @@ func (m *Manager) buildRouterHandler(ctx context.Context, routerName string, rou
 		}
 	}
 
-	handler, err := m.buildHTTPHandler(ctx, routerConfig, routerName)
+	handler, err := m.buildHTTPHandler(ctx, routerConfig, entryPointName, routerName)
 	if err != nil {
 		return nil, err
 	}
 
 	m.routerHandlers[routerName] = handler
-	return m.routerHandlers[routerName], nil
+	return handler, nil
 }
 
-func (m *Manager) buildHTTPHandler(ctx context.Context, router *runtime.RouterInfo, routerName string) (http.Handler, error) {
+func (m *Manager) buildHTTPHandler(ctx context.Context, router *runtime.RouterInfo, entryPointName, routerName string) (http.Handler, error) {
 	var qualifiedNames []string
 	for _, name := range router.Middlewares {
 		qualifiedNames = append(qualifiedNames, provider.GetQualifiedName(ctx, name))
 	}
 	router.Middlewares = qualifiedNames
 
-	if router.Service == "" {
-		return nil, errors.New("the service is missing on the router")
-	}
-
-	qualifiedService := provider.GetQualifiedName(ctx, router.Service)
-
 	chain := alice.New()
 
 	if router.DefaultRule {
 		chain = chain.Append(denyrouterrecursion.WrapHandler(routerName))
 	}
 
-	// Access logs, metrics, and tracing middlewares are idempotent if the associated signal is disabled.
-	chain = chain.Append(observability.WrapRouterHandler(ctx, routerName, router.Rule, qualifiedService))
-	metricsHandler := metricsMiddle.RouterMetricsHandler(ctx, m.observabilityMgr.MetricsRegistry(), routerName, qualifiedService)
+	var (
+		nextHandler http.Handler
+		serviceName string
+		err         error
+	)
 
+	// Check if this router has child routers or a service.
+	switch {
+	case len(router.ChildRefs) > 0:
+		// This router routes to child routers - create a muxer for them
+		nextHandler, err = m.buildChildRoutersMuxer(ctx, entryPointName, router.ChildRefs)
+		if err != nil {
+			return nil, fmt.Errorf("building child routers muxer: %w", err)
+		}
+		serviceName = fmt.Sprintf("%s-muxer", routerName)
+	case router.Service != "":
+		// This router routes to a service
+		qualifiedService := provider.GetQualifiedName(ctx, router.Service)
+		nextHandler, err = m.serviceManager.BuildHTTP(ctx, qualifiedService)
+		if err != nil {
+			return nil, err
+		}
+		serviceName = qualifiedService
+	default:
+		return nil, errors.New("router must have either a service or child routers")
+	}
+
+	// Access logs, metrics, and tracing middlewares are idempotent if the associated signal is disabled.
+	chain = chain.Append(observability.WrapRouterHandler(ctx, routerName, router.Rule, serviceName))
+
+	metricsHandler := metricsMiddle.RouterMetricsHandler(ctx, m.observabilityMgr.MetricsRegistry(), routerName, serviceName)
 	chain = chain.Append(observability.WrapMiddleware(ctx, metricsHandler))
+
 	chain = chain.Append(func(next http.Handler) (http.Handler, error) {
-		return accesslog.NewFieldHandler(next, accesslog.RouterName, routerName, nil), nil
+		return accesslog.NewConcatFieldHandler(next, accesslog.RouterName, routerName), nil
 	})
 
+	// Here we are adding deny handlers for encoded path characters and fragment.
+	// Deny handler are only added for root routers, child routers are protected by their parent router deny handlers.
+	if len(router.ParentRefs) == 0 && router.DeniedEncodedPathCharacters != nil {
+		chain = chain.Append(func(next http.Handler) (http.Handler, error) {
+			return denyEncodedPathCharacters(router.DeniedEncodedPathCharacters.Map(), next), nil
+		})
+	}
+
 	mHandler := m.middlewaresBuilder.BuildChain(ctx, router.Middlewares)
 
-	sHandler, err := m.serviceManager.BuildHTTP(ctx, qualifiedService)
-	if err != nil {
-		return nil, err
+	return chain.Extend(*mHandler).Then(nextHandler)
+}
+
+// ParseRouterTree sets up router tree and validates router configuration.
+// This function performs the following operations in order:
+//
+// 1. Populate ChildRefs: Uses ParentRefs to build the parent-child relationship graph
+// 2. Root-first traversal: Starting from root routers (no ParentRefs), traverses the tree
+// 3. Cycle detection: Detects circular dependencies and removes cyclic links
+// 4. Reachability check: Marks routers unreachable from any root as disabled
+// 5. Dead-end detection: Marks routers with no service and no children as disabled
+// 6. Validation: Checks for configuration errors
+//
+// Router status is set during this process:
+// - Enabled: Reachable routers with valid configuration
+// - Disabled: Unreachable, dead-end, or routers with critical errors
+// - Warning: Routers with non-critical errors (like cycles)
+//
+// The function modifies router.Status, router.ChildRefs, and adds errors to router.Err.
+func (m *Manager) ParseRouterTree() {
+	if m.conf == nil || m.conf.Routers == nil {
+		return
 	}
 
-	return chain.Extend(*mHandler).Then(sHandler)
+	// Populate ChildRefs based on ParentRefs and find root routers.
+	var rootRouters []string
+	for routerName, router := range m.conf.Routers {
+		if len(router.ParentRefs) == 0 {
+			rootRouters = append(rootRouters, routerName)
+			continue
+		}
+
+		for _, parentName := range router.ParentRefs {
+			if parentRouter, exists := m.conf.Routers[parentName]; exists {
+				// Add this router as a child of its parent
+				if !slices.Contains(parentRouter.ChildRefs, routerName) {
+					parentRouter.ChildRefs = append(parentRouter.ChildRefs, routerName)
+				}
+			} else {
+				router.AddError(fmt.Errorf("parent router %q does not exist", parentName), true)
+			}
+		}
+
+		// Check for non-root router with TLS config.
+		if router.TLS != nil {
+			router.AddError(errors.New("non-root router cannot have TLS configuration"), true)
+			continue
+		}
+
+		// Check for non-root router with Observability config.
+		if router.Observability != nil {
+			router.AddError(errors.New("non-root router cannot have Observability configuration"), true)
+			continue
+		}
+
+		// Check for non-root router with Entrypoint config.
+		if len(router.EntryPoints) > 0 {
+			router.AddError(errors.New("non-root router cannot have Entrypoints configuration"), true)
+			continue
+		}
+	}
+	sort.Strings(rootRouters)
+
+	// Root-first traversal with cycle detection.
+	visited := make(map[string]bool)
+	currentPath := make(map[string]bool)
+	var path []string
+
+	for _, rootName := range rootRouters {
+		if !visited[rootName] {
+			m.traverse(rootName, visited, currentPath, path)
+		}
+	}
+
+	for routerName, router := range m.conf.Routers {
+		// Set status for all routers based on reachability.
+		if !visited[routerName] {
+			router.AddError(errors.New("router is not reachable"), true)
+			continue
+		}
+
+		// Detect dead-end routers (no service + no children) - AFTER cycle handling.
+		if router.Service == "" && len(router.ChildRefs) == 0 {
+			router.AddError(errors.New("router has no service and no child routers"), true)
+			continue
+		}
+
+		// Check for router with service that is referenced as a parent.
+		if router.Service != "" && len(router.ChildRefs) > 0 {
+			router.AddError(errors.New("router has both a service and is referenced as a parent by other routers"), true)
+			continue
+		}
+	}
+}
+
+// traverse performs a depth-first traversal starting from root routers,
+// detecting cycles and marking visited routers for reachability detection.
+func (m *Manager) traverse(routerName string, visited, currentPath map[string]bool, path []string) {
+	if currentPath[routerName] {
+		// Found a cycle - handle it properly.
+		m.handleCycle(routerName, path)
+		return
+	}
+
+	if visited[routerName] {
+		return
+	}
+
+	router, exists := m.conf.Routers[routerName]
+	// Since the ChildRefs population already guarantees router existence, this check is purely defensive.
+	if !exists {
+		visited[routerName] = true
+		return
+	}
+
+	visited[routerName] = true
+	currentPath[routerName] = true
+	newPath := append(path, routerName)
+
+	// Sort ChildRefs for deterministic behavior.
+	sortedChildRefs := make([]string, len(router.ChildRefs))
+	copy(sortedChildRefs, router.ChildRefs)
+	sort.Strings(sortedChildRefs)
+
+	// Traverse children.
+	for _, childName := range sortedChildRefs {
+		m.traverse(childName, visited, currentPath, newPath)
+	}
+
+	currentPath[routerName] = false
+}
+
+// handleCycle handles cycle detection and removes the victim from guilty router's ChildRefs.
+func (m *Manager) handleCycle(victimRouter string, path []string) {
+	// Find where the cycle starts in the path
+	cycleStart := -1
+	for i, name := range path {
+		if name == victimRouter {
+			cycleStart = i
+			break
+		}
+	}
+
+	if cycleStart < 0 {
+		return
+	}
+
+	// Build the cycle path: from cycle start to current + victim.
+	cyclePath := append(path[cycleStart:], victimRouter)
+	cycleRouters := strings.Join(cyclePath, " -> ")
+
+	// The guilty router is the last one in the path (the one creating the cycle).
+	if len(path) > 0 {
+		guiltyRouterName := path[len(path)-1]
+		guiltyRouter, exists := m.conf.Routers[guiltyRouterName]
+		if !exists {
+			return
+		}
+
+		// Add cycle error to guilty router.
+		guiltyRouter.AddError(fmt.Errorf("cyclic reference detected in router tree: %s", cycleRouters), false)
+
+		// Remove victim from guilty router's ChildRefs.
+		for i, childRef := range guiltyRouter.ChildRefs {
+			if childRef == victimRouter {
+				guiltyRouter.ChildRefs = append(guiltyRouter.ChildRefs[:i], guiltyRouter.ChildRefs[i+1:]...)
+				break
+			}
+		}
+	}
+}
+
+// buildChildRoutersMuxer creates a muxer for child routers.
+func (m *Manager) buildChildRoutersMuxer(ctx context.Context, entryPointName string, childRefs []string) (http.Handler, error) {
+	childMuxer := httpmuxer.NewMuxer(m.parser)
+
+	// Set a default handler for the child muxer (404 Not Found).
+	childMuxer.SetDefaultHandler(http.NotFoundHandler())
+
+	childCount := 0
+	for _, childName := range childRefs {
+		childRouter, exists := m.conf.Routers[childName]
+		if !exists {
+			return nil, fmt.Errorf("child router %q does not exist", childName)
+		}
+
+		// Skip child routers with errors.
+		if len(childRouter.Err) > 0 {
+			continue
+		}
+
+		logger := log.Ctx(ctx).With().Str(logs.RouterName, childName).Logger()
+		ctxChild := logger.WithContext(provider.AddInContext(ctx, childName))
+
+		// Set priority if not set.
+		if childRouter.Priority == 0 {
+			childRouter.Priority = httpmuxer.GetRulePriority(childRouter.Rule)
+		}
+
+		// Build the child router handler.
+		childHandler, err := m.buildRouterHandler(ctxChild, entryPointName, childName, childRouter)
+		if err != nil {
+			childRouter.AddError(err, true)
+			logger.Error().Err(err).Send()
+			continue
+		}
+
+		// Add the child router to the muxer.
+		if err = childMuxer.AddRoute(childRouter.Rule, childRouter.RuleSyntax, childRouter.Priority, childHandler); err != nil {
+			childRouter.AddError(err, true)
+			logger.Error().Err(err).Send()
+			continue
+		}
+
+		childCount++
+	}
+
+	// Prevent empty muxer.
+	if childCount == 0 {
+		return nil, fmt.Errorf("no child routers could be added to muxer (%d skipped)", len(childRefs))
+	}
+
+	return childMuxer, nil
 }
diff --git a/pkg/server/router/router_test.go b/pkg/server/router/router_test.go
index 1458b2e99..a10c597b7 100644
--- a/pkg/server/router/router_test.go
+++ b/pkg/server/router/router_test.go
@@ -1,6 +1,7 @@
 package router
 
 import (
+	"context"
 	"crypto/tls"
 	"io"
 	"math"
@@ -11,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/containous/alice"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	ptypes "github.com/traefik/paerser/types"
@@ -809,30 +811,6 @@ func TestProviderOnMiddlewares(t *testing.T) {
 	assert.Equal(t, []string{"m1@docker", "m2@docker", "m1@file"}, rtConf.Middlewares["chain@docker"].Chain.Middlewares)
 }
 
-type staticTransportManager struct {
-	res *http.Response
-}
-
-func (s staticTransportManager) GetRoundTripper(_ string) (http.RoundTripper, error) {
-	return &staticTransport{res: s.res}, nil
-}
-
-func (s staticTransportManager) GetTLSConfig(_ string) (*tls.Config, error) {
-	panic("implement me")
-}
-
-func (s staticTransportManager) Get(_ string) (*dynamic.ServersTransport, error) {
-	panic("implement me")
-}
-
-type staticTransport struct {
-	res *http.Response
-}
-
-func (t *staticTransport) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return t.res, nil
-}
-
 func BenchmarkRouterServe(b *testing.B) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
 
@@ -927,6 +905,1106 @@ func BenchmarkService(b *testing.B) {
 	}
 }
 
+func TestManager_ComputeMultiLayerRouting(t *testing.T) {
+	testCases := []struct {
+		desc                string
+		routers             map[string]*dynamic.Router
+		expectedStatuses    map[string]string
+		expectedChildRefs   map[string][]string
+		expectedErrors      map[string][]string
+		expectedErrorCounts map[string]int
+	}{
+		{
+			desc: "Simple router",
+			routers: map[string]*dynamic.Router{
+				"A": {
+					Service: "A-service",
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {},
+			},
+		},
+		{
+			// A->B1
+			//  ->B2
+			desc: "Router with two children",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B1": {
+					ParentRefs: []string{"A"},
+					Service:    "B1-service",
+				},
+				"B2": {
+					ParentRefs: []string{"A"},
+					Service:    "B2-service",
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A":  runtime.StatusEnabled,
+				"B1": runtime.StatusEnabled,
+				"B2": runtime.StatusEnabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A":  {"B1", "B2"},
+				"B1": nil,
+				"B2": nil,
+			},
+		},
+		{
+			desc: "Non-root router with TLS config",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B": {
+					ParentRefs: []string{"A"},
+					Service:    "B-service",
+					TLS:        &dynamic.RouterTLSConfig{},
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+				"B": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": nil,
+			},
+			expectedErrors: map[string][]string{
+				"B": {"non-root router cannot have TLS configuration"},
+			},
+		},
+		{
+			desc: "Non-root router with observability config",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B": {
+					ParentRefs:    []string{"A"},
+					Service:       "B-service",
+					Observability: &dynamic.RouterObservabilityConfig{},
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+				"B": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": nil,
+			},
+			expectedErrors: map[string][]string{
+				"B": {"non-root router cannot have Observability configuration"},
+			},
+		},
+		{
+			desc: "Non-root router with EntryPoints config",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B": {
+					ParentRefs:  []string{"A"},
+					Service:     "B-service",
+					EntryPoints: []string{"web"},
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+				"B": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": nil,
+			},
+			expectedErrors: map[string][]string{
+				"B": {"non-root router cannot have Entrypoints configuration"},
+			},
+		},
+
+		{
+			desc: "Router with non-existing parent",
+			routers: map[string]*dynamic.Router{
+				"B": {
+					ParentRefs: []string{"A"},
+					Service:    "B-service",
+				},
+			},
+			expectedStatuses: map[string]string{
+				"B": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"B": nil,
+			},
+			expectedErrors: map[string][]string{
+				"B": {"parent router \"A\" does not exist", "router is not reachable"},
+			},
+		},
+		{
+			desc: "Dead-end router with no child and no service",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {},
+			},
+			expectedErrors: map[string][]string{
+				"A": {"router has no service and no child routers"},
+			},
+		},
+		{
+			// A->B->A
+			desc: "Router is not reachable",
+			routers: map[string]*dynamic.Router{
+				"A": {
+					ParentRefs: []string{"B"},
+				},
+				"B": {
+					ParentRefs: []string{"A"},
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusDisabled,
+				"B": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": {"A"},
+			},
+			// Cycle detection does not visit unreachable routers (it avoids computing the cycle dependency graph for unreachable routers).
+			expectedErrors: map[string][]string{
+				"A": {"router is not reachable"},
+				"B": {"router is not reachable"},
+			},
+		},
+		{
+			// A->B->C->D->B
+			desc: "Router creating a cycle is a dead-end and should be disabled",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B": {
+					ParentRefs: []string{"A", "D"},
+				},
+				"C": {
+					ParentRefs: []string{"B"},
+				},
+				"D": {
+					ParentRefs: []string{"C"},
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+				"B": runtime.StatusEnabled,
+				"C": runtime.StatusEnabled,
+				"D": runtime.StatusDisabled, // Dead-end router is disabled, because the cycle error broke the link with B.
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": {"C"},
+				"C": {"D"},
+				"D": {},
+			},
+			expectedErrors: map[string][]string{
+				"D": {
+					"cyclic reference detected in router tree: B -> C -> D -> B",
+					"router has no service and no child routers",
+				},
+			},
+		},
+		{
+			// A->B->C->D->B
+			//           ->E
+			desc: "Router creating a cycle A->B->C->D->B but which is referenced elsewhere, must be set to warning status",
+			routers: map[string]*dynamic.Router{
+				"A": {},
+				"B": {
+					ParentRefs: []string{"A", "D"},
+				},
+				"C": {
+					ParentRefs: []string{"B"},
+				},
+				"D": {
+					ParentRefs: []string{"C"},
+				},
+				"E": {
+					ParentRefs: []string{"D"},
+					Service:    "E-service",
+				},
+			},
+			expectedStatuses: map[string]string{
+				"A": runtime.StatusEnabled,
+				"B": runtime.StatusEnabled,
+				"C": runtime.StatusEnabled,
+				"D": runtime.StatusWarning,
+				"E": runtime.StatusEnabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"A": {"B"},
+				"B": {"C"},
+				"C": {"D"},
+				"D": {"E"},
+			},
+			expectedErrors: map[string][]string{
+				"D": {"cyclic reference detected in router tree: B -> C -> D -> B"},
+			},
+		},
+		{
+			desc: "Parent router with all children having errors",
+			routers: map[string]*dynamic.Router{
+				"parent": {},
+				"child-a": {
+					ParentRefs: []string{"parent"},
+					Service:    "child-a-service",
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid: non-root cannot have TLS
+				},
+				"child-b": {
+					ParentRefs: []string{"parent"},
+					Service:    "child-b-service",
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid: non-root cannot have TLS
+				},
+			},
+			expectedStatuses: map[string]string{
+				"parent":  runtime.StatusEnabled, // Enabled during ParseRouterTree (no config errors). Would be disabled during handler building when empty muxer is detected.
+				"child-a": runtime.StatusDisabled,
+				"child-b": runtime.StatusDisabled,
+			},
+			expectedChildRefs: map[string][]string{
+				"parent":  {"child-a", "child-b"},
+				"child-a": nil,
+				"child-b": nil,
+			},
+			expectedErrors: map[string][]string{
+				"child-a": {"non-root router cannot have TLS configuration"},
+				"child-b": {"non-root router cannot have TLS configuration"},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create runtime routers
+			runtimeRouters := make(map[string]*runtime.RouterInfo)
+			for name, router := range test.routers {
+				runtimeRouters[name] = &runtime.RouterInfo{
+					Router: router,
+					Status: runtime.StatusEnabled,
+				}
+			}
+
+			conf := &runtime.Configuration{
+				Routers: runtimeRouters,
+			}
+
+			manager := &Manager{
+				conf: conf,
+			}
+
+			// Execute the function we're testing
+			manager.ParseRouterTree()
+
+			// Verify ChildRefs are populated correctly
+			for routerName, expectedChildren := range test.expectedChildRefs {
+				router := runtimeRouters[routerName]
+				assert.ElementsMatch(t, expectedChildren, router.ChildRefs)
+			}
+
+			// Verify statuses are set correctly
+			var gotStatuses map[string]string
+			for routerName, router := range runtimeRouters {
+				if gotStatuses == nil {
+					gotStatuses = make(map[string]string)
+				}
+				gotStatuses[routerName] = router.Status
+			}
+			assert.Equal(t, test.expectedStatuses, gotStatuses)
+
+			// Verify errors are added correctly
+			var gotErrors map[string][]string
+			for routerName, router := range runtimeRouters {
+				for _, err := range router.Err {
+					if gotErrors == nil {
+						gotErrors = make(map[string][]string)
+					}
+					gotErrors[routerName] = append(gotErrors[routerName], err)
+				}
+			}
+			assert.Equal(t, test.expectedErrors, gotErrors)
+		})
+	}
+}
+
+func TestManager_buildChildRoutersMuxer(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		childRefs        []string
+		routers          map[string]*dynamic.Router
+		services         map[string]*dynamic.Service
+		middlewares      map[string]*dynamic.Middleware
+		expectedError    string
+		expectedRequests []struct {
+			path       string
+			statusCode int
+		}
+	}{
+		{
+			desc:      "simple child router with service",
+			childRefs: []string{"child1"},
+			routers: map[string]*dynamic.Router{
+				"child1": {
+					Rule:    "Path(`/api`)",
+					Service: "child1-service",
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/api", statusCode: http.StatusOK},
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc:      "multiple child routers with different rules",
+			childRefs: []string{"child1", "child2"},
+			routers: map[string]*dynamic.Router{
+				"child1": {
+					Rule:    "Path(`/api`)",
+					Service: "child1-service",
+				},
+				"child2": {
+					Rule:    "Path(`/web`)",
+					Service: "child2-service",
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"child2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/api", statusCode: http.StatusOK},
+				{path: "/web", statusCode: http.StatusOK},
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc:      "child router with middleware",
+			childRefs: []string{"child1"},
+			routers: map[string]*dynamic.Router{
+				"child1": {
+					Rule:        "Path(`/api`)",
+					Service:     "child1-service",
+					Middlewares: []string{"test-middleware"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			middlewares: map[string]*dynamic.Middleware{
+				"test-middleware": {
+					Headers: &dynamic.Headers{
+						CustomRequestHeaders: map[string]string{"X-Test": "value"},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/api", statusCode: http.StatusOK},
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc:      "nested child routers (child with its own children)",
+			childRefs: []string{"intermediate"},
+			routers: map[string]*dynamic.Router{
+				"intermediate": {
+					Rule: "PathPrefix(`/api`)",
+					// No service - this will have its own children
+				},
+				"leaf1": {
+					Rule:       "Path(`/api/v1`)",
+					Service:    "leaf1-service",
+					ParentRefs: []string{"intermediate"},
+				},
+				"leaf2": {
+					Rule:       "Path(`/api/v2`)",
+					Service:    "leaf2-service",
+					ParentRefs: []string{"intermediate"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"leaf1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"leaf2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/api/v1", statusCode: http.StatusOK},
+				{path: "/api/v2", statusCode: http.StatusOK},
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc:      "all child routers have errors - should return error",
+			childRefs: []string{"child1", "child2"},
+			routers: map[string]*dynamic.Router{
+				"child1": {
+					Rule:       "Path(`/api`)",
+					Service:    "child1-service",
+					ParentRefs: []string{"parent"},
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid: non-root router cannot have TLS
+				},
+				"child2": {
+					Rule:       "Path(`/web`)",
+					Service:    "child2-service",
+					ParentRefs: []string{"parent"},
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid: non-root router cannot have TLS
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"child2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedError: "no child routers could be added to muxer (2 skipped)",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create runtime routers
+			runtimeRouters := make(map[string]*runtime.RouterInfo)
+			for name, router := range test.routers {
+				runtimeRouters[name] = &runtime.RouterInfo{
+					Router: router,
+				}
+			}
+
+			// Create runtime services
+			runtimeServices := make(map[string]*runtime.ServiceInfo)
+			for name, service := range test.services {
+				runtimeServices[name] = &runtime.ServiceInfo{
+					Service: service,
+				}
+			}
+
+			// Create runtime middlewares
+			runtimeMiddlewares := make(map[string]*runtime.MiddlewareInfo)
+			for name, middleware := range test.middlewares {
+				runtimeMiddlewares[name] = &runtime.MiddlewareInfo{
+					Middleware: middleware,
+				}
+			}
+
+			conf := &runtime.Configuration{
+				Routers:     runtimeRouters,
+				Services:    runtimeServices,
+				Middlewares: runtimeMiddlewares,
+			}
+
+			// Set up the manager with mocks
+			serviceManager := &mockServiceManager{}
+			middlewareBuilder := &mockMiddlewareBuilder{}
+			parser, err := httpmuxer.NewSyntaxParser()
+			require.NoError(t, err)
+
+			manager := NewManager(conf, serviceManager, middlewareBuilder, nil, nil, parser)
+
+			// Compute multi-layer routing to populate ChildRefs
+			manager.ParseRouterTree()
+
+			// Build the child routers muxer
+			ctx := t.Context()
+			muxer, err := manager.buildChildRoutersMuxer(ctx, "test", test.childRefs)
+
+			if test.expectedError != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), test.expectedError)
+				return
+			}
+
+			if len(test.childRefs) == 0 {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotNil(t, muxer)
+
+			// Test that the muxer routes requests correctly
+			for _, req := range test.expectedRequests {
+				recorder := httptest.NewRecorder()
+				request := httptest.NewRequest(http.MethodGet, req.path, nil)
+				muxer.ServeHTTP(recorder, request)
+
+				assert.Equal(t, req.statusCode, recorder.Code, "unexpected status code for path %s", req.path)
+			}
+		})
+	}
+}
+
+func TestManager_buildHTTPHandler_WithChildRouters(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		router           *runtime.RouterInfo
+		childRouters     map[string]*dynamic.Router
+		services         map[string]*dynamic.Service
+		expectedError    string
+		expectedRequests []struct {
+			path       string
+			statusCode int
+		}
+	}{
+		{
+			desc: "router with child routers",
+			router: &runtime.RouterInfo{
+				Router: &dynamic.Router{
+					Rule: "PathPrefix(`/api`)",
+				},
+				ChildRefs: []string{"child1", "child2"},
+			},
+			childRouters: map[string]*dynamic.Router{
+				"child1": {
+					Rule:    "Path(`/api/v1`)",
+					Service: "child1-service",
+				},
+				"child2": {
+					Rule:    "Path(`/api/v2`)",
+					Service: "child2-service",
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"child2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc: "router with service (normal case)",
+			router: &runtime.RouterInfo{
+				Router: &dynamic.Router{
+					Rule:    "PathPrefix(`/api`)",
+					Service: "main-service",
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"main-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{},
+		},
+		{
+			desc: "router with neither service nor child routers - error",
+			router: &runtime.RouterInfo{
+				Router: &dynamic.Router{
+					Rule: "PathPrefix(`/api`)",
+				},
+			},
+			expectedError: "router must have either a service or child routers",
+		},
+		{
+			desc: "router with child routers but missing child - error",
+			router: &runtime.RouterInfo{
+				Router: &dynamic.Router{
+					Rule: "PathPrefix(`/api`)",
+				},
+				ChildRefs: []string{"nonexistent"},
+			},
+			expectedError: "child router \"nonexistent\" does not exist",
+		},
+		{
+			desc: "router with all children having errors - returns empty muxer error",
+			router: &runtime.RouterInfo{
+				Router: &dynamic.Router{
+					Rule: "PathPrefix(`/api`)",
+				},
+				ChildRefs: []string{"child1", "child2"},
+			},
+			childRouters: map[string]*dynamic.Router{
+				"child1": {
+					Rule:       "Path(`/api/v1`)",
+					Service:    "child1-service",
+					ParentRefs: []string{"parent"},
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid for non-root
+				},
+				"child2": {
+					Rule:       "Path(`/api/v2`)",
+					Service:    "child2-service",
+					ParentRefs: []string{"parent"},
+					TLS:        &dynamic.RouterTLSConfig{}, // Invalid for non-root
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"child2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedError: "no child routers could be added to muxer (2 skipped)",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create runtime routers
+			runtimeRouters := make(map[string]*runtime.RouterInfo)
+			runtimeRouters["test-router"] = test.router
+			for name, router := range test.childRouters {
+				runtimeRouters[name] = &runtime.RouterInfo{
+					Router: router,
+				}
+			}
+
+			// Create runtime services
+			runtimeServices := make(map[string]*runtime.ServiceInfo)
+			for name, service := range test.services {
+				runtimeServices[name] = &runtime.ServiceInfo{
+					Service: service,
+				}
+			}
+
+			conf := &runtime.Configuration{
+				Routers:  runtimeRouters,
+				Services: runtimeServices,
+			}
+
+			// Set up the manager with mocks
+			serviceManager := &mockServiceManager{}
+			middlewareBuilder := &mockMiddlewareBuilder{}
+			parser, err := httpmuxer.NewSyntaxParser()
+			require.NoError(t, err)
+
+			manager := NewManager(conf, serviceManager, middlewareBuilder, nil, nil, parser)
+
+			// Run ParseRouterTree to validate configuration and populate ChildRefs/errors
+			manager.ParseRouterTree()
+
+			// Build the HTTP handler
+			ctx := t.Context()
+			handler, err := manager.buildHTTPHandler(ctx, test.router, "test", "test-router")
+
+			if test.expectedError != "" {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), test.expectedError)
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotNil(t, handler)
+
+			// Test that the handler routes requests correctly
+			for _, req := range test.expectedRequests {
+				recorder := httptest.NewRecorder()
+				request := httptest.NewRequest(http.MethodGet, req.path, nil)
+				handler.ServeHTTP(recorder, request)
+
+				assert.Equal(t, req.statusCode, recorder.Code, "unexpected status code for path %s", req.path)
+			}
+		})
+	}
+}
+
+func TestManager_BuildHandlers_WithChildRouters(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		routers          map[string]*dynamic.Router
+		services         map[string]*dynamic.Service
+		expectedRequests []struct {
+			path       string
+			statusCode int
+		}
+	}{
+		{
+			desc: "parent router with child routers",
+			routers: map[string]*dynamic.Router{
+				"parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/api`)",
+				},
+				"child1": {
+					Rule:       "Path(`/api/v1`)",
+					Service:    "child1-service",
+					ParentRefs: []string{"parent"},
+				},
+				"child2": {
+					Rule:       "Path(`/api/v2`)",
+					Service:    "child2-service",
+					ParentRefs: []string{"parent"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"child2-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{
+				{path: "/unknown", statusCode: http.StatusNotFound},
+			},
+		},
+		{
+			desc: "multiple parent routers with children",
+			routers: map[string]*dynamic.Router{
+				"api-parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/api`)",
+				},
+				"web-parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/web`)",
+				},
+				"api-child": {
+					Rule:       "Path(`/api/v1`)",
+					Service:    "api-service",
+					ParentRefs: []string{"api-parent"},
+				},
+				"web-child": {
+					Rule:       "Path(`/web/index`)",
+					Service:    "web-service",
+					ParentRefs: []string{"web-parent"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"api-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+				"web-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8081"}},
+					},
+				},
+			},
+			expectedRequests: []struct {
+				path       string
+				statusCode int
+			}{},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create runtime routers
+			runtimeRouters := make(map[string]*runtime.RouterInfo)
+			for name, router := range test.routers {
+				runtimeRouters[name] = &runtime.RouterInfo{
+					Router: router,
+				}
+			}
+
+			// Create runtime services
+			runtimeServices := make(map[string]*runtime.ServiceInfo)
+			for name, service := range test.services {
+				runtimeServices[name] = &runtime.ServiceInfo{
+					Service: service,
+				}
+			}
+
+			conf := &runtime.Configuration{
+				Routers:  runtimeRouters,
+				Services: runtimeServices,
+			}
+
+			// Set up the manager with mocks
+			serviceManager := &mockServiceManager{}
+			middlewareBuilder := &mockMiddlewareBuilder{}
+			parser, err := httpmuxer.NewSyntaxParser()
+			require.NoError(t, err)
+
+			manager := NewManager(conf, serviceManager, middlewareBuilder, nil, nil, parser)
+
+			// Compute multi-layer routing to set up parent-child relationships
+			manager.ParseRouterTree()
+
+			// Build handlers
+			ctx := t.Context()
+			handlers := manager.BuildHandlers(ctx, []string{"web"}, false)
+
+			handler := handlers["web"]
+			require.NotNil(t, handler)
+
+			// Test that the handler routes requests correctly
+			for _, req := range test.expectedRequests {
+				recorder := httptest.NewRecorder()
+				request := httptest.NewRequest(http.MethodGet, req.path, nil)
+				request.Host = "test.com"
+				handler.ServeHTTP(recorder, request)
+
+				assert.Equal(t, req.statusCode, recorder.Code, "unexpected status code for path %s", req.path)
+			}
+		})
+	}
+}
+
+func TestManager_BuildHandlers_Deny(t *testing.T) {
+	testCases := []struct {
+		desc               string
+		routers            map[string]*dynamic.Router
+		services           map[string]*dynamic.Service
+		requestPath        string
+		expectedStatusCode int
+	}{
+		{
+			desc:        "parent router without child routers, request with encoded slash",
+			requestPath: "/foo%2F",
+			routers: map[string]*dynamic.Router{
+				"parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/`)",
+					Service:     "service",
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			desc:        "parent router with child routers, request with encoded slash",
+			requestPath: "/foo%2F",
+			routers: map[string]*dynamic.Router{
+				"parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/`)",
+				},
+				"child1": {
+					Rule:       "PathPrefix(`/`)",
+					Service:    "child1-service",
+					ParentRefs: []string{"parent"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			desc:        "parent router disallowing encoded slash without child router",
+			requestPath: "/foo%2F",
+			routers: map[string]*dynamic.Router{
+				"parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/`)",
+					Service:     "service",
+					DeniedEncodedPathCharacters: &dynamic.RouterDeniedEncodedPathCharacters{
+						AllowEncodedSlash: false,
+					},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			desc:        "parent router disallowing encoded slash with child routers",
+			requestPath: "/foo%2F",
+			routers: map[string]*dynamic.Router{
+				"parent": {
+					EntryPoints: []string{"web"},
+					Rule:        "PathPrefix(`/`)",
+					DeniedEncodedPathCharacters: &dynamic.RouterDeniedEncodedPathCharacters{
+						AllowEncodedSlash: false,
+					},
+				},
+				"child1": {
+					Rule:       "PathPrefix(`/`)",
+					Service:    "child1-service",
+					ParentRefs: []string{"parent"},
+				},
+			},
+			services: map[string]*dynamic.Service{
+				"child1-service": {
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
+					},
+				},
+			},
+			expectedStatusCode: http.StatusBadRequest,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create runtime routers
+			runtimeRouters := make(map[string]*runtime.RouterInfo)
+			for name, router := range test.routers {
+				runtimeRouters[name] = &runtime.RouterInfo{
+					Router: router,
+				}
+			}
+
+			// Create runtime services
+			runtimeServices := make(map[string]*runtime.ServiceInfo)
+			for name, service := range test.services {
+				runtimeServices[name] = &runtime.ServiceInfo{
+					Service: service,
+				}
+			}
+
+			conf := &runtime.Configuration{
+				Routers:  runtimeRouters,
+				Services: runtimeServices,
+			}
+
+			// Set up the manager with mocks
+			serviceManager := &mockServiceManager{}
+			middlewareBuilder := &mockMiddlewareBuilder{}
+
+			parser, err := httpmuxer.NewSyntaxParser()
+			require.NoError(t, err)
+
+			manager := NewManager(conf, serviceManager, middlewareBuilder, nil, nil, parser)
+
+			// Compute multi-layer routing to set up parent-child relationships
+			manager.ParseRouterTree()
+
+			// Build handlers
+			ctx := t.Context()
+			handlers := manager.BuildHandlers(ctx, []string{"web"}, false)
+
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodGet, test.requestPath, http.NoBody)
+
+			handlers["web"].ServeHTTP(recorder, request)
+
+			assert.Equal(t, test.expectedStatusCode, recorder.Code)
+		})
+	}
+}
+
+// Mock implementations for testing
+
+type staticTransportManager struct {
+	res *http.Response
+}
+
+func (s staticTransportManager) GetRoundTripper(_ string) (http.RoundTripper, error) {
+	return &staticTransport{res: s.res}, nil
+}
+
+func (s staticTransportManager) GetTLSConfig(_ string) (*tls.Config, error) {
+	panic("implement me")
+}
+
+func (s staticTransportManager) Get(_ string) (*dynamic.ServersTransport, error) {
+	panic("implement me")
+}
+
+type staticTransport struct {
+	res *http.Response
+}
+
+func (t *staticTransport) RoundTrip(_ *http.Request) (*http.Response, error) {
+	return t.res, nil
+}
+
+type mockServiceManager struct{}
+
+func (m *mockServiceManager) BuildHTTP(_ context.Context, _ string) (http.Handler, error) {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("mock service response"))
+	}), nil
+}
+
+func (m *mockServiceManager) LaunchHealthCheck(_ context.Context) {}
+
+type mockMiddlewareBuilder struct{}
+
+func (m *mockMiddlewareBuilder) BuildChain(_ context.Context, _ []string) *alice.Chain {
+	chain := alice.New()
+	return &chain
+}
+
 type proxyBuilderMock struct{}
 
 func (p proxyBuilderMock) Build(_ string, _ *url.URL, _, _ bool, _ time.Duration) (http.Handler, error) {
diff --git a/pkg/server/router/tcp/router.go b/pkg/server/router/tcp/router.go
index 0f5c8f843..283f1364c 100644
--- a/pkg/server/router/tcp/router.go
+++ b/pkg/server/router/tcp/router.go
@@ -3,6 +3,7 @@ package tcp
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"crypto/tls"
 	"errors"
 	"io"
@@ -222,7 +223,17 @@ func (r *Router) acmeTLSALPNHandler() tcp.Handler {
 	}
 
 	return tcp.HandlerFunc(func(conn tcp.WriteCloser) {
-		_ = tls.Server(conn, r.httpsTLSConfig).Handshake()
+		tlsConn := tls.Server(conn, r.httpsTLSConfig)
+		defer tlsConn.Close()
+
+		// This avoids stale connections when validating the ACME challenge,
+		// as we expect a validation request to complete in a short period of time.
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+
+		if err := tlsConn.HandshakeContext(ctx); err != nil {
+			log.Debug().Err(err).Msg("Error during ACME-TLS/1 handshake")
+		}
 	})
 }
 
diff --git a/pkg/server/router/tcp/router_test.go b/pkg/server/router/tcp/router_test.go
index 1c2875776..768a78ea9 100644
--- a/pkg/server/router/tcp/router_test.go
+++ b/pkg/server/router/tcp/router_test.go
@@ -697,6 +697,64 @@ func Test_Routing(t *testing.T) {
 	}
 }
 
+func Test_Router_acmeTLSALPNHandlerTimeout(t *testing.T) {
+	router, err := NewRouter()
+	require.NoError(t, err)
+
+	router.httpsTLSConfig = &tls.Config{}
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	acceptCh := make(chan struct{}, 1)
+	go func() {
+		close(acceptCh)
+
+		conn, err := listener.Accept()
+		require.NoError(t, err)
+
+		defer listener.Close()
+
+		router.acmeTLSALPNHandler().
+			ServeTCP(conn.(*net.TCPConn))
+	}()
+
+	<-acceptCh
+
+	conn, err := net.DialTimeout("tcp", listener.Addr().String(), 2*time.Second)
+	require.NoError(t, err)
+
+	// This is a minimal truncated Client Hello message
+	// to simulate a hanging connection during TLS handshake.
+	clientHello := []byte{
+		// TLS Record Header
+		0x16,       // Content Type: Handshake
+		0x03, 0x01, // Version: TLS 1.0 (for compatibility)
+		0x00, 0x50, // Length: 80 bytes
+	}
+
+	_, err = conn.Write(clientHello)
+	require.NoError(t, err)
+
+	errCh := make(chan error, 1)
+	go func() {
+		// This will return an EOF as the acmeTLSALPNHandler will close the connection
+		// after a timeout during the TLS handshake.
+		b := make([]byte, 256)
+		_, err = conn.Read(b)
+
+		errCh <- err
+	}()
+
+	select {
+	case err := <-errCh:
+		assert.ErrorIs(t, err, io.EOF)
+
+	case <-time.After(3 * time.Second):
+		t.Fatal("Error: Timeout waiting for acmeTLSALPNHandler to close the connection")
+	}
+}
+
 // routerTCPCatchAll configures a TCP CatchAll No TLS - HostSNI(`*`) router.
 func routerTCPCatchAll(conf *runtime.Configuration) {
 	conf.TCPRouters["tcp-catchall"] = &runtime.TCPRouterInfo{
diff --git a/pkg/server/routerfactory.go b/pkg/server/routerfactory.go
index f4e0a1102..698de82b4 100644
--- a/pkg/server/routerfactory.go
+++ b/pkg/server/routerfactory.go
@@ -23,8 +23,9 @@ import (
 
 // RouterFactory the factory of TCP/UDP routers.
 type RouterFactory struct {
-	entryPointsTCP  []string
-	entryPointsUDP  []string
+	entryPointsTCP []string
+	entryPointsUDP []string
+
 	allowACMEByPass map[string]bool
 
 	managerFactory *service.ManagerFactory
@@ -105,6 +106,8 @@ func (f *RouterFactory) CreateRouters(rtConf *runtime.Configuration) (map[string
 
 	routerManager := router.NewManager(rtConf, serviceManager, middlewaresBuilder, f.observabilityMgr, f.tlsManager, f.parser)
 
+	routerManager.ParseRouterTree()
+
 	handlersNonTLS := routerManager.BuildHandlers(ctx, f.entryPointsTCP, false)
 	handlersTLS := routerManager.BuildHandlers(ctx, f.entryPointsTCP, true)
 
@@ -124,6 +127,8 @@ func (f *RouterFactory) CreateRouters(rtConf *runtime.Configuration) (map[string
 		}
 	}
 
+	svcTCPManager.LaunchHealthCheck(ctx)
+
 	// UDP
 	svcUDPManager := udpsvc.NewManager(rtConf)
 	rtUDPManager := udprouter.NewManager(rtConf, svcUDPManager)
diff --git a/pkg/server/server_entrypoint_tcp.go b/pkg/server/server_entrypoint_tcp.go
index aef3954bf..71f5fc2b3 100644
--- a/pkg/server/server_entrypoint_tcp.go
+++ b/pkg/server/server_entrypoint_tcp.go
@@ -631,6 +631,12 @@ func newHTTPServer(ctx context.Context, ln net.Listener, configuration *static.E
 	if configuration.HTTP2.MaxConcurrentStreams < 0 {
 		return nil, errors.New("max concurrent streams value must be greater than or equal to zero")
 	}
+	if configuration.HTTP2.MaxDecoderHeaderTableSize < 0 {
+		return nil, errors.New("max decoder header table size value must be greater than or equal to zero")
+	}
+	if configuration.HTTP2.MaxEncoderHeaderTableSize < 0 {
+		return nil, errors.New("max encoder header table size value must be greater than or equal to zero")
+	}
 
 	httpSwitcher := middlewares.NewHandlerSwitcher(http.NotFoundHandler())
 
@@ -688,7 +694,9 @@ func newHTTPServer(ctx context.Context, ln net.Listener, configuration *static.E
 		IdleTimeout:    time.Duration(configuration.Transport.RespondingTimeouts.IdleTimeout),
 		MaxHeaderBytes: configuration.HTTP.MaxHeaderBytes,
 		HTTP2: &http.HTTP2Config{
-			MaxConcurrentStreams: int(configuration.HTTP2.MaxConcurrentStreams),
+			MaxConcurrentStreams:      int(configuration.HTTP2.MaxConcurrentStreams),
+			MaxDecoderHeaderTableSize: int(configuration.HTTP2.MaxDecoderHeaderTableSize),
+			MaxEncoderHeaderTableSize: int(configuration.HTTP2.MaxEncoderHeaderTableSize),
 		},
 	}
 	if debugConnection || (configuration.Transport != nil && (configuration.Transport.KeepAliveMaxTime > 0 || configuration.Transport.KeepAliveMaxRequests > 0)) {
@@ -759,6 +767,24 @@ func (t *trackedConnection) Close() error {
 	return t.WriteCloser.Close()
 }
 
+// denyFragment rejects the request if the URL path contains a fragment (hash character).
+// When go receives an HTTP request, it assumes the absence of fragment URL.
+// However, it is still possible to send a fragment in the request.
+// In this case, Traefik will encode the '#' character, altering the request's intended meaning.
+// To avoid this behavior, the following function rejects requests that include a fragment in the URL.
+func denyFragment(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		if strings.Contains(req.URL.RawPath, "#") {
+			log.Debug().Msgf("Rejecting request because it contains a fragment in the URL path: %s", req.URL.RawPath)
+			rw.WriteHeader(http.StatusBadRequest)
+
+			return
+		}
+
+		h.ServeHTTP(rw, req)
+	})
+}
+
 // This function is inspired by http.AllowQuerySemicolons.
 func encodeQuerySemicolons(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
@@ -779,23 +805,6 @@ func encodeQuerySemicolons(h http.Handler) http.Handler {
 	})
 }
 
-// When go receives an HTTP request, it assumes the absence of fragment URL.
-// However, it is still possible to send a fragment in the request.
-// In this case, Traefik will encode the '#' character, altering the request's intended meaning.
-// To avoid this behavior, the following function rejects requests that include a fragment in the URL.
-func denyFragment(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		if strings.Contains(req.URL.RawPath, "#") {
-			log.Debug().Msgf("Rejecting request because it contains a fragment in the URL path: %s", req.URL.RawPath)
-			rw.WriteHeader(http.StatusBadRequest)
-
-			return
-		}
-
-		h.ServeHTTP(rw, req)
-	})
-}
-
 // sanitizePath removes the "..", "." and duplicate slash segments from the URL according to https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.2.3.
 // It cleans the request URL Path and RawPath, and updates the request URI.
 func sanitizePath(h http.Handler) http.Handler {
diff --git a/pkg/server/server_entrypoint_tcp_test.go b/pkg/server/server_entrypoint_tcp_test.go
index 8170234a7..7e3e0b112 100644
--- a/pkg/server/server_entrypoint_tcp_test.go
+++ b/pkg/server/server_entrypoint_tcp_test.go
@@ -387,6 +387,42 @@ func TestKeepAliveH2c(t *testing.T) {
 	require.Contains(t, err.Error(), "use of closed network connection")
 }
 
+func Test_denyFragment(t *testing.T) {
+	tests := []struct {
+		name       string
+		url        string
+		wantStatus int
+	}{
+		{
+			name:       "Rejects fragment character",
+			url:        "http://example.com/#",
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:       "Allows without fragment",
+			url:        "http://example.com/",
+			wantStatus: http.StatusOK,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			handler := denyFragment(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			}))
+
+			req := httptest.NewRequest(http.MethodGet, test.url, nil)
+			res := httptest.NewRecorder()
+
+			handler.ServeHTTP(res, req)
+
+			assert.Equal(t, test.wantStatus, res.Code)
+		})
+	}
+}
+
 func TestSanitizePath(t *testing.T) {
 	tests := []struct {
 		path     string
@@ -525,6 +561,12 @@ func TestPathOperations(t *testing.T) {
 	configuration := &static.EntryPoint{}
 	configuration.SetDefaults()
 
+	// We need to allow some of the suspicious encoded characters to test the path operations in case they are authorized.
+	configuration.HTTP.EncodedCharacters = &static.EncodedCharacters{
+		AllowEncodedSlash:   true,
+		AllowEncodedPercent: true,
+	}
+
 	// Create the HTTP server using newHTTPServer.
 	server, err := newHTTPServer(t.Context(), ln, configuration, false, requestdecorator.New(nil))
 	require.NoError(t, err)
@@ -648,3 +690,34 @@ func TestPathOperations(t *testing.T) {
 		})
 	}
 }
+
+func TestHTTP2Config(t *testing.T) {
+	expectedMaxConcurrentStreams := 42
+	expectedEncoderTableSize := 128
+	expectedDecoderTableSize := 256
+
+	// Create a listener for the server.
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = ln.Close()
+	})
+
+	// Define the server configuration.
+	configuration := &static.EntryPoint{}
+	configuration.SetDefaults()
+	configuration.HTTP2.MaxConcurrentStreams = int32(expectedMaxConcurrentStreams)
+	configuration.HTTP2.MaxEncoderHeaderTableSize = int32(expectedEncoderTableSize)
+	configuration.HTTP2.MaxDecoderHeaderTableSize = int32(expectedDecoderTableSize)
+
+	// Create the HTTP server using newHTTPServer.
+	server, err := newHTTPServer(t.Context(), ln, configuration, false, requestdecorator.New(nil))
+	require.NoError(t, err)
+
+	// Get the underlying HTTP Server.
+	httpServer := server.Server.(*http.Server)
+
+	assert.Equal(t, expectedMaxConcurrentStreams, httpServer.HTTP2.MaxConcurrentStreams)
+	assert.Equal(t, expectedEncoderTableSize, httpServer.HTTP2.MaxEncoderHeaderTableSize)
+	assert.Equal(t, expectedDecoderTableSize, httpServer.HTTP2.MaxDecoderHeaderTableSize)
+}
diff --git a/pkg/server/service/loadbalancer/hrw/hrw.go b/pkg/server/service/loadbalancer/hrw/hrw.go
new file mode 100644
index 000000000..51ca397fd
--- /dev/null
+++ b/pkg/server/service/loadbalancer/hrw/hrw.go
@@ -0,0 +1,201 @@
+package hrw
+
+import (
+	"context"
+	"errors"
+	"hash/fnv"
+	"math"
+	"net/http"
+	"sync"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/ip"
+)
+
+var errNoAvailableServer = errors.New("no available server")
+
+type namedHandler struct {
+	http.Handler
+	name   string
+	weight float64
+}
+
+// Balancer implements the Rendezvous Hashing algorithm for load balancing.
+// The idea is to compute a score for each available backend using a hash of the client's
+// source (for example, IP) combined with the backend's identifier, and assign the client
+// to the backend with the highest score. This ensures that each client consistently
+// connects to the same backend while distributing load evenly across all backends.
+type Balancer struct {
+	wantsHealthCheck bool
+
+	strategy ip.RemoteAddrStrategy
+
+	handlersMu sync.RWMutex
+	// References all the handlers by name and also by the hashed value of the name.
+	handlers []*namedHandler
+	// status is a record of which child services of the Balancer are healthy, keyed
+	// by name of child service. A service is initially added to the map when it is
+	// created via Add, and it is later removed or added to the map as needed,
+	// through the SetStatus method.
+	status map[string]struct{}
+	// updaters is the list of hooks that are run (to update the Balancer
+	// parent(s)), whenever the Balancer status changes.
+	// No mutex is needed, as it is modified only during the configuration build.
+	updaters []func(bool)
+	// fenced is the list of terminating yet still serving child services.
+	fenced map[string]struct{}
+}
+
+// New creates a new load balancer.
+func New(wantHealthCheck bool) *Balancer {
+	balancer := &Balancer{
+		status:           make(map[string]struct{}),
+		fenced:           make(map[string]struct{}),
+		wantsHealthCheck: wantHealthCheck,
+		strategy:         ip.RemoteAddrStrategy{},
+	}
+
+	return balancer
+}
+
+// getNodeScore calculates the score of the couple of src and handler name.
+func getNodeScore(handler *namedHandler, src string) float64 {
+	h := fnv.New64a()
+	h.Write([]byte(src + handler.name))
+	sum := h.Sum64()
+	score := float64(sum) / math.Pow(2, 64)
+	logScore := 1.0 / -math.Log(score)
+
+	return logScore * handler.weight
+}
+
+// SetStatus sets on the balancer that its given child is now of the given
+// status. balancerName is only needed for logging purposes.
+func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
+	b.handlersMu.Lock()
+	defer b.handlersMu.Unlock()
+
+	upBefore := len(b.status) > 0
+
+	status := "DOWN"
+	if up {
+		status = "UP"
+	}
+
+	log.Ctx(ctx).Debug().Msgf("Setting status of %s to %v", childName, status)
+
+	if up {
+		b.status[childName] = struct{}{}
+	} else {
+		delete(b.status, childName)
+	}
+
+	upAfter := len(b.status) > 0
+	status = "DOWN"
+	if upAfter {
+		status = "UP"
+	}
+
+	// No Status Change
+	if upBefore == upAfter {
+		// We're still with the same status, no need to propagate
+		log.Ctx(ctx).Debug().Msgf("Still %s, no need to propagate", status)
+		return
+	}
+
+	// Status Change
+	log.Ctx(ctx).Debug().Msgf("Propagating new %s status", status)
+	for _, fn := range b.updaters {
+		fn(upAfter)
+	}
+}
+
+// RegisterStatusUpdater adds fn to the list of hooks that are run when the
+// status of the Balancer changes.
+// Not thread safe.
+func (b *Balancer) RegisterStatusUpdater(fn func(up bool)) error {
+	if !b.wantsHealthCheck {
+		return errors.New("healthCheck not enabled in config for this HRW service")
+	}
+	b.updaters = append(b.updaters, fn)
+
+	return nil
+}
+
+func (b *Balancer) nextServer(ip string) (*namedHandler, error) {
+	b.handlersMu.RLock()
+	var healthy []*namedHandler
+	for _, h := range b.handlers {
+		if _, ok := b.status[h.name]; ok {
+			if _, fenced := b.fenced[h.name]; !fenced {
+				healthy = append(healthy, h)
+			}
+		}
+	}
+	b.handlersMu.RUnlock()
+
+	if len(healthy) == 0 {
+		return nil, errNoAvailableServer
+	}
+
+	var handler *namedHandler
+	score := 0.0
+	for _, h := range healthy {
+		s := getNodeScore(h, ip)
+		if s > score {
+			handler = h
+			score = s
+		}
+	}
+
+	log.Debug().Msgf("Service selected by HRW: %s", handler.name)
+
+	return handler, nil
+}
+
+func (b *Balancer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	// give ip fetched to b.nextServer
+	clientIP := b.strategy.GetIP(req)
+	log.Debug().Msgf("ServeHTTP() clientIP=%s", clientIP)
+
+	server, err := b.nextServer(clientIP)
+	if err != nil {
+		if errors.Is(err, errNoAvailableServer) {
+			http.Error(w, errNoAvailableServer.Error(), http.StatusServiceUnavailable)
+		} else {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+		return
+	}
+
+	server.ServeHTTP(w, req)
+}
+
+// AddServer adds a handler with a server.
+func (b *Balancer) AddServer(name string, handler http.Handler, server dynamic.Server) {
+	b.Add(name, handler, server.Weight, server.Fenced)
+}
+
+// Add adds a handler.
+// A handler with a non-positive weight is ignored.
+func (b *Balancer) Add(name string, handler http.Handler, weight *int, fenced bool) {
+	w := 1
+	if weight != nil {
+		w = *weight
+	}
+
+	if w <= 0 { // non-positive weight is meaningless
+		return
+	}
+
+	h := &namedHandler{Handler: handler, name: name, weight: float64(w)}
+
+	b.handlersMu.Lock()
+	b.handlers = append(b.handlers, h)
+	b.status[name] = struct{}{}
+	if fenced {
+		b.fenced[name] = struct{}{}
+	}
+	b.handlersMu.Unlock()
+}
diff --git a/pkg/server/service/loadbalancer/hrw/hrw_test.go b/pkg/server/service/loadbalancer/hrw/hrw_test.go
new file mode 100644
index 000000000..a843fdb3d
--- /dev/null
+++ b/pkg/server/service/loadbalancer/hrw/hrw_test.go
@@ -0,0 +1,309 @@
+package hrw
+
+import (
+	"context"
+	"encoding/binary"
+	"math/rand"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// newTestRand creates a deterministic random source for reproducible tests.
+func newTestRand() *rand.Rand {
+	return rand.New(rand.NewSource(12345))
+}
+
+// genIPAddress generate randomly an IP address as a string.
+func genIPAddress(rng *rand.Rand) string {
+	buf := make([]byte, 4)
+
+	ip := rng.Uint32()
+
+	binary.LittleEndian.PutUint32(buf, ip)
+	ipStr := net.IP(buf)
+	return ipStr.String()
+}
+
+// initStatusArray initialize an array filled with status value for test assertions.
+func initStatusArray(size int, value int) []int {
+	status := make([]int, 0, size)
+	for i := 1; i <= size; i++ {
+		status = append(status, value)
+	}
+	return status
+}
+
+// Tests evaluate load balancing of single and multiple clients.
+// Due to the randomness of IP Adresses, repartition between services is not perfect
+// The tests validate repartition using a margin of 10% of the number of requests
+
+func TestBalancer(t *testing.T) {
+	rng := newTestRand()
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(4), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	for range 100 {
+		req.RemoteAddr = genIPAddress(rng)
+		balancer.ServeHTTP(recorder, req)
+	}
+	assert.InDelta(t, 80, recorder.save["first"], 10)
+	assert.InDelta(t, 20, recorder.save["second"], 10)
+}
+
+func TestBalancerNoService(t *testing.T) {
+	balancer := New(false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+func TestBalancerOneServerZeroWeight(t *testing.T) {
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), Int(0), false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	assert.Equal(t, 3, recorder.save["first"])
+}
+
+type key string
+
+const serviceName key = "serviceName"
+
+func TestBalancerNoServiceUp(t *testing.T) {
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), Int(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), Int(1), false)
+
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "first", false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+func TestBalancerOneServerDown(t *testing.T) {
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), Int(1), false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	assert.Equal(t, 3, recorder.save["first"])
+}
+
+func TestBalancerDownThenUp(t *testing.T) {
+	rng := newTestRand()
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+	assert.Equal(t, 3, recorder.save["first"])
+
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", true)
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	for range 100 {
+		req.RemoteAddr = genIPAddress(rng)
+		balancer.ServeHTTP(recorder, req)
+	}
+	assert.InDelta(t, 50, recorder.save["first"], 10)
+	assert.InDelta(t, 50, recorder.save["second"], 10)
+}
+
+func TestBalancerPropagate(t *testing.T) {
+	rng := newTestRand()
+	balancer1 := New(true)
+
+	balancer1.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+	balancer1.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	balancer2 := New(true)
+	balancer2.Add("third", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "third")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+	balancer2.Add("fourth", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "fourth")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	topBalancer := New(true)
+	topBalancer.Add("balancer1", balancer1, Int(1), false)
+	_ = balancer1.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "balancer1", up)
+	})
+	topBalancer.Add("balancer2", balancer2, Int(1), false)
+	_ = balancer2.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "balancer2", up)
+	})
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	for range 100 {
+		req.RemoteAddr = genIPAddress(rng)
+		topBalancer.ServeHTTP(recorder, req)
+	}
+	assert.InDelta(t, 25, recorder.save["first"], 10)
+	assert.InDelta(t, 25, recorder.save["second"], 10)
+	assert.InDelta(t, 25, recorder.save["third"], 10)
+	assert.InDelta(t, 25, recorder.save["fourth"], 10)
+	wantStatus := initStatusArray(100, 200)
+	assert.Equal(t, wantStatus, recorder.status)
+
+	// fourth gets downed, but balancer2 still up since third is still up.
+	balancer2.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "fourth", false)
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	for range 100 {
+		req.RemoteAddr = genIPAddress(rng)
+		topBalancer.ServeHTTP(recorder, req)
+	}
+	assert.InDelta(t, 25, recorder.save["first"], 10)
+	assert.InDelta(t, 25, recorder.save["second"], 10)
+	assert.InDelta(t, 50, recorder.save["third"], 10)
+	assert.InDelta(t, 0, recorder.save["fourth"], 0)
+	wantStatus = initStatusArray(100, 200)
+	assert.Equal(t, wantStatus, recorder.status)
+
+	// third gets downed, and the propagation triggers balancer2 to be marked as
+	// down as well for topBalancer.
+	balancer2.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "third", false)
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	for range 100 {
+		req.RemoteAddr = genIPAddress(rng)
+		topBalancer.ServeHTTP(recorder, req)
+	}
+	assert.InDelta(t, 50, recorder.save["first"], 10)
+	assert.InDelta(t, 50, recorder.save["second"], 10)
+	assert.InDelta(t, 0, recorder.save["third"], 0)
+	assert.InDelta(t, 0, recorder.save["fourth"], 0)
+	wantStatus = initStatusArray(100, 200)
+	assert.Equal(t, wantStatus, recorder.status)
+}
+
+func TestBalancerAllServersZeroWeight(t *testing.T) {
+	balancer := New(false)
+
+	balancer.Add("test", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), Int(0), false)
+	balancer.Add("test2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), Int(0), false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+func TestSticky(t *testing.T) {
+	rng := newTestRand()
+	balancer := New(false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), Int(2), false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.RemoteAddr = genIPAddress(rng)
+	for range 10 {
+		for _, cookie := range recorder.Result().Cookies() {
+			req.AddCookie(cookie)
+		}
+		recorder.ResponseRecorder = httptest.NewRecorder()
+
+		balancer.ServeHTTP(recorder, req)
+	}
+
+	assert.True(t, recorder.save["first"] == 0 || recorder.save["first"] == 10)
+	assert.True(t, recorder.save["second"] == 0 || recorder.save["second"] == 10)
+	// from one IP, the choice between server must be the same for the 10 requests
+	// weight does not impose what would be chosen from 1 client
+}
+
+func Int(v int) *int { return &v }
+
+type responseRecorder struct {
+	*httptest.ResponseRecorder
+	save     map[string]int
+	sequence []string
+	status   []int
+}
+
+func (r *responseRecorder) WriteHeader(statusCode int) {
+	r.save[r.Header().Get("server")]++
+	r.sequence = append(r.sequence, r.Header().Get("server"))
+	r.status = append(r.status, statusCode)
+	r.ResponseRecorder.WriteHeader(statusCode)
+}
diff --git a/pkg/server/service/loadbalancer/leasttime/leasttime.go b/pkg/server/service/loadbalancer/leasttime/leasttime.go
new file mode 100644
index 000000000..41f4f5218
--- /dev/null
+++ b/pkg/server/service/loadbalancer/leasttime/leasttime.go
@@ -0,0 +1,373 @@
+package leasttime
+
+import (
+	"context"
+	"errors"
+	"math"
+	"net/http"
+	"net/http/httptrace"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer"
+)
+
+const sampleSize = 100 // Number of response time samples to track.
+
+var errNoAvailableServer = errors.New("no available server")
+
+// namedHandler wraps an HTTP handler with metrics and server information.
+// Tracks response time (TTFB) and inflight request count for load balancing decisions.
+type namedHandler struct {
+	http.Handler
+	name   string
+	weight float64
+
+	deadlineMu sync.RWMutex
+	deadline   float64 // WRR tie-breaking (EDF scheduling).
+
+	inflightCount atomic.Int64 // Number of inflight requests.
+
+	responseTimeMu  sync.RWMutex
+	responseTimes   [sampleSize]float64 // Fixed-size ring buffer (TTFB measurements in ms).
+	responseTimeIdx int                 // Current position in ring buffer.
+	responseTimeSum float64             // Sum of all values in buffer.
+	sampleCount     int                 // Number of samples collected so far.
+}
+
+// updateResponseTime updates the average response time for this server using a ring buffer.
+func (s *namedHandler) updateResponseTime(elapsed time.Duration) {
+	s.responseTimeMu.Lock()
+	defer s.responseTimeMu.Unlock()
+
+	ms := float64(elapsed.Milliseconds())
+
+	if s.sampleCount < sampleSize {
+		// Still filling the buffer.
+		s.responseTimes[s.responseTimeIdx] = ms
+		s.responseTimeSum += ms
+		s.sampleCount++
+	} else {
+		// Buffer is full, replace oldest value.
+		oldValue := s.responseTimes[s.responseTimeIdx]
+		s.responseTimes[s.responseTimeIdx] = ms
+		s.responseTimeSum = s.responseTimeSum - oldValue + ms
+	}
+
+	s.responseTimeIdx = (s.responseTimeIdx + 1) % sampleSize
+}
+
+// getAvgResponseTime returns the average response time in milliseconds.
+// Returns 0 if no samples have been collected yet (cold start).
+func (s *namedHandler) getAvgResponseTime() float64 {
+	s.responseTimeMu.RLock()
+	defer s.responseTimeMu.RUnlock()
+
+	if s.sampleCount == 0 {
+		return 0
+	}
+	return s.responseTimeSum / float64(s.sampleCount)
+}
+
+func (s *namedHandler) getDeadline() float64 {
+	s.deadlineMu.RLock()
+	defer s.deadlineMu.RUnlock()
+	return s.deadline
+}
+
+func (s *namedHandler) setDeadline(deadline float64) {
+	s.deadlineMu.Lock()
+	defer s.deadlineMu.Unlock()
+	s.deadline = deadline
+}
+
+// Balancer implements the least-time load balancing algorithm.
+// It selects the server with the lowest average response time (TTFB) and fewest active connections.
+type Balancer struct {
+	wantsHealthCheck bool
+
+	// handlersMu protects the handlers slice, the status and the fenced maps.
+	handlersMu sync.RWMutex
+	handlers   []*namedHandler
+	// status is a record of which child services of the Balancer are healthy, keyed
+	// by name of child service. A service is initially added to the map when it is
+	// created via Add, and it is later removed or added to the map as needed,
+	// through the SetStatus method.
+	status map[string]struct{}
+	// fenced is the list of terminating yet still serving child services.
+	fenced map[string]struct{}
+
+	// updaters is the list of hooks that are run (to update the Balancer
+	// parent(s)), whenever the Balancer status changes.
+	// No mutex is needed, as it is modified only during the configuration build.
+	updaters []func(bool)
+
+	sticky *loadbalancer.Sticky
+
+	// deadlineMu protects EDF scheduling state (curDeadline and all handler deadline fields).
+	// Separate from handlersMu to reduce lock contention during tie-breaking.
+	curDeadlineMu sync.RWMutex
+	// curDeadline is used for WRR tie-breaking (EDF scheduling).
+	curDeadline float64
+}
+
+// New creates a new least-time load balancer.
+func New(stickyConfig *dynamic.Sticky, wantsHealthCheck bool) *Balancer {
+	balancer := &Balancer{
+		status:           make(map[string]struct{}),
+		fenced:           make(map[string]struct{}),
+		wantsHealthCheck: wantsHealthCheck,
+	}
+	if stickyConfig != nil && stickyConfig.Cookie != nil {
+		balancer.sticky = loadbalancer.NewSticky(*stickyConfig.Cookie)
+	}
+
+	return balancer
+}
+
+// SetStatus sets on the balancer that its given child is now of the given
+// status. childName is only needed for logging purposes.
+func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
+	b.handlersMu.Lock()
+	defer b.handlersMu.Unlock()
+
+	upBefore := len(b.status) > 0
+
+	status := "DOWN"
+	if up {
+		status = "UP"
+	}
+
+	log.Ctx(ctx).Debug().Msgf("Setting status of %s to %v", childName, status)
+
+	if up {
+		b.status[childName] = struct{}{}
+	} else {
+		delete(b.status, childName)
+	}
+
+	upAfter := len(b.status) > 0
+	status = "DOWN"
+	if upAfter {
+		status = "UP"
+	}
+
+	// No Status Change.
+	if upBefore == upAfter {
+		// We're still with the same status, no need to propagate.
+		log.Ctx(ctx).Debug().Msgf("Still %s, no need to propagate", status)
+		return
+	}
+
+	// Status Change.
+	log.Ctx(ctx).Debug().Msgf("Propagating new %s status", status)
+	for _, fn := range b.updaters {
+		fn(upAfter)
+	}
+}
+
+// RegisterStatusUpdater adds fn to the list of hooks that are run when the
+// status of the Balancer changes.
+// Not thread safe.
+func (b *Balancer) RegisterStatusUpdater(fn func(up bool)) error {
+	if !b.wantsHealthCheck {
+		return errors.New("healthCheck not enabled in config for this LeastTime service")
+	}
+	b.updaters = append(b.updaters, fn)
+	return nil
+}
+
+// getHealthyServers returns the list of healthy, non-fenced servers.
+func (b *Balancer) getHealthyServers() []*namedHandler {
+	b.handlersMu.RLock()
+	defer b.handlersMu.RUnlock()
+
+	var healthy []*namedHandler
+	for _, h := range b.handlers {
+		if _, ok := b.status[h.name]; ok {
+			if _, fenced := b.fenced[h.name]; !fenced {
+				healthy = append(healthy, h)
+			}
+		}
+	}
+	return healthy
+}
+
+// selectWRR selects a server from candidates using Weighted Round Robin (EDF scheduling).
+// This is used for tie-breaking when multiple servers have identical scores.
+func (b *Balancer) selectWRR(candidates []*namedHandler) *namedHandler {
+	if len(candidates) == 0 {
+		return nil
+	}
+
+	selected := candidates[0]
+	minDeadline := math.MaxFloat64
+
+	// Find handler with earliest deadline.
+	for _, h := range candidates {
+		handlerDeadline := h.getDeadline()
+		if handlerDeadline < minDeadline {
+			minDeadline = handlerDeadline
+			selected = h
+		}
+	}
+
+	// Update deadline based on when this server was selected (minDeadline),
+	// not the global curDeadline. This ensures proper weighted distribution.
+	newDeadline := minDeadline + 1/selected.weight
+	selected.setDeadline(newDeadline)
+
+	// Track the maximum deadline assigned for initializing new servers.
+	b.curDeadlineMu.Lock()
+	if newDeadline > b.curDeadline {
+		b.curDeadline = newDeadline
+	}
+	b.curDeadlineMu.Unlock()
+
+	return selected
+}
+
+// Score = (avgResponseTime × (1 + inflightCount)) / weight.
+func (b *Balancer) nextServer() (*namedHandler, error) {
+	healthy := b.getHealthyServers()
+
+	if len(healthy) == 0 {
+		return nil, errNoAvailableServer
+	}
+
+	if len(healthy) == 1 {
+		return healthy[0], nil
+	}
+
+	// Calculate scores and find minimum.
+	minScore := math.MaxFloat64
+	var candidates []*namedHandler
+
+	for _, h := range healthy {
+		avgRT := h.getAvgResponseTime()
+		inflight := float64(h.inflightCount.Load())
+		score := (avgRT * (1 + inflight)) / h.weight
+
+		if score < minScore {
+			minScore = score
+			candidates = []*namedHandler{h}
+		} else if score == minScore {
+			candidates = append(candidates, h)
+		}
+	}
+
+	if len(candidates) == 1 {
+		return candidates[0], nil
+	}
+
+	// Multiple servers with same score: use WRR (EDF) tie-breaking.
+	selected := b.selectWRR(candidates)
+	if selected == nil {
+		return nil, errNoAvailableServer
+	}
+
+	return selected, nil
+}
+
+func (b *Balancer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	// Handle sticky sessions first.
+	if b.sticky != nil {
+		h, rewrite, err := b.sticky.StickyHandler(req)
+		if err != nil {
+			log.Error().Err(err).Msg("Error while getting sticky handler")
+		} else if h != nil {
+			b.handlersMu.RLock()
+			_, ok := b.status[h.Name]
+			b.handlersMu.RUnlock()
+			if ok {
+				if rewrite {
+					if err := b.sticky.WriteStickyCookie(rw, h.Name); err != nil {
+						log.Error().Err(err).Msg("Writing sticky cookie")
+					}
+				}
+
+				h.ServeHTTP(rw, req)
+				return
+			}
+		}
+	}
+
+	server, err := b.nextServer()
+	if err != nil {
+		if errors.Is(err, errNoAvailableServer) {
+			http.Error(rw, errNoAvailableServer.Error(), http.StatusServiceUnavailable)
+		} else {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+		}
+		return
+	}
+
+	if b.sticky != nil {
+		if err := b.sticky.WriteStickyCookie(rw, server.name); err != nil {
+			log.Error().Err(err).Msg("Error while writing sticky cookie")
+		}
+	}
+
+	// Track inflight requests.
+	server.inflightCount.Add(1)
+	defer server.inflightCount.Add(-1)
+
+	startTime := time.Now()
+	trace := &httptrace.ClientTrace{
+		GotFirstResponseByte: func() {
+			// Update average response time (TTFB).
+			server.updateResponseTime(time.Since(startTime))
+		},
+	}
+	traceCtx := httptrace.WithClientTrace(req.Context(), trace)
+	server.ServeHTTP(rw, req.WithContext(traceCtx))
+}
+
+// AddServer adds a handler with a server.
+func (b *Balancer) AddServer(name string, handler http.Handler, server dynamic.Server) {
+	b.Add(name, handler, server.Weight, server.Fenced)
+}
+
+// Add adds a handler.
+// A handler with a non-positive weight is ignored.
+func (b *Balancer) Add(name string, handler http.Handler, weight *int, fenced bool) {
+	w := 1
+	if weight != nil {
+		w = *weight
+	}
+
+	if w <= 0 { // non-positive weight is meaningless.
+		return
+	}
+
+	h := &namedHandler{Handler: handler, name: name, weight: float64(w)}
+
+	// Initialize deadline by adding 1/weight to current deadline.
+	// This staggers servers to prevent all starting at the same time.
+	var deadline float64
+	b.curDeadlineMu.RLock()
+	deadline = b.curDeadline + 1/h.weight
+	b.curDeadlineMu.RUnlock()
+
+	h.setDeadline(deadline)
+
+	// Update balancer's current deadline with the new server's deadline.
+	b.curDeadlineMu.Lock()
+	b.curDeadline = deadline
+	b.curDeadlineMu.Unlock()
+
+	b.handlersMu.Lock()
+	b.handlers = append(b.handlers, h)
+	b.status[name] = struct{}{}
+	if fenced {
+		b.fenced[name] = struct{}{}
+	}
+	b.handlersMu.Unlock()
+
+	if b.sticky != nil {
+		b.sticky.AddHandler(name, handler)
+	}
+}
diff --git a/pkg/server/service/loadbalancer/leasttime/leasttime_test.go b/pkg/server/service/loadbalancer/leasttime/leasttime_test.go
new file mode 100644
index 000000000..53bb81505
--- /dev/null
+++ b/pkg/server/service/loadbalancer/leasttime/leasttime_test.go
@@ -0,0 +1,1092 @@
+package leasttime
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httptrace"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+)
+
+type key string
+
+const serviceName key = "serviceName"
+
+func pointer[T any](v T) *T { return &v }
+
+// responseRecorder tracks which servers handled requests.
+type responseRecorder struct {
+	*httptest.ResponseRecorder
+	save map[string]int
+}
+
+func (r *responseRecorder) WriteHeader(statusCode int) {
+	server := r.Header().Get("server")
+	if server != "" {
+		r.save[server]++
+	}
+	r.ResponseRecorder.WriteHeader(statusCode)
+}
+
+// TestBalancer tests basic server addition and least-time selection.
+func TestBalancer(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 10 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// With least-time and equal response times, both servers should get some traffic.
+	assert.Positive(t, recorder.save["first"])
+	assert.Positive(t, recorder.save["second"])
+	assert.Equal(t, 10, recorder.save["first"]+recorder.save["second"])
+}
+
+// TestBalancerNoService tests behavior when no servers are configured.
+func TestBalancerNoService(t *testing.T) {
+	balancer := New(nil, false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+// TestBalancerNoServiceUp tests behavior when all servers are marked down.
+func TestBalancerNoServiceUp(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), pointer(1), false)
+
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "first", false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+// TestBalancerOneServerDown tests that down servers are excluded from selection.
+func TestBalancerOneServerDown(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusInternalServerError)
+	}), pointer(1), false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	assert.Equal(t, 3, recorder.save["first"])
+	assert.Equal(t, 0, recorder.save["second"])
+}
+
+// TestBalancerOneServerDownThenUp tests server status transitions.
+func TestBalancerOneServerDownThenUp(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+	assert.Equal(t, 3, recorder.save["first"])
+	assert.Equal(t, 0, recorder.save["second"])
+
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "parent"), "second", true)
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 20 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+	// Both servers should get some traffic.
+	assert.Positive(t, recorder.save["first"])
+	assert.Positive(t, recorder.save["second"])
+	assert.Equal(t, 20, recorder.save["first"]+recorder.save["second"])
+}
+
+// TestBalancerAllServersZeroWeight tests that all zero-weight servers result in no available server.
+func TestBalancerAllServersZeroWeight(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), pointer(0), false)
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), pointer(0), false)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+// TestBalancerOneServerZeroWeight tests that zero-weight servers are ignored.
+func TestBalancerOneServerZeroWeight(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), pointer(0), false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Only first server should receive traffic.
+	assert.Equal(t, 3, recorder.save["first"])
+	assert.Equal(t, 0, recorder.save["second"])
+}
+
+// TestBalancerPropagate tests status propagation to parent balancers.
+func TestBalancerPropagate(t *testing.T) {
+	balancer1 := New(nil, true)
+
+	balancer1.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+	balancer1.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer2 := New(nil, true)
+	balancer2.Add("third", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "third")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+	balancer2.Add("fourth", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "fourth")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	topBalancer := New(nil, true)
+	topBalancer.Add("balancer1", balancer1, pointer(1), false)
+	topBalancer.Add("balancer2", balancer2, pointer(1), false)
+	err := balancer1.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "balancer1", up)
+	})
+	assert.NoError(t, err)
+	err = balancer2.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "balancer2", up)
+	})
+	assert.NoError(t, err)
+
+	// Set all children of balancer1 to down, should propagate to top.
+	balancer1.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "first", false)
+	balancer1.SetStatus(context.WithValue(t.Context(), serviceName, "top"), "second", false)
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 4 {
+		topBalancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Only balancer2 should receive traffic.
+	assert.Equal(t, 0, recorder.save["first"])
+	assert.Equal(t, 0, recorder.save["second"])
+	assert.Equal(t, 4, recorder.save["third"]+recorder.save["fourth"])
+}
+
+// TestBalancerOneServerFenced tests that fenced servers are excluded from selection.
+func TestBalancerOneServerFenced(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), true) // fenced
+
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 3 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Only first server should receive traffic.
+	assert.Equal(t, 3, recorder.save["first"])
+	assert.Equal(t, 0, recorder.save["second"])
+}
+
+// TestBalancerAllFencedServers tests that all fenced servers result in no available server.
+func TestBalancerAllFencedServers(t *testing.T) {
+	balancer := New(nil, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), pointer(1), true)
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}), pointer(1), true)
+
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	assert.Equal(t, http.StatusServiceUnavailable, recorder.Result().StatusCode)
+}
+
+// TestBalancerRegisterStatusUpdaterWithoutHealthCheck tests error when registering updater without health check.
+func TestBalancerRegisterStatusUpdaterWithoutHealthCheck(t *testing.T) {
+	balancer := New(nil, false)
+
+	err := balancer.RegisterStatusUpdater(func(up bool) {})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "healthCheck not enabled")
+}
+
+// TestBalancerSticky tests sticky session support.
+func TestBalancerSticky(t *testing.T) {
+	balancer := New(&dynamic.Sticky{
+		Cookie: &dynamic.Cookie{
+			Name: "test",
+		},
+	}, false)
+
+	balancer.Add("first", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "first")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("second", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "second")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// First request should set cookie.
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	firstServer := recorder.Header().Get("server")
+	assert.NotEmpty(t, firstServer)
+
+	// Extract cookie from first response.
+	cookies := recorder.Result().Cookies()
+	assert.NotEmpty(t, cookies)
+
+	// Second request with cookie should hit same server.
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	for _, cookie := range cookies {
+		req.AddCookie(cookie)
+	}
+
+	recorder2 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder2, req)
+	secondServer := recorder2.Header().Get("server")
+
+	assert.Equal(t, firstServer, secondServer)
+}
+
+// TestBalancerStickyFallback tests that sticky sessions fallback to least-time when sticky server is down.
+func TestBalancerStickyFallback(t *testing.T) {
+	balancer := New(&dynamic.Sticky{
+		Cookie: &dynamic.Cookie{
+			Name: "test",
+		},
+	}, false)
+
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(50 * time.Millisecond)
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(50 * time.Millisecond)
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// Make initial request to establish sticky session with server1.
+	recorder1 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder1, httptest.NewRequest(http.MethodGet, "/", nil))
+	firstServer := recorder1.Header().Get("server")
+	assert.NotEmpty(t, firstServer)
+
+	// Extract cookie from first response.
+	cookies := recorder1.Result().Cookies()
+	assert.NotEmpty(t, cookies)
+
+	// Mark the sticky server as DOWN
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "test"), firstServer, false)
+
+	// Request with sticky cookie should fallback to the other server
+	req2 := httptest.NewRequest(http.MethodGet, "/", nil)
+	for _, cookie := range cookies {
+		req2.AddCookie(cookie)
+	}
+	recorder2 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder2, req2)
+	fallbackServer := recorder2.Header().Get("server")
+	assert.NotEqual(t, firstServer, fallbackServer)
+	assert.NotEmpty(t, fallbackServer)
+
+	// New sticky cookie should be written for the fallback server
+	newCookies := recorder2.Result().Cookies()
+	assert.NotEmpty(t, newCookies)
+
+	// Verify sticky session persists with the fallback server
+	req3 := httptest.NewRequest(http.MethodGet, "/", nil)
+	for _, cookie := range newCookies {
+		req3.AddCookie(cookie)
+	}
+	recorder3 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder3, req3)
+	assert.Equal(t, fallbackServer, recorder3.Header().Get("server"))
+
+	// Bring original server back UP
+	balancer.SetStatus(context.WithValue(t.Context(), serviceName, "test"), firstServer, true)
+
+	// Request with fallback server cookie should still stick to fallback server
+	req4 := httptest.NewRequest(http.MethodGet, "/", nil)
+	for _, cookie := range newCookies {
+		req4.AddCookie(cookie)
+	}
+	recorder4 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder4, req4)
+	assert.Equal(t, fallbackServer, recorder4.Header().Get("server"))
+}
+
+// TestBalancerStickyFenced tests that sticky sessions persist to fenced servers (graceful shutdown)
+// Fencing enables zero-downtime deployments: fenced servers reject NEW connections
+// but continue serving EXISTING sticky sessions until they complete.
+func TestBalancerStickyFenced(t *testing.T) {
+	balancer := New(&dynamic.Sticky{
+		Cookie: &dynamic.Cookie{
+			Name: "test",
+		},
+	}, false)
+
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// Establish sticky session with any server.
+	recorder1 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder1, httptest.NewRequest(http.MethodGet, "/", nil))
+	stickyServer := recorder1.Header().Get("server")
+	assert.NotEmpty(t, stickyServer)
+
+	cookies := recorder1.Result().Cookies()
+	assert.NotEmpty(t, cookies)
+
+	// Fence the sticky server (simulate graceful shutdown).
+	balancer.handlersMu.Lock()
+	balancer.fenced[stickyServer] = struct{}{}
+	balancer.handlersMu.Unlock()
+
+	// Existing sticky session should STILL work (graceful draining).
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	for _, cookie := range cookies {
+		req.AddCookie(cookie)
+	}
+	recorder2 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder2, req)
+	assert.Equal(t, stickyServer, recorder2.Header().Get("server"))
+
+	// But NEW requests should NOT go to the fenced server.
+	recorder3 := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder3, httptest.NewRequest(http.MethodGet, "/", nil))
+	newServer := recorder3.Header().Get("server")
+	assert.NotEqual(t, stickyServer, newServer)
+	assert.NotEmpty(t, newServer)
+}
+
+// TestRingBufferBasic tests basic ring buffer functionality with few samples.
+func TestRingBufferBasic(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}),
+		name:    "test",
+		weight:  1,
+	}
+
+	// Test cold start - no samples.
+	avg := handler.getAvgResponseTime()
+	assert.InDelta(t, 0.0, avg, 0)
+
+	// Add one sample.
+	handler.updateResponseTime(10 * time.Millisecond)
+	avg = handler.getAvgResponseTime()
+	assert.InDelta(t, 10.0, avg, 0)
+
+	// Add more samples.
+	handler.updateResponseTime(20 * time.Millisecond)
+	handler.updateResponseTime(30 * time.Millisecond)
+	avg = handler.getAvgResponseTime()
+	assert.InDelta(t, 20.0, avg, 0) // (10 + 20 + 30) / 3 = 20
+}
+
+// TestRingBufferWraparound tests ring buffer behavior when it wraps around
+func TestRingBufferWraparound(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}),
+		name:    "test",
+		weight:  1,
+	}
+
+	// Fill the buffer with 100 samples of 10ms each.
+	for range sampleSize {
+		handler.updateResponseTime(10 * time.Millisecond)
+	}
+	avg := handler.getAvgResponseTime()
+	assert.InDelta(t, 10.0, avg, 0)
+
+	// Add one more sample (should replace oldest).
+	handler.updateResponseTime(20 * time.Millisecond)
+	avg = handler.getAvgResponseTime()
+	// Sum: 99*10 + 1*20 = 1010, avg = 1010/100 = 10.1
+	assert.InDelta(t, 10.1, avg, 0)
+
+	// Add 10 more samples of 30ms.
+	for range 10 {
+		handler.updateResponseTime(30 * time.Millisecond)
+	}
+	avg = handler.getAvgResponseTime()
+	// Sum: 89*10 + 1*20 + 10*30 = 890 + 20 + 300 = 1210, avg = 1210/100 = 12.1
+	assert.InDelta(t, 12.1, avg, 0)
+}
+
+// TestRingBufferLarge tests ring buffer with many samples (> 100).
+func TestRingBufferLarge(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}),
+		name:    "test",
+		weight:  1,
+	}
+
+	// Add 150 samples.
+	for i := range 150 {
+		handler.updateResponseTime(time.Duration(i+1) * time.Millisecond)
+	}
+
+	// Should only track last 100 samples: 51, 52, ..., 150
+	// Sum = (51 + 150) * 100 / 2 = 10050
+	// Avg = 10050 / 100 = 100.5
+	avg := handler.getAvgResponseTime()
+	assert.InDelta(t, 100.5, avg, 0)
+}
+
+// TestInflightCounter tests inflight request tracking.
+func TestInflightCounter(t *testing.T) {
+	balancer := New(nil, false)
+
+	var inflightAtRequest atomic.Int64
+
+	balancer.Add("test", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		inflightAtRequest.Store(balancer.handlers[0].inflightCount.Load())
+		rw.Header().Set("server", "test")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// Check that inflight count is 0 initially.
+	balancer.handlersMu.RLock()
+	handler := balancer.handlers[0]
+	balancer.handlersMu.RUnlock()
+	assert.Equal(t, int64(0), handler.inflightCount.Load())
+
+	// Make a request.
+	recorder := httptest.NewRecorder()
+	balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	// During request, inflight should have been 1.
+	assert.Equal(t, int64(1), inflightAtRequest.Load())
+
+	// After request completes, inflight should be back to 0.
+	assert.Equal(t, int64(0), handler.inflightCount.Load())
+}
+
+// TestConcurrentResponseTimeUpdates tests thread safety of response time updates.
+func TestConcurrentResponseTimeUpdates(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}),
+		name:    "test",
+		weight:  1,
+	}
+
+	// Concurrently update response times.
+	var wg sync.WaitGroup
+	numGoroutines := 10
+	updatesPerGoroutine := 20
+
+	for i := range numGoroutines {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for range updatesPerGoroutine {
+				handler.updateResponseTime(time.Duration(id+1) * time.Millisecond)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Should have exactly 100 samples (buffer size).
+	assert.Equal(t, sampleSize, handler.sampleCount)
+}
+
+// TestConcurrentInflightTracking tests thread safety of inflight counter.
+func TestConcurrentInflightTracking(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			time.Sleep(10 * time.Millisecond)
+			rw.WriteHeader(http.StatusOK)
+		}),
+		name:   "test",
+		weight: 1,
+	}
+
+	var maxInflight atomic.Int64
+
+	var wg sync.WaitGroup
+	numRequests := 50
+
+	for range numRequests {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			handler.inflightCount.Add(1)
+			defer handler.inflightCount.Add(-1)
+
+			// Track maximum inflight count.
+			current := handler.inflightCount.Load()
+			for {
+				maxLoad := maxInflight.Load()
+				if current <= maxLoad || maxInflight.CompareAndSwap(maxLoad, current) {
+					break
+				}
+			}
+
+			time.Sleep(1 * time.Millisecond)
+		}()
+	}
+
+	wg.Wait()
+
+	// All requests completed, inflight should be 0.
+	assert.Equal(t, int64(0), handler.inflightCount.Load())
+	// Max inflight should be > 1 (concurrent requests).
+	assert.Greater(t, maxInflight.Load(), int64(1))
+}
+
+// TestConcurrentRequestsRespectInflight tests that the load balancer dynamically
+// adapts to inflight request counts during concurrent request processing.
+func TestConcurrentRequestsRespectInflight(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Use a channel to control when handlers start sleeping.
+	// This ensures we can fill one server with inflight requests before routing new ones.
+	blockChan := make(chan struct{})
+
+	// Add two servers with equal response times and weights.
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		<-blockChan // Wait for signal to proceed.
+		time.Sleep(10 * time.Millisecond)
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		<-blockChan // Wait for signal to proceed.
+		time.Sleep(10 * time.Millisecond)
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// Pre-warm both servers to establish equal average response times.
+	for i := range sampleSize {
+		balancer.handlers[0].responseTimes[i] = 10.0
+	}
+	balancer.handlers[0].responseTimeSum = 10.0 * sampleSize
+	balancer.handlers[0].sampleCount = sampleSize
+
+	for i := range sampleSize {
+		balancer.handlers[1].responseTimes[i] = 10.0
+	}
+	balancer.handlers[1].responseTimeSum = 10.0 * sampleSize
+	balancer.handlers[1].sampleCount = sampleSize
+
+	// Phase 1: Launch concurrent requests to server1 that will block.
+	var wg sync.WaitGroup
+	inflightRequests := 5
+
+	for range inflightRequests {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			recorder := httptest.NewRecorder()
+			balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+		}()
+	}
+
+	// Wait for goroutines to start and increment inflight counters.
+	// They will block on the channel, keeping inflight count high.
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify inflight counts before making new requests.
+	server1Inflight := balancer.handlers[0].inflightCount.Load()
+	server2Inflight := balancer.handlers[1].inflightCount.Load()
+	assert.Equal(t, int64(5), server1Inflight+server2Inflight)
+
+	// Phase 2: Make new requests while the initial requests are blocked.
+	// These should see the high inflight counts and route to the less-loaded server.
+	var saveMu sync.Mutex
+	save := map[string]int{}
+	newRequests := 50
+
+	// Launch new requests in background so they don't block.
+	var newWg sync.WaitGroup
+	for range newRequests {
+		newWg.Add(1)
+		go func() {
+			defer newWg.Done()
+			rec := httptest.NewRecorder()
+			balancer.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+			server := rec.Header().Get("server")
+			if server != "" {
+				saveMu.Lock()
+				save[server]++
+				saveMu.Unlock()
+			}
+		}()
+	}
+
+	// Wait for new requests to start and see the inflight counts.
+	time.Sleep(50 * time.Millisecond)
+
+	close(blockChan)
+
+	wg.Wait()
+	newWg.Wait()
+
+	saveMu.Lock()
+	total := save["server1"] + save["server2"]
+	server1Count := save["server1"]
+	server2Count := save["server2"]
+	saveMu.Unlock()
+
+	assert.Equal(t, newRequests, total)
+
+	// With inflight tracking, load should naturally balance toward equal distribution.
+	// We allow variance due to concurrent execution and race windows in server selection.
+	assert.InDelta(t, 25.0, float64(server1Count), 5.0) // 20-30 requests
+	assert.InDelta(t, 25.0, float64(server2Count), 5.0) // 20-30 requests
+}
+
+// TestTTFBMeasurement tests TTFB measurement accuracy.
+func TestTTFBMeasurement(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add server with known delay.
+	delay := 50 * time.Millisecond
+	balancer.Add("slow", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(delay)
+		rw.Header().Set("server", "slow")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// Make multiple requests to build average.
+	for range 5 {
+		recorder := httptest.NewRecorder()
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Check that average response time is approximately the delay.
+	avg := balancer.handlers[0].getAvgResponseTime()
+
+	// Allow 5ms tolerance for Go timing jitter and test environment variations.
+	assert.InDelta(t, float64(delay.Milliseconds()), avg, 5.0)
+}
+
+// TestZeroSamplesReturnsZero tests that getAvgResponseTime returns 0 when no samples.
+func TestZeroSamplesReturnsZero(t *testing.T) {
+	handler := &namedHandler{
+		Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {}),
+		name:    "test",
+		weight:  1,
+	}
+
+	avg := handler.getAvgResponseTime()
+	assert.InDelta(t, 0.0, avg, 0)
+}
+
+// TestScoreCalculationWithWeights tests that weights are properly considered in score calculation.
+func TestScoreCalculationWithWeights(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add two servers with same response time but different weights.
+	// Server with higher weight should be preferred.
+	balancer.Add("weighted", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(50 * time.Millisecond)
+		rw.Header().Set("server", "weighted")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(3), false) // Weight 3
+
+	balancer.Add("normal", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(50 * time.Millisecond)
+		rw.Header().Set("server", "normal")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false) // Weight 1
+
+	// Make requests to build up response time averages.
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 2 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Score for weighted: (50 × (1 + 0)) / 3 = 16.67
+	// Score for normal: (50 × (1 + 0)) / 1 = 50
+	// After warmup, weighted server has 3x better score (16.67 vs 50) and should receive nearly all requests.
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 10 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	assert.Equal(t, 10, recorder.save["weighted"])
+	assert.Zero(t, recorder.save["normal"])
+}
+
+// TestScoreCalculationWithInflight tests that inflight requests are considered in score calculation.
+func TestScoreCalculationWithInflight(t *testing.T) {
+	balancer := New(nil, false)
+
+	// We'll manually control the inflight counters to test the score calculation.
+	// Add two servers with same response time.
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(10 * time.Millisecond)
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(10 * time.Millisecond)
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// Build up response time averages for both servers.
+	for range 2 {
+		recorder := httptest.NewRecorder()
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Now manually set server1 to have high inflight count.
+	balancer.handlers[0].inflightCount.Store(5)
+
+	// Make requests - they should prefer server2 because:
+	// Score for server1: (10 × (1 + 5)) / 1 = 60
+	// Score for server2: (10 × (1 + 0)) / 1 = 10
+	recorder := &responseRecorder{save: map[string]int{}}
+	for range 5 {
+		// Manually increment to simulate the ServeHTTP behavior.
+		server, _ := balancer.nextServer()
+		server.inflightCount.Add(1)
+
+		if server.name == "server1" {
+			recorder.save["server1"]++
+		} else {
+			recorder.save["server2"]++
+		}
+	}
+
+	// Server2 should get all requests
+	assert.Equal(t, 5, recorder.save["server2"])
+	assert.Zero(t, recorder.save["server1"])
+}
+
+// TestScoreCalculationColdStart tests that new servers (0ms avg) get fair selection
+func TestScoreCalculationColdStart(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add a warm server with established response time
+	balancer.Add("warm", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(50 * time.Millisecond)
+		rw.Header().Set("server", "warm")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// Warm up the first server
+	for range 10 {
+		recorder := httptest.NewRecorder()
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Now add a cold server (new, no response time data)
+	balancer.Add("cold", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(10 * time.Millisecond) // Actually faster
+		rw.Header().Set("server", "cold")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// Cold server should get selected because:
+	// Score for warm: (50 × (1 + 0)) / 1 = 50
+	// Score for cold: (0 × (1 + 0)) / 1 = 0
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 20 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// Cold server should get all or most requests initially due to 0ms average
+	assert.Greater(t, recorder.save["cold"], 10)
+
+	// After cold server builds up its average, it should continue to get more traffic
+	// because it's actually faster (10ms vs 50ms)
+	recorder = &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 20 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+	assert.Greater(t, recorder.save["cold"], recorder.save["warm"])
+}
+
+// TestFastServerGetsMoreTraffic verifies that servers with lower response times
+// receive proportionally more traffic in steady state (after cold start).
+// This tests the core selection bias of the least-time algorithm.
+func TestFastServerGetsMoreTraffic(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add two servers with different static response times.
+	balancer.Add("fast", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(20 * time.Millisecond)
+		rw.Header().Set("server", "fast")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	balancer.Add("slow", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(100 * time.Millisecond)
+		rw.Header().Set("server", "slow")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// After just 1 request to each server, the algorithm identifies the fastest server
+	// and routes nearly all subsequent traffic there (converges in ~2 requests).
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 50 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	assert.Greater(t, recorder.save["fast"], recorder.save["slow"])
+	assert.Greater(t, recorder.save["fast"], 48) // Expect ~96-98% to fast server (48-49/50).
+}
+
+// TestTrafficShiftsWhenPerformanceDegrades verifies that the load balancer
+// adapts to changing server performance by shifting traffic away from degraded servers.
+// This tests the adaptive behavior - the core value proposition of least-time load balancing.
+func TestTrafficShiftsWhenPerformanceDegrades(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Use atomic to dynamically control server1's response time.
+	server1Delay := atomic.Int64{}
+	server1Delay.Store(5) // Start with 5ms
+
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(time.Duration(server1Delay.Load()) * time.Millisecond)
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond) // Static 5ms
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+		httptrace.ContextClientTrace(req.Context()).GotFirstResponseByte()
+	}), pointer(1), false)
+
+	// Pre-fill ring buffers to eliminate cold start effects and ensure deterministic equal performance state.
+	for _, h := range balancer.handlers {
+		for i := range sampleSize {
+			h.responseTimes[i] = 5.0
+		}
+		h.responseTimeSum = 5.0 * sampleSize
+		h.sampleCount = sampleSize
+	}
+
+	// Phase 1: Both servers perform equally (5ms each).
+	recorder := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 50 {
+		balancer.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// With equal performance and pre-filled buffers, distribution should be balanced via WRR tie-breaking.
+	total := recorder.save["server1"] + recorder.save["server2"]
+	assert.Equal(t, 50, total)
+	assert.InDelta(t, 25, recorder.save["server1"], 10) // 25 ± 10 requests
+	assert.InDelta(t, 25, recorder.save["server2"], 10) // 25 ± 10 requests
+
+	// Phase 2: server1 degrades (simulating GC pause, CPU spike, or network latency).
+	server1Delay.Store(50) // Now 50ms (10x slower) - dramatic degradation for reliable detection
+
+	// Make more requests to shift the moving average.
+	// Ring buffer has 100 samples, need significant new samples to shift average.
+	// server1's average will climb from ~5ms toward 50ms.
+	recorder2 := &responseRecorder{ResponseRecorder: httptest.NewRecorder(), save: map[string]int{}}
+	for range 60 {
+		balancer.ServeHTTP(recorder2, httptest.NewRequest(http.MethodGet, "/", nil))
+	}
+
+	// server2 should get significantly more traffic
+	// With 10x performance difference, server2 should dominate.
+	total2 := recorder2.save["server1"] + recorder2.save["server2"]
+	assert.Equal(t, 60, total2)
+	assert.Greater(t, recorder2.save["server2"], 35) // At least ~60% (35/60)
+	assert.Less(t, recorder2.save["server1"], 25)    // At most ~40% (25/60)
+}
+
+// TestMultipleServersWithSameScore tests WRR tie-breaking when multiple servers have identical scores.
+// Uses nextServer() directly to avoid timing variations in the test.
+func TestMultipleServersWithSameScore(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add three servers with identical response times and weights.
+	balancer.Add("server1", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "server1")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("server2", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "server2")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	balancer.Add("server3", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "server3")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false)
+
+	// Set all servers to identical response times to trigger tie-breaking.
+	for _, h := range balancer.handlers {
+		for i := range sampleSize {
+			h.responseTimes[i] = 5.0
+		}
+		h.responseTimeSum = 5.0 * sampleSize
+		h.sampleCount = sampleSize
+	}
+
+	// With all servers having identical scores, WRR tie-breaking should distribute fairly.
+	// Test the selection logic directly without actual HTTP requests to avoid timing variations.
+	counts := map[string]int{"server1": 0, "server2": 0, "server3": 0}
+	for range 90 {
+		server, err := balancer.nextServer()
+		assert.NoError(t, err)
+		counts[server.name]++
+	}
+
+	total := counts["server1"] + counts["server2"] + counts["server3"]
+	assert.Equal(t, 90, total)
+
+	// With WRR and 90 requests, each server should get ~30 requests (±1 due to initialization).
+	assert.InDelta(t, 30, counts["server1"], 1)
+	assert.InDelta(t, 30, counts["server2"], 1)
+	assert.InDelta(t, 30, counts["server3"], 1)
+}
+
+// TestWRRTieBreakingWeightedDistribution tests weighted distribution among tied servers.
+// Uses nextServer() directly to avoid timing variations in the test.
+func TestWRRTieBreakingWeightedDistribution(t *testing.T) {
+	balancer := New(nil, false)
+
+	// Add two servers with different weights.
+	// To create equal scores, response times must be proportional to weights.
+	balancer.Add("weighted", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(15 * time.Millisecond) // 3x longer due to 3x weight
+		rw.Header().Set("server", "weighted")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(3), false) // Weight 3
+
+	balancer.Add("normal", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		time.Sleep(5 * time.Millisecond)
+		rw.Header().Set("server", "normal")
+		rw.WriteHeader(http.StatusOK)
+	}), pointer(1), false) // Weight 1
+
+	// Since response times is proportional to weights, both scores are equal, so WRR tie-breaking will apply.
+	// weighted: score = (15 * 1) / 3 = 5
+	// normal: score = (5 * 1) / 1 = 5
+	for i := range sampleSize {
+		balancer.handlers[0].responseTimes[i] = 15.0
+	}
+	balancer.handlers[0].responseTimeSum = 15.0 * sampleSize
+	balancer.handlers[0].sampleCount = sampleSize
+
+	for i := range sampleSize {
+		balancer.handlers[1].responseTimes[i] = 5.0
+	}
+	balancer.handlers[1].responseTimeSum = 5.0 * sampleSize
+	balancer.handlers[1].sampleCount = sampleSize
+
+	// Test the selection logic directly without actual HTTP requests to avoid timing variations.
+	counts := map[string]int{"weighted": 0, "normal": 0}
+	for range 80 {
+		server, err := balancer.nextServer()
+		assert.NoError(t, err)
+		counts[server.name]++
+	}
+
+	total := counts["weighted"] + counts["normal"]
+	assert.Equal(t, 80, total)
+
+	// With 3:1 weight ratio, distribution should be ~75%/25% (60/80 and 20/80), ±1 due to initialization.
+	assert.InDelta(t, 60, counts["weighted"], 1)
+	assert.InDelta(t, 20, counts["normal"], 1)
+}
diff --git a/pkg/server/service/loadbalancer/p2c/p2c.go b/pkg/server/service/loadbalancer/p2c/p2c.go
index 3bf06a512..948a7d5a1 100644
--- a/pkg/server/service/loadbalancer/p2c/p2c.go
+++ b/pkg/server/service/loadbalancer/p2c/p2c.go
@@ -14,6 +14,8 @@ import (
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer"
 )
 
+var errNoAvailableServer = errors.New("no available server")
+
 type namedHandler struct {
 	http.Handler
 
@@ -56,6 +58,7 @@ type Balancer struct {
 
 	// updaters is the list of hooks that are run (to update the Balancer
 	// parent(s)), whenever the Balancer status changes.
+	// No mutex is needed, as it is modified only during the configuration build.
 	updaters []func(bool)
 
 	sticky *loadbalancer.Sticky
@@ -80,7 +83,7 @@ func New(stickyConfig *dynamic.Sticky, wantsHealthCheck bool) *Balancer {
 }
 
 // SetStatus sets on the balancer that its given child is now of the given
-// status. balancerName is only needed for logging purposes.
+// status. childName is only needed for logging purposes.
 func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
 	b.handlersMu.Lock()
 	defer b.handlersMu.Unlock()
@@ -125,14 +128,12 @@ func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
 // Not thread safe.
 func (b *Balancer) RegisterStatusUpdater(fn func(up bool)) error {
 	if !b.wantsHealthCheck {
-		return errors.New("healthCheck not enabled in config for this weighted service")
+		return errors.New("healthCheck not enabled in config for this P2C service")
 	}
 	b.updaters = append(b.updaters, fn)
 	return nil
 }
 
-var errNoAvailableServer = errors.New("no available server")
-
 func (b *Balancer) nextServer() (*namedHandler, error) {
 	// We kept the same representation (map) as in the WRR strategy to improve maintainability.
 	// However, with the P2C strategy, we only need a slice of healthy servers.
diff --git a/pkg/server/service/loadbalancer/wrr/wrr.go b/pkg/server/service/loadbalancer/wrr/wrr.go
index 2c9bff0ee..69bc2c498 100644
--- a/pkg/server/service/loadbalancer/wrr/wrr.go
+++ b/pkg/server/service/loadbalancer/wrr/wrr.go
@@ -12,6 +12,8 @@ import (
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer"
 )
 
+var errNoAvailableServer = errors.New("no available server")
+
 type namedHandler struct {
 	http.Handler
 	name     string
@@ -40,6 +42,7 @@ type Balancer struct {
 
 	// updaters is the list of hooks that are run (to update the Balancer
 	// parent(s)), whenever the Balancer status changes.
+	// No mutex is needed, as it is modified only during the configuration build.
 	updaters []func(bool)
 
 	sticky *loadbalancer.Sticky
@@ -93,7 +96,7 @@ func (b *Balancer) Pop() interface{} {
 }
 
 // SetStatus sets on the balancer that its given child is now of the given
-// status. balancerName is only needed for logging purposes.
+// status. childName is only needed for logging purposes.
 func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
 	b.handlersMu.Lock()
 	defer b.handlersMu.Unlock()
@@ -138,14 +141,12 @@ func (b *Balancer) SetStatus(ctx context.Context, childName string, up bool) {
 // Not thread safe.
 func (b *Balancer) RegisterStatusUpdater(fn func(up bool)) error {
 	if !b.wantsHealthCheck {
-		return errors.New("healthCheck not enabled in config for this weighted service")
+		return errors.New("healthCheck not enabled in config for this WRR service")
 	}
 	b.updaters = append(b.updaters, fn)
 	return nil
 }
 
-var errNoAvailableServer = errors.New("no available server")
-
 func (b *Balancer) nextServer() (*namedHandler, error) {
 	b.handlersMu.Lock()
 	defer b.handlersMu.Unlock()
diff --git a/pkg/server/service/service.go b/pkg/server/service/service.go
index a8e00cd1d..e61820f3d 100644
--- a/pkg/server/service/service.go
+++ b/pkg/server/service/service.go
@@ -28,6 +28,8 @@ import (
 	"github.com/traefik/traefik/v3/pkg/server/middleware"
 	"github.com/traefik/traefik/v3/pkg/server/provider"
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/failover"
+	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/hrw"
+	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/leasttime"
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/mirror"
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/p2c"
 	"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr"
@@ -137,6 +139,13 @@ func (m *Manager) BuildHTTP(rootCtx context.Context, serviceName string) (http.H
 			conf.AddError(err, true)
 			return nil, err
 		}
+	case conf.HighestRandomWeight != nil:
+		var err error
+		lb, err = m.getHRWServiceHandler(ctx, serviceName, conf.HighestRandomWeight)
+		if err != nil {
+			conf.AddError(err, true)
+			return nil, err
+		}
 	case conf.Mirroring != nil:
 		var err error
 		lb, err = m.getMirrorServiceHandler(ctx, conf.Mirroring)
@@ -258,19 +267,18 @@ func (m *Manager) getWRRServiceHandler(ctx context.Context, serviceName string,
 			continue
 		}
 
-		childName := service.Name
 		updater, ok := serviceHandler.(healthcheck.StatusUpdater)
 		if !ok {
-			return nil, fmt.Errorf("child service %v of %v not a healthcheck.StatusUpdater (%T)", childName, serviceName, serviceHandler)
+			return nil, fmt.Errorf("child service %v of %v not a healthcheck.StatusUpdater (%T)", service.Name, serviceName, serviceHandler)
 		}
 
 		if err := updater.RegisterStatusUpdater(func(up bool) {
-			balancer.SetStatus(ctx, childName, up)
+			balancer.SetStatus(ctx, service.Name, up)
 		}); err != nil {
-			return nil, fmt.Errorf("cannot register %v as updater for %v: %w", childName, serviceName, err)
+			return nil, fmt.Errorf("cannot register %v as updater for %v: %w", service.Name, serviceName, err)
 		}
 
-		log.Ctx(ctx).Debug().Str("parent", serviceName).Str("child", childName).
+		log.Ctx(ctx).Debug().Str("parent", serviceName).Str("child", service.Name).
 			Msg("Child service will update parent on status change")
 	}
 
@@ -278,13 +286,13 @@ func (m *Manager) getWRRServiceHandler(ctx context.Context, serviceName string,
 }
 
 func (m *Manager) getServiceHandler(ctx context.Context, service dynamic.WRRService) (http.Handler, error) {
-	switch {
-	case service.Status != nil:
+	if service.Status != nil {
 		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			rw.WriteHeader(*service.Status)
 		}), nil
+	}
 
-	case service.GRPCStatus != nil:
+	if service.GRPCStatus != nil {
 		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			st := status.New(service.GRPCStatus.Code, service.GRPCStatus.Msg)
 
@@ -299,10 +307,57 @@ func (m *Manager) getServiceHandler(ctx context.Context, service dynamic.WRRServ
 
 			_, _ = rw.Write(body)
 		}), nil
-
-	default:
-		return m.BuildHTTP(ctx, service.Name)
 	}
+
+	svcHandler, err := m.BuildHTTP(ctx, service.Name)
+	if err != nil {
+		return nil, fmt.Errorf("building HTTP service: %w", err)
+	}
+
+	if service.Headers != nil {
+		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			for k, v := range service.Headers {
+				req.Header.Set(k, v)
+			}
+
+			svcHandler.ServeHTTP(rw, req)
+		}), nil
+	}
+
+	return svcHandler, nil
+}
+
+func (m *Manager) getHRWServiceHandler(ctx context.Context, serviceName string, config *dynamic.HighestRandomWeight) (http.Handler, error) {
+	// TODO Handle accesslog and metrics with multiple service name
+	balancer := hrw.New(config.HealthCheck != nil)
+	for _, service := range shuffle(config.Services, m.rand) {
+		serviceHandler, err := m.BuildHTTP(ctx, service.Name)
+		if err != nil {
+			return nil, err
+		}
+
+		balancer.Add(service.Name, serviceHandler, service.Weight, false)
+
+		if config.HealthCheck == nil {
+			continue
+		}
+
+		updater, ok := serviceHandler.(healthcheck.StatusUpdater)
+		if !ok {
+			return nil, fmt.Errorf("child service %v of %v not a healthcheck.StatusUpdater (%T)", service.Name, serviceName, serviceHandler)
+		}
+
+		if err := updater.RegisterStatusUpdater(func(up bool) {
+			balancer.SetStatus(ctx, service.Name, up)
+		}); err != nil {
+			return nil, fmt.Errorf("cannot register %v as updater for %v: %w", service.Name, serviceName, err)
+		}
+
+		log.Ctx(ctx).Debug().Str("parent", serviceName).Str("child", service.Name).
+			Msg("Child service will update parent on status change")
+	}
+
+	return balancer, nil
 }
 
 type serverBalancer interface {
@@ -341,15 +396,30 @@ func (m *Manager) getLoadBalancerServiceHandler(ctx context.Context, serviceName
 	var lb serverBalancer
 	switch service.Strategy {
 	// Here we are handling the empty value to comply with providers that are not applying defaults (e.g. REST provider)
-	// TODO: remove this when all providers apply default values.
+	// TODO: remove this empty check when all providers apply default values.
 	case dynamic.BalancerStrategyWRR, "":
 		lb = wrr.New(service.Sticky, service.HealthCheck != nil)
 	case dynamic.BalancerStrategyP2C:
 		lb = p2c.New(service.Sticky, service.HealthCheck != nil)
+	case dynamic.BalancerStrategyHRW:
+		lb = hrw.New(service.HealthCheck != nil)
+	case dynamic.BalancerStrategyLeastTime:
+		lb = leasttime.New(service.Sticky, service.HealthCheck != nil)
 	default:
 		return nil, fmt.Errorf("unsupported load-balancer strategy %q", service.Strategy)
 	}
 
+	var passiveHealthChecker *healthcheck.PassiveServiceHealthChecker
+	if service.PassiveHealthCheck != nil {
+		passiveHealthChecker = healthcheck.NewPassiveHealthChecker(
+			serviceName,
+			lb,
+			service.PassiveHealthCheck.MaxFailedAttempts,
+			service.PassiveHealthCheck.FailureWindow,
+			service.HealthCheck != nil,
+			m.observabilityMgr.MetricsRegistry())
+	}
+
 	healthCheckTargets := make(map[string]*url.URL)
 
 	for i, server := range shuffle(service.Servers, m.rand) {
@@ -368,6 +438,11 @@ func (m *Manager) getLoadBalancerServiceHandler(ctx context.Context, serviceName
 			return nil, fmt.Errorf("error building proxy for server URL %s: %w", server.URL, err)
 		}
 
+		if passiveHealthChecker != nil {
+			// If passive health check is enabled, we wrap the proxy with the passive health checker.
+			proxy = passiveHealthChecker.WrapHandler(ctx, proxy, target.String())
+		}
+
 		// The retry wrapping must be done just before the proxy handler,
 		// to make sure that the retry will not be triggered/disabled by
 		// middlewares in the chain.
@@ -392,7 +467,7 @@ func (m *Manager) getLoadBalancerServiceHandler(ctx context.Context, serviceName
 
 		lb.AddServer(server.URL, proxy, server)
 
-		// servers are considered UP by default.
+		// Servers are considered UP by default.
 		info.UpdateServerStatus(target.String(), runtime.StatusUp)
 
 		healthCheckTargets[server.URL] = target
diff --git a/pkg/server/service/service_test.go b/pkg/server/service/service_test.go
index 7d00a69fb..574dd1a5b 100644
--- a/pkg/server/service/service_test.go
+++ b/pkg/server/service/service_test.go
@@ -10,9 +10,11 @@ import (
 	"net/textproto"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	ptypes "github.com/traefik/paerser/types"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
 	"github.com/traefik/traefik/v3/pkg/config/runtime"
 	"github.com/traefik/traefik/v3/pkg/proxy/httputil"
@@ -67,6 +69,33 @@ func TestGetLoadBalancer(t *testing.T) {
 			fwd:         &forwarderMock{},
 			expectError: false,
 		},
+		{
+			desc:        "Succeeds when passive health checker is set",
+			serviceName: "test",
+			service: &dynamic.ServersLoadBalancer{
+				Strategy: dynamic.BalancerStrategyWRR,
+				PassiveHealthCheck: &dynamic.PassiveServerHealthCheck{
+					FailureWindow:     ptypes.Duration(30 * time.Second),
+					MaxFailedAttempts: 3,
+				},
+			},
+			fwd:         &forwarderMock{},
+			expectError: false,
+		},
+		{
+			desc:        "Fails when unsupported strategy is set",
+			serviceName: "test",
+			service: &dynamic.ServersLoadBalancer{
+				Strategy: "invalid",
+				Servers: []dynamic.Server{
+					{
+						URL: "http://localhost:8080",
+					},
+				},
+			},
+			fwd:         &forwarderMock{},
+			expectError: true,
+		},
 	}
 
 	for _, test := range testCases {
@@ -145,7 +174,7 @@ func TestGetLoadBalancerServiceHandler(t *testing.T) {
 			serviceName: "test",
 			service: &dynamic.ServersLoadBalancer{
 				Strategy:       dynamic.BalancerStrategyWRR,
-				PassHostHeader: boolPtr(true),
+				PassHostHeader: pointer(true),
 				Servers: []dynamic.Server{
 					{
 						URL: server1.URL,
@@ -464,16 +493,6 @@ func Test1xxResponses(t *testing.T) {
 	}
 }
 
-type serviceBuilderFunc func(ctx context.Context, serviceName string) (http.Handler, error)
-
-func (s serviceBuilderFunc) BuildHTTP(ctx context.Context, serviceName string) (http.Handler, error) {
-	return s(ctx, serviceName)
-}
-
-type internalHandler struct{}
-
-func (internalHandler) ServeHTTP(_ http.ResponseWriter, _ *http.Request) {}
-
 func TestManager_ServiceBuilders(t *testing.T) {
 	var internalHandler internalHandler
 
@@ -590,7 +609,129 @@ func TestMultipleTypeOnBuildHTTP(t *testing.T) {
 	assert.Error(t, err, "cannot create service: multi-types service not supported, consider declaring two different pieces of service instead")
 }
 
-func boolPtr(v bool) *bool { return &v }
+func TestGetServiceHandler_Headers(t *testing.T) {
+	pb := httputil.NewProxyBuilder(&transportManagerMock{}, nil)
+
+	testCases := []struct {
+		desc            string
+		service         dynamic.WRRService
+		userAgent       string
+		expectedHeaders map[string]string
+	}{
+		{
+			desc: "Service with custom headers",
+			service: dynamic.WRRService{
+				Name: "target-service",
+				Headers: map[string]string{
+					"X-Custom-Header": "custom-value",
+					"X-Service-Type":  "knative-service",
+					"Authorization":   "bearer token123",
+				},
+			},
+			userAgent: "test-agent",
+			expectedHeaders: map[string]string{
+				"X-Custom-Header": "custom-value",
+				"X-Service-Type":  "knative-service",
+				"Authorization":   "bearer token123",
+			},
+		},
+		{
+			desc: "Service with empty headers map",
+			service: dynamic.WRRService{
+				Name:    "target-service",
+				Headers: map[string]string{},
+			},
+			userAgent:       "test-agent",
+			expectedHeaders: map[string]string{},
+		},
+		{
+			desc: "Service with nil headers",
+			service: dynamic.WRRService{
+				Name:    "target-service",
+				Headers: nil,
+			},
+			userAgent:       "test-agent",
+			expectedHeaders: map[string]string{},
+		},
+		{
+			desc: "Service with headers that override existing request headers",
+			service: dynamic.WRRService{
+				Name: "target-service",
+				Headers: map[string]string{
+					"User-Agent": "overridden-agent",
+					"Accept":     "application/json",
+				},
+			},
+			userAgent: "original-agent",
+			expectedHeaders: map[string]string{
+				"User-Agent": "overridden-agent",
+				"Accept":     "application/json",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			// Create a test server that will verify the headers are properly set for this specific test case
+			testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				// Verify expected headers are present
+				for key, expectedValue := range test.expectedHeaders {
+					actualValue := r.Header.Get(key)
+					assert.Equal(t, expectedValue, actualValue, "Header %s should be %s", key, expectedValue)
+				}
+
+				w.Header().Set("X-Response", "success")
+				w.WriteHeader(http.StatusOK)
+			}))
+			t.Cleanup(testServer.Close)
+
+			// Create the target service that the WRRService will point to
+			targetServiceInfo := &runtime.ServiceInfo{
+				Service: &dynamic.Service{
+					LoadBalancer: &dynamic.ServersLoadBalancer{
+						Strategy: dynamic.BalancerStrategyWRR,
+						Servers: []dynamic.Server{
+							{URL: testServer.URL},
+						},
+					},
+				},
+			}
+
+			// Create a fresh manager for each test case
+			sm := NewManager(map[string]*runtime.ServiceInfo{
+				"target-service": targetServiceInfo,
+			}, nil, nil, &transportManagerMock{}, pb)
+
+			// Get the service handler
+			handler, err := sm.getServiceHandler(t.Context(), test.service)
+			require.NoError(t, err)
+			require.NotNil(t, handler)
+
+			// Create a test request
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://test.example.com/path", nil)
+			if test.userAgent != "" {
+				req.Header.Set("User-Agent", test.userAgent)
+			}
+
+			// Execute the request
+			recorder := httptest.NewRecorder()
+			handler.ServeHTTP(recorder, req)
+
+			// Verify the response was successful
+			assert.Equal(t, http.StatusOK, recorder.Code)
+		})
+	}
+}
+
+type serviceBuilderFunc func(ctx context.Context, serviceName string) (http.Handler, error)
+
+func (s serviceBuilderFunc) BuildHTTP(ctx context.Context, serviceName string) (http.Handler, error) {
+	return s(ctx, serviceName)
+}
+
+type internalHandler struct{}
+
+func (internalHandler) ServeHTTP(_ http.ResponseWriter, _ *http.Request) {}
 
 type forwarderMock struct{}
 
diff --git a/pkg/server/service/tcp/service.go b/pkg/server/service/tcp/service.go
index 9ff454fad..7928eb3b5 100644
--- a/pkg/server/service/tcp/service.go
+++ b/pkg/server/service/tcp/service.go
@@ -4,12 +4,15 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"maps"
 	"math/rand"
 	"net"
+	"slices"
 	"time"
 
 	"github.com/rs/zerolog/log"
 	"github.com/traefik/traefik/v3/pkg/config/runtime"
+	"github.com/traefik/traefik/v3/pkg/healthcheck"
 	"github.com/traefik/traefik/v3/pkg/observability/logs"
 	"github.com/traefik/traefik/v3/pkg/server/provider"
 	"github.com/traefik/traefik/v3/pkg/tcp"
@@ -17,17 +20,19 @@ import (
 
 // Manager is the TCPHandlers factory.
 type Manager struct {
-	dialerManager *tcp.DialerManager
-	configs       map[string]*runtime.TCPServiceInfo
-	rand          *rand.Rand // For the initial shuffling of load-balancers.
+	dialerManager  *tcp.DialerManager
+	configs        map[string]*runtime.TCPServiceInfo
+	rand           *rand.Rand // For the initial shuffling of load-balancers.
+	healthCheckers map[string]*healthcheck.ServiceTCPHealthChecker
 }
 
 // NewManager creates a new manager.
 func NewManager(conf *runtime.Configuration, dialerManager *tcp.DialerManager) *Manager {
 	return &Manager{
-		dialerManager: dialerManager,
-		configs:       conf.TCPServices,
-		rand:          rand.New(rand.NewSource(time.Now().UnixNano())),
+		dialerManager:  dialerManager,
+		healthCheckers: make(map[string]*healthcheck.ServiceTCPHealthChecker),
+		configs:        conf.TCPServices,
+		rand:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
 
@@ -51,7 +56,7 @@ func (m *Manager) BuildTCP(rootCtx context.Context, serviceName string) (tcp.Han
 
 	switch {
 	case conf.LoadBalancer != nil:
-		loadBalancer := tcp.NewWRRLoadBalancer()
+		loadBalancer := tcp.NewWRRLoadBalancer(conf.LoadBalancer.HealthCheck != nil)
 
 		if conf.LoadBalancer.TerminationDelay != nil {
 			log.Ctx(ctx).Warn().Msgf("Service %q load balancer uses `TerminationDelay`, but this option is deprecated, please use ServersTransport configuration instead.", serviceName)
@@ -65,6 +70,8 @@ func (m *Manager) BuildTCP(rootCtx context.Context, serviceName string) (tcp.Han
 			conf.LoadBalancer.ServersTransport = provider.GetQualifiedName(ctx, conf.LoadBalancer.ServersTransport)
 		}
 
+		uniqHealthCheckTargets := make(map[string]healthcheck.TCPHealthCheckTarget, len(conf.LoadBalancer.Servers))
+
 		for index, server := range shuffle(conf.LoadBalancer.Servers, m.rand) {
 			srvLogger := logger.With().
 				Int(logs.ServerIndex, index).
@@ -86,14 +93,34 @@ func (m *Manager) BuildTCP(rootCtx context.Context, serviceName string) (tcp.Han
 				continue
 			}
 
-			loadBalancer.AddServer(handler)
+			loadBalancer.Add(server.Address, handler, nil)
+
+			// Servers are considered UP by default.
+			conf.UpdateServerStatus(server.Address, runtime.StatusUp)
+
+			uniqHealthCheckTargets[server.Address] = healthcheck.TCPHealthCheckTarget{
+				Address: server.Address,
+				TLS:     server.TLS,
+				Dialer:  dialer,
+			}
+
 			logger.Debug().Msg("Creating TCP server")
 		}
 
+		if conf.LoadBalancer.HealthCheck != nil {
+			m.healthCheckers[serviceName] = healthcheck.NewServiceTCPHealthChecker(
+				ctx,
+				conf.LoadBalancer.HealthCheck,
+				loadBalancer,
+				conf,
+				slices.Collect(maps.Values(uniqHealthCheckTargets)),
+				serviceQualifiedName)
+		}
+
 		return loadBalancer, nil
 
 	case conf.Weighted != nil:
-		loadBalancer := tcp.NewWRRLoadBalancer()
+		loadBalancer := tcp.NewWRRLoadBalancer(conf.Weighted.HealthCheck != nil)
 
 		for _, service := range shuffle(conf.Weighted.Services, m.rand) {
 			handler, err := m.BuildTCP(ctx, service.Name)
@@ -102,7 +129,25 @@ func (m *Manager) BuildTCP(rootCtx context.Context, serviceName string) (tcp.Han
 				return nil, err
 			}
 
-			loadBalancer.AddWeightServer(handler, service.Weight)
+			loadBalancer.Add(service.Name, handler, service.Weight)
+
+			if conf.Weighted.HealthCheck == nil {
+				continue
+			}
+
+			updater, ok := handler.(healthcheck.StatusUpdater)
+			if !ok {
+				return nil, fmt.Errorf("child service %v of %v not a healthcheck.StatusUpdater (%T)", service.Name, serviceName, handler)
+			}
+
+			if err := updater.RegisterStatusUpdater(func(up bool) {
+				loadBalancer.SetStatus(ctx, service.Name, up)
+			}); err != nil {
+				return nil, fmt.Errorf("cannot register %v as updater for %v: %w", service.Name, serviceName, err)
+			}
+
+			log.Ctx(ctx).Debug().Str("parent", serviceName).Str("child", service.Name).
+				Msg("Child service will update parent on status change")
 		}
 
 		return loadBalancer, nil
@@ -114,6 +159,14 @@ func (m *Manager) BuildTCP(rootCtx context.Context, serviceName string) (tcp.Han
 	}
 }
 
+// LaunchHealthCheck launches the health checks.
+func (m *Manager) LaunchHealthCheck(ctx context.Context) {
+	for serviceName, hc := range m.healthCheckers {
+		logger := log.Ctx(ctx).With().Str(logs.ServiceName, serviceName).Logger()
+		go hc.Launch(logger.WithContext(ctx))
+	}
+}
+
 func shuffle[T any](values []T, r *rand.Rand) []T {
 	shuffled := make([]T, len(values))
 	copy(shuffled, values)
diff --git a/pkg/server/service/tcp/service_test.go b/pkg/server/service/tcp/service_test.go
index 8dd0b7393..bcdfe4bd8 100644
--- a/pkg/server/service/tcp/service_test.go
+++ b/pkg/server/service/tcp/service_test.go
@@ -233,6 +233,49 @@ func TestManager_BuildTCP(t *testing.T) {
 			providerName:  "provider-1",
 			expectedError: "no transport configuration found for \"myServersTransport@provider-1\"",
 		},
+		{
+			desc:        "WRR with healthcheck enabled",
+			stConfigs:   map[string]*dynamic.TCPServersTransport{"default@internal": {}},
+			serviceName: "serviceName",
+			configs: map[string]*runtime.TCPServiceInfo{
+				"serviceName@provider-1": {
+					TCPService: &dynamic.TCPService{
+						Weighted: &dynamic.TCPWeightedRoundRobin{
+							Services: []dynamic.TCPWRRService{
+								{Name: "foobar@provider-1", Weight: new(int)},
+								{Name: "foobar2@provider-1", Weight: new(int)},
+							},
+							HealthCheck: &dynamic.HealthCheck{},
+						},
+					},
+				},
+				"foobar@provider-1": {
+					TCPService: &dynamic.TCPService{
+						LoadBalancer: &dynamic.TCPServersLoadBalancer{
+							Servers: []dynamic.TCPServer{
+								{
+									Address: "192.168.0.12:80",
+								},
+							},
+							HealthCheck: &dynamic.TCPServerHealthCheck{},
+						},
+					},
+				},
+				"foobar2@provider-1": {
+					TCPService: &dynamic.TCPService{
+						LoadBalancer: &dynamic.TCPServersLoadBalancer{
+							Servers: []dynamic.TCPServer{
+								{
+									Address: "192.168.0.13:80",
+								},
+							},
+							HealthCheck: &dynamic.TCPServerHealthCheck{},
+						},
+					},
+				},
+			},
+			providerName: "provider-1",
+		},
 	}
 
 	for _, test := range testCases {
diff --git a/pkg/tcp/dialer.go b/pkg/tcp/dialer.go
index bc4855b5b..da9a24569 100644
--- a/pkg/tcp/dialer.go
+++ b/pkg/tcp/dialer.go
@@ -1,6 +1,7 @@
 package tcp
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
@@ -33,6 +34,7 @@ type ClientConn interface {
 // Dialer is an interface to dial a network connection, with support for PROXY protocol and termination delay.
 type Dialer interface {
 	Dial(network, addr string, clientConn ClientConn) (c net.Conn, err error)
+	DialContext(ctx context.Context, network, addr string, clientConn ClientConn) (c net.Conn, err error)
 	TerminationDelay() time.Duration
 }
 
@@ -49,7 +51,12 @@ func (d tcpDialer) TerminationDelay() time.Duration {
 
 // Dial dials a network connection and optionally sends a PROXY protocol header.
 func (d tcpDialer) Dial(network, addr string, clientConn ClientConn) (net.Conn, error) {
-	conn, err := d.dialer.Dial(network, addr)
+	return d.DialContext(context.Background(), network, addr, clientConn)
+}
+
+// DialContext dials a network connection and optionally sends a PROXY protocol header, with context.
+func (d tcpDialer) DialContext(ctx context.Context, network, addr string, clientConn ClientConn) (net.Conn, error) {
+	conn, err := d.dialer.DialContext(ctx, network, addr)
 	if err != nil {
 		return nil, err
 	}
@@ -72,7 +79,12 @@ type tcpTLSDialer struct {
 
 // Dial dials a network connection with the wrapped tcpDialer and performs a TLS handshake.
 func (d tcpTLSDialer) Dial(network, addr string, clientConn ClientConn) (net.Conn, error) {
-	conn, err := d.tcpDialer.Dial(network, addr, clientConn)
+	return d.DialContext(context.Background(), network, addr, clientConn)
+}
+
+// DialContext dials a network connection with the wrapped tcpDialer and performs a TLS handshake, with context.
+func (d tcpTLSDialer) DialContext(ctx context.Context, network, addr string, clientConn ClientConn) (net.Conn, error) {
+	conn, err := d.tcpDialer.DialContext(ctx, network, addr, clientConn)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/tcp/wrr_load_balancer.go b/pkg/tcp/wrr_load_balancer.go
index 93d43a4fb..c836af17d 100644
--- a/pkg/tcp/wrr_load_balancer.go
+++ b/pkg/tcp/wrr_load_balancer.go
@@ -1,6 +1,7 @@
 package tcp
 
 import (
+	"context"
 	"errors"
 	"sync"
 
@@ -11,30 +12,42 @@ var errNoServersInPool = errors.New("no servers in the pool")
 
 type server struct {
 	Handler
+	name   string
 	weight int
 }
 
 // WRRLoadBalancer is a naive RoundRobin load balancer for TCP services.
 type WRRLoadBalancer struct {
-	servers       []server
-	lock          sync.Mutex
-	currentWeight int
-	index         int
+	// serversMu is a mutex to protect the handlers slice and the status.
+	serversMu sync.Mutex
+	servers   []server
+	// status is a record of which child services of the Balancer are healthy, keyed
+	// by name of child service. A service is initially added to the map when it is
+	// created via Add, and it is later removed or added to the map as needed,
+	// through the SetStatus method.
+	status map[string]struct{}
+
+	// updaters is the list of hooks that are run (to update the Balancer parent(s)), whenever the Balancer status changes.
+	// No mutex is needed, as it is modified only during the configuration build.
+	updaters []func(bool)
+
+	index            int
+	currentWeight    int
+	wantsHealthCheck bool
 }
 
 // NewWRRLoadBalancer creates a new WRRLoadBalancer.
-func NewWRRLoadBalancer() *WRRLoadBalancer {
+func NewWRRLoadBalancer(wantsHealthCheck bool) *WRRLoadBalancer {
 	return &WRRLoadBalancer{
-		index: -1,
+		status:           make(map[string]struct{}),
+		index:            -1,
+		wantsHealthCheck: wantsHealthCheck,
 	}
 }
 
 // ServeTCP forwards the connection to the right service.
 func (b *WRRLoadBalancer) ServeTCP(conn WriteCloser) {
-	b.lock.Lock()
-	next, err := b.next()
-	b.lock.Unlock()
-
+	next, err := b.nextServer()
 	if err != nil {
 		if !errors.Is(err, errNoServersInPool) {
 			log.Error().Err(err).Msg("Error during load balancing")
@@ -46,22 +59,103 @@ func (b *WRRLoadBalancer) ServeTCP(conn WriteCloser) {
 	next.ServeTCP(conn)
 }
 
-// AddServer appends a server to the existing list.
-func (b *WRRLoadBalancer) AddServer(serverHandler Handler) {
-	w := 1
-	b.AddWeightServer(serverHandler, &w)
-}
-
-// AddWeightServer appends a server to the existing list with a weight.
-func (b *WRRLoadBalancer) AddWeightServer(serverHandler Handler, weight *int) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
+// Add appends a server to the existing list with a name and weight.
+func (b *WRRLoadBalancer) Add(name string, handler Handler, weight *int) {
 	w := 1
 	if weight != nil {
 		w = *weight
 	}
-	b.servers = append(b.servers, server{Handler: serverHandler, weight: w})
+
+	b.serversMu.Lock()
+	b.servers = append(b.servers, server{Handler: handler, name: name, weight: w})
+	b.status[name] = struct{}{}
+	b.serversMu.Unlock()
+}
+
+// SetStatus sets status (UP or DOWN) of a target server.
+func (b *WRRLoadBalancer) SetStatus(ctx context.Context, childName string, up bool) {
+	b.serversMu.Lock()
+	defer b.serversMu.Unlock()
+
+	upBefore := len(b.status) > 0
+
+	status := "DOWN"
+	if up {
+		status = "UP"
+	}
+
+	log.Ctx(ctx).Debug().Msgf("Setting status of %s to %v", childName, status)
+
+	if up {
+		b.status[childName] = struct{}{}
+	} else {
+		delete(b.status, childName)
+	}
+
+	upAfter := len(b.status) > 0
+	status = "DOWN"
+	if upAfter {
+		status = "UP"
+	}
+
+	// No Status Change
+	if upBefore == upAfter {
+		// We're still with the same status, no need to propagate
+		log.Ctx(ctx).Debug().Msgf("Still %s, no need to propagate", status)
+		return
+	}
+
+	// Status Change
+	log.Ctx(ctx).Debug().Msgf("Propagating new %s status", status)
+	for _, fn := range b.updaters {
+		fn(upAfter)
+	}
+}
+
+func (b *WRRLoadBalancer) RegisterStatusUpdater(fn func(up bool)) error {
+	if !b.wantsHealthCheck {
+		return errors.New("healthCheck not enabled in config for this weighted service")
+	}
+
+	b.updaters = append(b.updaters, fn)
+	return nil
+}
+
+func (b *WRRLoadBalancer) nextServer() (Handler, error) {
+	b.serversMu.Lock()
+	defer b.serversMu.Unlock()
+
+	if len(b.servers) == 0 || len(b.status) == 0 {
+		return nil, errNoServersInPool
+	}
+
+	// The algo below may look messy, but is actually very simple
+	// it calculates the GCD  and subtracts it on every iteration, what interleaves servers
+	// and allows us not to build an iterator every time we readjust weights.
+
+	// Maximum weight across all enabled servers.
+	maximum := b.maxWeight()
+	if maximum == 0 {
+		return nil, errors.New("all servers have 0 weight")
+	}
+
+	// GCD across all enabled servers
+	gcd := b.weightGcd()
+
+	for {
+		b.index = (b.index + 1) % len(b.servers)
+		if b.index == 0 {
+			b.currentWeight -= gcd
+			if b.currentWeight <= 0 {
+				b.currentWeight = maximum
+			}
+		}
+		srv := b.servers[b.index]
+
+		if _, ok := b.status[srv.name]; ok && srv.weight >= b.currentWeight {
+			return srv, nil
+		}
+	}
 }
 
 func (b *WRRLoadBalancer) maxWeight() int {
@@ -92,36 +186,3 @@ func gcd(a, b int) int {
 	}
 	return a
 }
-
-func (b *WRRLoadBalancer) next() (Handler, error) {
-	if len(b.servers) == 0 {
-		return nil, errNoServersInPool
-	}
-
-	// The algo below may look messy, but is actually very simple
-	// it calculates the GCD  and subtracts it on every iteration, what interleaves servers
-	// and allows us not to build an iterator every time we readjust weights
-
-	// Maximum weight across all enabled servers
-	maximum := b.maxWeight()
-	if maximum == 0 {
-		return nil, errors.New("all servers have 0 weight")
-	}
-
-	// GCD across all enabled servers
-	gcd := b.weightGcd()
-
-	for {
-		b.index = (b.index + 1) % len(b.servers)
-		if b.index == 0 {
-			b.currentWeight -= gcd
-			if b.currentWeight <= 0 {
-				b.currentWeight = maximum
-			}
-		}
-		srv := b.servers[b.index]
-		if srv.weight >= b.currentWeight {
-			return srv, nil
-		}
-	}
-}
diff --git a/pkg/tcp/wrr_load_balancer_test.go b/pkg/tcp/wrr_load_balancer_test.go
index fc3438ac6..f51ec4736 100644
--- a/pkg/tcp/wrr_load_balancer_test.go
+++ b/pkg/tcp/wrr_load_balancer_test.go
@@ -9,50 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-type fakeConn struct {
-	writeCall map[string]int
-	closeCall int
-}
-
-func (f *fakeConn) Read(b []byte) (n int, err error) {
-	panic("implement me")
-}
-
-func (f *fakeConn) Write(b []byte) (n int, err error) {
-	f.writeCall[string(b)]++
-	return len(b), nil
-}
-
-func (f *fakeConn) Close() error {
-	f.closeCall++
-	return nil
-}
-
-func (f *fakeConn) LocalAddr() net.Addr {
-	panic("implement me")
-}
-
-func (f *fakeConn) RemoteAddr() net.Addr {
-	panic("implement me")
-}
-
-func (f *fakeConn) SetDeadline(t time.Time) error {
-	panic("implement me")
-}
-
-func (f *fakeConn) SetReadDeadline(t time.Time) error {
-	panic("implement me")
-}
-
-func (f *fakeConn) SetWriteDeadline(t time.Time) error {
-	panic("implement me")
-}
-
-func (f *fakeConn) CloseWrite() error {
-	panic("implement me")
-}
-
-func TestLoadBalancing(t *testing.T) {
+func TestWRRLoadBalancer_LoadBalancing(t *testing.T) {
 	testCases := []struct {
 		desc          string
 		serversWeight map[string]int
@@ -124,9 +81,9 @@ func TestLoadBalancing(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
-			balancer := NewWRRLoadBalancer()
+			balancer := NewWRRLoadBalancer(false)
 			for server, weight := range test.serversWeight {
-				balancer.AddWeightServer(HandlerFunc(func(conn WriteCloser) {
+				balancer.Add(server, HandlerFunc(func(conn WriteCloser) {
 					_, err := conn.Write([]byte(server))
 					require.NoError(t, err)
 				}), &weight)
@@ -142,3 +99,196 @@ func TestLoadBalancing(t *testing.T) {
 		})
 	}
 }
+
+func TestWRRLoadBalancer_NoServiceUp(t *testing.T) {
+	balancer := NewWRRLoadBalancer(false)
+
+	balancer.Add("first", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("first"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.Add("second", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("second"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.SetStatus(t.Context(), "first", false)
+	balancer.SetStatus(t.Context(), "second", false)
+
+	conn := &fakeConn{writeCall: make(map[string]int)}
+	balancer.ServeTCP(conn)
+
+	assert.Empty(t, conn.writeCall)
+	assert.Equal(t, 1, conn.closeCall)
+}
+
+func TestWRRLoadBalancer_OneServerDown(t *testing.T) {
+	balancer := NewWRRLoadBalancer(false)
+
+	balancer.Add("first", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("first"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.Add("second", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("second"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.SetStatus(t.Context(), "second", false)
+
+	conn := &fakeConn{writeCall: make(map[string]int)}
+	for range 3 {
+		balancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 3, conn.writeCall["first"])
+}
+
+func TestWRRLoadBalancer_DownThenUp(t *testing.T) {
+	balancer := NewWRRLoadBalancer(false)
+
+	balancer.Add("first", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("first"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.Add("second", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("second"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer.SetStatus(t.Context(), "second", false)
+
+	conn := &fakeConn{writeCall: make(map[string]int)}
+	for range 3 {
+		balancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 3, conn.writeCall["first"])
+
+	balancer.SetStatus(t.Context(), "second", true)
+
+	conn = &fakeConn{writeCall: make(map[string]int)}
+	for range 2 {
+		balancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 1, conn.writeCall["first"])
+	assert.Equal(t, 1, conn.writeCall["second"])
+}
+
+func TestWRRLoadBalancer_Propagate(t *testing.T) {
+	balancer1 := NewWRRLoadBalancer(true)
+
+	balancer1.Add("first", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("first"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer1.Add("second", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("second"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer2 := NewWRRLoadBalancer(true)
+
+	balancer2.Add("third", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("third"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	balancer2.Add("fourth", HandlerFunc(func(conn WriteCloser) {
+		_, err := conn.Write([]byte("fourth"))
+		require.NoError(t, err)
+	}), pointer(1))
+
+	topBalancer := NewWRRLoadBalancer(true)
+
+	topBalancer.Add("balancer1", balancer1, pointer(1))
+	_ = balancer1.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(t.Context(), "balancer1", up)
+	})
+
+	topBalancer.Add("balancer2", balancer2, pointer(1))
+	_ = balancer2.RegisterStatusUpdater(func(up bool) {
+		topBalancer.SetStatus(t.Context(), "balancer2", up)
+	})
+
+	conn := &fakeConn{writeCall: make(map[string]int)}
+	for range 8 {
+		topBalancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 2, conn.writeCall["first"])
+	assert.Equal(t, 2, conn.writeCall["second"])
+	assert.Equal(t, 2, conn.writeCall["third"])
+	assert.Equal(t, 2, conn.writeCall["fourth"])
+
+	// fourth gets downed, but balancer2 still up since third is still up.
+	balancer2.SetStatus(t.Context(), "fourth", false)
+
+	conn = &fakeConn{writeCall: make(map[string]int)}
+	for range 8 {
+		topBalancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 2, conn.writeCall["first"])
+	assert.Equal(t, 2, conn.writeCall["second"])
+	assert.Equal(t, 4, conn.writeCall["third"])
+	assert.Equal(t, 0, conn.writeCall["fourth"])
+
+	// third gets downed, and the propagation triggers balancer2 to be marked as
+	// down as well for topBalancer.
+	balancer2.SetStatus(t.Context(), "third", false)
+
+	conn = &fakeConn{writeCall: make(map[string]int)}
+	for range 8 {
+		topBalancer.ServeTCP(conn)
+	}
+	assert.Equal(t, 4, conn.writeCall["first"])
+	assert.Equal(t, 4, conn.writeCall["second"])
+	assert.Equal(t, 0, conn.writeCall["third"])
+	assert.Equal(t, 0, conn.writeCall["fourth"])
+}
+
+func pointer[T any](v T) *T { return &v }
+
+type fakeConn struct {
+	writeCall map[string]int
+	closeCall int
+}
+
+func (f *fakeConn) Read(b []byte) (n int, err error) {
+	panic("implement me")
+}
+
+func (f *fakeConn) Write(b []byte) (n int, err error) {
+	f.writeCall[string(b)]++
+	return len(b), nil
+}
+
+func (f *fakeConn) Close() error {
+	f.closeCall++
+	return nil
+}
+
+func (f *fakeConn) LocalAddr() net.Addr {
+	panic("implement me")
+}
+
+func (f *fakeConn) RemoteAddr() net.Addr {
+	panic("implement me")
+}
+
+func (f *fakeConn) SetDeadline(t time.Time) error {
+	panic("implement me")
+}
+
+func (f *fakeConn) SetReadDeadline(t time.Time) error {
+	panic("implement me")
+}
+
+func (f *fakeConn) SetWriteDeadline(t time.Time) error {
+	panic("implement me")
+}
+
+func (f *fakeConn) CloseWrite() error {
+	panic("implement me")
+}
diff --git a/pkg/tls/zz_generated.deepcopy.go b/pkg/tls/zz_generated.deepcopy.go
index a065a73b8..10b4c4ff5 100644
--- a/pkg/tls/zz_generated.deepcopy.go
+++ b/pkg/tls/zz_generated.deepcopy.go
@@ -4,7 +4,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/types/zz_generated.deepcopy.go b/pkg/types/zz_generated.deepcopy.go
index ee095012e..2400d186d 100644
--- a/pkg/types/zz_generated.deepcopy.go
+++ b/pkg/types/zz_generated.deepcopy.go
@@ -4,7 +4,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
+Copyright (c) 2016-2020 Containous SAS; 2020-2026 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pkg/updater/provider.go b/pkg/updater/provider.go
index 26d1fc469..d703bd1a2 100644
--- a/pkg/updater/provider.go
+++ b/pkg/updater/provider.go
@@ -6,7 +6,9 @@ import (
 	"net/http"
 
 	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/api"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/config/runtime"
 	"github.com/traefik/traefik/v3/pkg/config/static"
 	"github.com/traefik/traefik/v3/pkg/safe"
 )
@@ -24,23 +26,23 @@ func New(config *static.Configuration) *Updater {
 }
 
 func (u *Updater) HandleConfigUpdate(cfg dynamic.Configuration) {
-	body, err := json.Marshal(cfg)
+	runtimeConfig := runtime.NewConfig(cfg)
 
-	if err != nil {
-		// should never happen?
+	body := bytes.NewBuffer([]byte{})
+	result := api.GetRunTimeRepresentation(runtimeConfig)
+
+	if err := json.NewEncoder(body).Encode(result); err != nil {
 		log.Error().Err(err).Msg("Error while marshalling dynamic configuration data to json")
 		return
 	}
 
-	requestBody := bytes.NewBuffer(body)
-
 	for _, url := range u.callbackUrls {
 		safe.Go(func() {
-			resp, err := http.Post(url, "application/json", requestBody)
+			resp, err := http.Post(url, "application/json", body)
 
 			if err != nil {
 				log.Error().Err(err).Str("url", url).Msg("Error while sending configuration data to callback")
-			} else  {
+			} else {
 				log.Debug().Str("url", url).Msg("Configuration data sent")
 				resp.Body.Close()
 			}
diff --git a/script/ca-certificates.crt b/script/ca-certificates.crt
deleted file mode 100644
index a4e2acce9..000000000
--- a/script/ca-certificates.crt
+++ /dev/null
@@ -1,3818 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
-AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
-CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
-BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
-VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
-qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
-HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
-G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
-lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
-IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
-0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
-k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
-4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
-m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
-cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
-uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
-KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
-ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
-AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
-VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
-VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
-CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
-cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
-QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
-7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
-cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
-QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
-czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
-aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
-aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
-DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
-BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
-D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
-JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
-AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
-vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
-tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
-7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
-I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
-h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
-d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
-pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFgzCCA2ugAwIBAgIPXZONMGc2yAYdGsdUhGkHMA0GCSqGSIb3DQEBCwUAMDsx
-CzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJ
-WiBGTk1ULVJDTTAeFw0wODEwMjkxNTU5NTZaFw0zMDAxMDEwMDAwMDBaMDsxCzAJ
-BgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBG
-Tk1ULVJDTTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALpxgHpMhm5/
-yBNtwMZ9HACXjywMI7sQmkCpGreHiPibVmr75nuOi5KOpyVdWRHbNi63URcfqQgf
-BBckWKo3Shjf5TnUV/3XwSyRAZHiItQDwFj8d0fsjz50Q7qsNI1NOHZnjrDIbzAz
-WHFctPVrbtQBULgTfmxKo0nRIBnuvMApGGWn3v7v3QqQIecaZ5JCEJhfTzC8PhxF
-tBDXaEAUwED653cXeuYLj2VbPNmaUtu1vZ5Gzz3rkQUCwJaydkxNEJY7kvqcfw+Z
-374jNUUeAlz+taibmSXaXvMiwzn15Cou08YfxGyqxRxqAQVKL9LFwag0Jl1mpdIC
-IfkYtwb1TplvqKtMUejPUBjFd8g5CSxJkjKZqLsXF3mwWsXmo8RZZUc1g16p6DUL
-mbvkzSDGm0oGObVo/CK67lWMK07q87Hj/LaZmtVC+nFNCM+HHmpxffnTtOmlcYF7
-wk5HlqX2doWjKI/pgG6BU6VtX7hI+cL5NqYuSf+4lsKMB7ObiFj86xsc3i1w4peS
-MKGJ47xVqCfWS+2QrYv6YyVZLag13cqXM7zlzced0ezvXg5KkAYmY6252TUtB7p2
-ZSysV4999AeU14ECll2jB0nVetBX+RvnU0Z1qrB5QstocQjpYL05ac70r8NWQMet
-UqIJ5G+GR4of6ygnXYMgrwTJbFaai0b1AgMBAAGjgYMwgYAwDwYDVR0TAQH/BAUw
-AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFPd9xf3E6Jobd2Sn9R2gzL+H
-YJptMD4GA1UdIAQ3MDUwMwYEVR0gADArMCkGCCsGAQUFBwIBFh1odHRwOi8vd3d3
-LmNlcnQuZm5tdC5lcy9kcGNzLzANBgkqhkiG9w0BAQsFAAOCAgEAB5BK3/MjTvDD
-nFFlm5wioooMhfNzKWtN/gHiqQxjAb8EZ6WdmF/9ARP67Jpi6Yb+tmLSbkyU+8B1
-RXxlDPiyN8+sD8+Nb/kZ94/sHvJwnvDKuO+3/3Y3dlv2bojzr2IyIpMNOmqOFGYM
-LVN0V2Ue1bLdI4E7pWYjJ2cJj+F3qkPNZVEI7VFY/uY5+ctHhKQV8Xa7pO6kO8Rf
-77IzlhEYt8llvhjho6Tc+hj507wTmzl6NLrTQfv6MooqtyuGC2mDOL7Nii4LcK2N
-JpLuHvUBKwrZ1pebbuCoGRw6IYsMHkCtA+fdZn71uSANA+iW+YJF1DngoABd15jm
-fZ5nc8OaKveri6E6FO80vFIOiZiaBECEHX5FaZNXzuvO+FB8TxxuBEOb+dY7Ixjp
-6o7RTUaN8Tvkasq6+yO3m/qZASlaWFot4/nUbQ4mrcFuNLwy+AwF+mWj2zs3gyLp
-1txyM/1d8iC9djwj2ij3+RvrWWTV3F9yfiD8zYm1kGdNYno/Tq0dwzn+evQoFt9B
-9kiABdcPUXmsEKvU7ANm5mqwujGSQkBqvjrTcuFqN1W8rB2Vt2lh8kORdOag0wok
-RqEIr9baRRmW1FMdW4R58MD3R++Lj8UGrp1MYp3/RgT408m2ECVAdf4WqslKYIYv
-uu8wd+RU4riEmViAqhOLUTpPSPaLtrM=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFuzCCA6OgAwIBAgIIVwoRl0LE48wwDQYJKoZIhvcNAQELBQAwazELMAkGA1UE
-BhMCSVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8w
-MzM1ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290
-IENBMB4XDTExMDkyMjExMjIwMloXDTMwMDkyMjExMjIwMlowazELMAkGA1UEBhMC
-SVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8wMzM1
-ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290IENB
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp8bEpSmkLO/lGMWwUKNv
-UTufClrJwkg4CsIcoBh/kbWHuUA/3R1oHwiD1S0eiKD4j1aPbZkCkpAW1V8IbInX
-4ay8IMKx4INRimlNAJZaby/ARH6jDuSRzVju3PvHHkVH3Se5CAGfpiEd9UEtL0z9
-KK3giq0itFZljoZUj5NDKd45RnijMCO6zfB9E1fAXdKDa0hMxKufgFpbOr3JpyI/
-gCczWw63igxdBzcIy2zSekciRDXFzMwujt0q7bd9Zg1fYVEiVRvjRuPjPdA1Yprb
-rxTIW6HMiRvhMCb8oJsfgadHHwTrozmSBp+Z07/T6k9QnBn+locePGX2oxgkg4YQ
-51Q+qDp2JE+BIcXjDwL4k5RHILv+1A7TaLndxHqEguNTVHnd25zS8gebLra8Pu2F
-be8lEfKXGkJh90qX6IuxEAf6ZYGyojnP9zz/GPvG8VqLWeICrHuS0E4UT1lF9gxe
-KF+w6D9Fz8+vm2/7hNN3WpVvrJSEnu68wEqPSpP4RCHiMUVhUE4Q2OM1fEwZtN4F
-v6MGn8i1zeQf1xcGDXqVdFUNaBr8EBtiZJ1t4JWgw5QHVw0U5r0F+7if5t+L4sbn
-fpb2U8WANFAoWPASUHEXMLrmeGO89LKtmyuy/uE5jF66CyCU3nuDuP/jVo23Eek7
-jPKxwV2dpAtMK9myGPW1n0sCAwEAAaNjMGEwHQYDVR0OBBYEFFLYiDrIn3hm7Ynz
-ezhwlMkCAjbQMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUUtiIOsifeGbt
-ifN7OHCUyQICNtAwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAL
-e3KHwGCmSUyIWOYdiPcUZEim2FgKDk8TNd81HdTtBjHIgT5q1d07GjLukD0R0i70
-jsNjLiNmsGe+b7bAEzlgqqI0JZN1Ut6nna0Oh4lScWoWPBkdg/iaKWW+9D+a2fDz
-WochcYBNy+A4mz+7+uAwTc+G02UQGRjRlwKxK3JCaKygvU5a2hi/a5iB0P2avl4V
-SM0RFbnAKVy06Ij3Pjaut2L9HmLecHgQHEhb2rykOLpn7VU+Xlff1ANATIGk0k9j
-pwlCCRT8AKnCgHNPLsBA2RF7SOp6AsDT6ygBJlh0wcBzIm2Tlf05fbsq4/aC4yyX
-X04fkZT6/iyj2HYauE2yOE+b+h1IYHkm4vP9qdCa6HCPSXrW5b0KDtst842/6+Ok
-fcvHlXHo2qN8xcL4dJIEG4aspCJTQLas/kx2z/uUMsA1n3Y/buWQbqCmJqK4LL7R
-K4X9p2jIugErsWx0Hbhzlefut8cl8ABMALJ+tguLHPPAUJ4lueAI3jZm/zel0btU
-ZCzJJ7VLkn5l/9Mt4blOvH+kQSGQQXemOR/qnuOf0GZvBeyqdn6/axag67XH/JJU
-LysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9vwGYT7JZVEc+NHt4bVaT
-LnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
-MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
-IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
-MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
-FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
-bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
-H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
-uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
-mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
-a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
-E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
-WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
-VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
-Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
-cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
-IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
-AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
-YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
-6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
-Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
-c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
-mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEGDCCAwCgAwIBAgIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJTRTEU
-MBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3
-b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwHhcNMDAwNTMw
-MTAzODMxWhcNMjAwNTMwMTAzODMxWjBlMQswCQYDVQQGEwJTRTEUMBIGA1UEChML
-QWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFkZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYD
-VQQDExhBZGRUcnVzdCBDbGFzcyAxIENBIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQCWltQhSWDia+hBBwzexODcEyPNwTXH+9ZOEQpnXvUGW2ul
-CDtbKRY654eyNAbFvAWlA3yCyykQruGIgb3WntP+LVbBFc7jJp0VLhD7Bo8wBN6n
-tGO0/7Gcrjyvd7ZWxbWroulpOj0OM3kyP3CCkplhbY0wCI9xP6ZIVxn4JdxLZlyl
-dI+Yrsj5wAYi56xz36Uu+1LcsRVlIPo1Zmne3yzxbrww2ywkEtvrNTVokMsAsJch
-PXQhI2U0K7t4WaPW4XY5mqRJjox0r26kmqPZm9I4XJuiGMx1I4S+6+JNM3GOGvDC
-+Mcdoq0Dlyz4zyXG9rgkMbFjXZJ/Y/AlyVMuH79NAgMBAAGjgdIwgc8wHQYDVR0O
-BBYEFJWxtPCUtr3H2tERCSG+wa9J/RB7MAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MIGPBgNVHSMEgYcwgYSAFJWxtPCUtr3H2tERCSG+wa9J/RB7oWmkZzBl
-MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxHTAbBgNVBAsTFEFk
-ZFRydXN0IFRUUCBOZXR3b3JrMSEwHwYDVQQDExhBZGRUcnVzdCBDbGFzcyAxIENB
-IFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBACxtZBsfzQ3duQH6lmM0MkhHma6X
-7f1yFqZzR1r0693p9db7RcwpiURdv0Y5PejuvE1Uhh4dbOMXJ0PhiVYrqW9yTkkz
-43J8KiOavD7/KCrto/8cI7pDVwlnTUtiBi34/2ydYB7YHEt9tTEv2dB8Xfjea4MY
-eDdXL+gzB2ffHsdrKpV2ro9Xo/D0UrSpUwjP4E/TelOL/bscVjby/rK25Xa71SJl
-pz/+0WatC7xrmYbvP33zGDLKe8bjq2RGlfgmadlVg3sslgf/WSxEo8bl6ancoWOA
-WiFeIc9TVPC6b4nbqKqVz4vjccweGyBECMB6tkD9xOQ14R0WHNC8K47Wcdk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
-dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL
-MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
-cm1UcnVzdCBDb21tZXJjaWFsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEA9htPZwcroRX1BiLLHwGy43NFBkRJLLtJJRTWzsO3qyxPxkEylFf6EqdbDuKP
-Hx6GGaeqtS25Xw2Kwq+FNXkyLbscYjfysVtKPcrNcV/pQr6U6Mje+SJIZMblq8Yr
-ba0F8PrVC8+a5fBQpIs7R6UjW3p6+DM/uO+Zl+MgwdYoic+U+7lF7eNAFxHUdPAL
-MeIrJmqbTFeurCA+ukV6BfO9m2kVrn1OIGPENXY6BwLJN/3HR+7o8XYdcxXyl6S1
-yHp52UKqK39c/s4mT6NmgTWvRLpUHhwwMmWd5jyTXlBOeuM61G7MGvv50jeuJCqr
-VwMiKA1JdX+3KNp1v47j3A55MQIDAQABo0IwQDAdBgNVHQ4EFgQUnZPGU4teyq8/
-nx4P5ZmVvCT2lI8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
-KoZIhvcNAQELBQADggEBAFis9AQOzcAN/wr91LoWXym9e2iZWEnStB03TX8nfUYG
-XUPGhi4+c7ImfU+TqbbEKpqrIZcUsd6M06uJFdhrJNTxFq7YpFzUf1GO7RgBsZNj
-vbz4YYCanrHOQnDiqX0GJX0nof5v7LMeJNrjS1UaADs1tDvZ110w/YETifLCBivt
-Z8SOyUOyXGsViQK8YvxO8rUzqrJv0wqiUOP2O+guRMLbZjipM1ZI8W0bM40NjD9g
-N53Tym1+NH4Nn3J2ixufcv1SNUFFApYvHLKac0khsUlHRUe072o0EclNmsxZt9YC
-nlpOZbWUrhvfKbAW8b8Angc6F2S1BLUjIZkKlTuXfO8=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
-dCBOZXR3b3JraW5nMB4XDTEwMDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDEL
-MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
-cm1UcnVzdCBOZXR3b3JraW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SEHi3y
-YJ0wTsyEheIszx6e/jarM3c1RNg1lho9Nuh6DtjVR6FqaYvZ/Ls6rnla1fTWcbua
-kCNrmreIdIcMHl+5ni36q1Mr3Lt2PpNMCAiMHqIjHNRqrSK6mQEubWXLviRmVSRL
-QESxG9fhwoXA3hA/Pe24/PHxI1Pcv2WXb9n5QHGNfb2V1M6+oF4nI979ptAmDgAp
-6zxG8D1gvz9Q0twmQVGeFDdCBKNwV6gbh+0t+nvujArjqWaJGctB+d1ENmHP4ndG
-yH329JKBNv3bNPFyfvMMFr20FQIDAQABo0IwQDAdBgNVHQ4EFgQUBx/S55zawm6i
-QLSwelAQUHTEyL0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
-KoZIhvcNAQEFBQADggEBAIlXshZ6qML91tmbmzTCnLQyFE2npN/svqe++EPbkTfO
-tDIuUFUaNU52Q3Eg75N3ThVwLofDwR1t3Mu1J9QsVtFSUzpE0nPIxBsFZVpikpzu
-QY0x2+c06lkh1QF612S4ZDnNye2v7UsDSKegmQGA3GWjNq5lWUhPgkvIZfFXHeVZ
-Lgo/bNjR9eUJtGxUAArgFU2HdW23WJZa3W3SAKD0m0i+wzekujbgfIeFlxoVot4u
-olu9rxj5kFDNcFn4J2dHy8egBzp90SxdbBk6ZrV9/ZFvgrG+CJPbFEfxojfHRZ48
-x3evZKiT3/Zpg4Jg8klCNO1aAFSFHBY2kgxc+qatv9s=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVz
-dCBQcmVtaXVtMB4XDTEwMDEyOTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkG
-A1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1U
-cnVzdCBQcmVtaXVtMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBLf
-qV/+Qd3d9Z+K4/as4Tx4mrzY8H96oDMq3I0gW64tb+eT2TZwamjPjlGjhVtnBKAQ
-JG9dKILBl1fYSCkTtuG+kU3fhQxTGJoeJKJPj/CihQvL9Cl/0qRY7iZNyaqoe5rZ
-+jjeRFcV5fiMyNlI4g0WJx0eyIOFJbe6qlVBzAMiSy2RjYvmia9mx+n/K+k8rNrS
-s8PhaJyJ+HoAVt70VZVs+7pk3WKL3wt3MutizCaam7uqYoNMtAZ6MMgpv+0GTZe5
-HMQxK9VfvFMSF5yZVylmd2EhMQcuJUmdGPLu8ytxjLW6OQdJd/zvLpKQBY0tL3d7
-70O/Nbua2Plzpyzy0FfuKE4mX4+QaAkvuPjcBukumj5Rp9EixAqnOEhss/n/fauG
-V+O61oV4d7pD6kh/9ti+I20ev9E2bFhc8e6kGVQa9QPSdubhjL08s9NIS+LI+H+S
-qHZGnEJlPqQewQcDWkYtuJfzt9WyVSHvutxMAJf7FJUnM7/oQ0dG0giZFmA7mn7S
-5u046uwBHjxIVkkJx0w3AJ6IDsBz4W9m6XJHMD4Q5QsDyZpCAGzFlH5hxIrff4Ia
-C1nEWTJ3s7xgaVY5/bQGeyzWZDbZvUjthB9+pSKPKrhC9IK31FOQeE4tGv2Bb0TX
-OwF0lkLgAOIua+rF7nKsu7/+6qqo+Nz2snmKtmcCAwEAAaNCMEAwHQYDVR0OBBYE
-FJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
-BAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2
-KI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg
-Nt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0QNiigfV4Py/VpfzZotReBA4Xrf5B
-8OWycvpEgjNC6C1Y91aMYj+6QrCcDFx+LmUmXFNPALJ4fqENmS2NuB2OosSw/WDQ
-MKSOyARiqcTtNd56l+0OOF6SL5Nwpamcb6d9Ex1+xghIsV5n61EIJenmJWtSKZGc
-0jlzCFfemQa0W50QBuHCAKi4HEoCChTQwUHK+4w1IX2COPKpVJEZNZOUbWo6xbLQ
-u4mGk+ibyQ86p3q4ofB4Rvr8Ny/lioTz3/4E2aFooC8k4gmVBtWVyuEklut89pMF
-u+1z6S3RdTnX5yTb2E5fQ4+e0BQ5v1VwSJlXMbSc7kqYA5YwH2AG7hsj/oFgIxpH
-YoWlzBk0gG+zrBrjn/B7SK3VAdlntqlyk+otZrWyuOQ9PLLvTIzq6we/qzWaVYa8
-GKa1qF60g2xraUDTn9zxw2lrueFtCfTxqlB2Cnp9ehehVZZCmTEJ3WARjQUwfuaO
-RtGdFNrHF+QFlozEJLUbzxQHskD4o55BhrwE0GuWyCqANP2/7waj3VjFhT0+j/6e
-KeC2uAloGRwYQw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMC
-VVMxFDASBgNVBAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQ
-cmVtaXVtIEVDQzAeFw0xMDAxMjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJ
-BgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwXQWZmaXJt
-VHJ1c3QgUHJlbWl1bSBFQ0MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNMF4bFZ0D
-0KF5Nbc6PJJ6yhUczWLznCZcBz3lVPqj1swS6vQUX+iOGasvLkjmrBhDeKzQN8O9
-ss0s5kfiGuZjuD0uL3jET9v0D6RoTFVya5UdThhClXjMNzyR4ptlKymjQjBAMB0G
-A1UdDgQWBBSaryl6wBE1NSZRMADDav5A1a7WPDAPBgNVHRMBAf8EBTADAQH/MA4G
-A1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAXCfOHiFBar8jAQr9HX/Vs
-aobgxCd05DhT1wV/GzTjxi+zygk8N53X57hG8f2h4nECMEJZh0PUUd+60wkyWs6I
-flc9nF9Ca/UHLbXwgpP5WW+uZPpY5Yse42O+tYHNbwKMeQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
-ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
-b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL
-MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
-b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
-ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
-9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
-IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
-VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
-93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
-jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
-AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA
-A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI
-U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs
-N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv
-o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU
-5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy
-rqXRfboQnoZsG4q5WTP468SQvvG5
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwF
-ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
-b24gUm9vdCBDQSAyMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTEL
-MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
-b3QgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Wny2cSkxK
-gXlRmeyKy2tgURO8TW0G/LAIjd0ZEGrHJgw12MBvIITplLGbhQPDW9tK6Mj4kHbZ
-W0/jTOgGNk3Mmqw9DJArktQGGWCsN0R5hYGCrVo34A3MnaZMUnbqQ523BNFQ9lXg
-1dKmSYXpN+nKfq5clU1Imj+uIFptiJXZNLhSGkOQsL9sBbm2eLfq0OQ6PBJTYv9K
-8nu+NQWpEjTj82R0Yiw9AElaKP4yRLuH3WUnAnE72kr3H9rN9yFVkE8P7K6C4Z9r
-2UXTu/Bfh+08LDmG2j/e7HJV63mjrdvdfLC6HM783k81ds8P+HgfajZRRidhW+me
-z/CiVX18JYpvL7TFz4QuK/0NURBs+18bvBt+xa47mAExkv8LV/SasrlX6avvDXbR
-8O70zoan4G7ptGmh32n2M8ZpLpcTnqWHsFcQgTfJU7O7f/aS0ZzQGPSSbtqDT6Zj
-mUyl+17vIWR6IF9sZIUVyzfpYgwLKhbcAS4y2j5L9Z469hdAlO+ekQiG+r5jqFoz
-7Mt0Q5X5bGlSNscpb/xVA1wf+5+9R+vnSUeVC06JIglJ4PVhHvG/LopyboBZ/1c6
-+XUyo05f7O0oYtlNc/LMgRdg7c3r3NunysV+Ar3yVAhU/bQtCSwXVEqY0VThUWcI
-0u1ufm8/0i2BWSlmy5A5lREedCf+3euvAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
-Af8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSwDPBMMPQFWAJI/TPlUq9LhONm
-UjANBgkqhkiG9w0BAQwFAAOCAgEAqqiAjw54o+Ci1M3m9Zh6O+oAA7CXDpO8Wqj2
-LIxyh6mx/H9z/WNxeKWHWc8w4Q0QshNabYL1auaAn6AFC2jkR2vHat+2/XcycuUY
-+gn0oJMsXdKMdYV2ZZAMA3m3MSNjrXiDCYZohMr/+c8mmpJ5581LxedhpxfL86kS
-k5Nrp+gvU5LEYFiwzAJRGFuFjWJZY7attN6a+yb3ACfAXVU3dJnJUH/jWS5E4ywl
-7uxMMne0nxrpS10gxdr9HIcWxkPo1LsmmkVwXqkLN1PiRnsn/eBG8om3zEK2yygm
-btmlyTrIQRNg91CMFa6ybRoVGld45pIq2WWQgj9sAq+uEjonljYE1x2igGOpm/Hl
-urR8FLBOybEfdF849lHqm/osohHUqS0nGkWxr7JOcQ3AWEbWaQbLU8uz/mtBzUF+
-fUwPfHJ5elnNXkoOrJupmHN5fLT0zLm4BwyydFy4x2+IoZCn9Kr5v2c69BoVYh63
-n749sSmvZ6ES8lgQGVMDMBu4Gon2nL2XA46jCfMdiyHxtN/kHNGfZQIG6lzWE7OE
-76KlXIx3KadowGuuQNKotOrN8I1LOJwZmhsoVLiJkO/KdYE+HvJkJMcYr07/R54H
-9jVlpNMKVv/1F2Rs76giJUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT
-4PsJYGw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5
-MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
-Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
-A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg
-Q0EgMzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCmXp8ZBf8ANm+gBG1bG8lKl
-ui2yEujSLtf6ycXYqm0fc4E7O5hrOXwzpcVOho6AF2hiRVd9RFgdszflZwjrZt6j
-QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSr
-ttvXBp43rDCGB5Fwx5zEGbF4wDAKBggqhkjOPQQDAgNJADBGAiEA4IWSoxe3jfkr
-BqWTrBqYaGFy+uGh0PsceGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteM
-YyRIHN8wfdVoOw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5
-MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
-Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
-A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg
-Q0EgNDB2MBAGByqGSM49AgEGBSuBBAAiA2IABNKrijdPo1MN/sGKe0uoe0ZLY7Bi
-9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri83Bk
-M6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB
-/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WB
-MAoGCCqGSM49BAMDA2gAMGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlw
-CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW
-1KyLa2tJElMzrdfkviT8tQp21KW8EA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
-AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
-EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
-FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
-Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
-VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
-SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
-4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
-cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
-eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
-A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
-DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
-vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
-DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
-maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
-lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
-KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGFDCCA/ygAwIBAgIIU+w77vuySF8wDQYJKoZIhvcNAQEFBQAwUTELMAkGA1UE
-BhMCRVMxQjBABgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1h
-cHJvZmVzaW9uYWwgQ0lGIEE2MjYzNDA2ODAeFw0wOTA1MjAwODM4MTVaFw0zMDEy
-MzEwODM4MTVaMFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUg
-Q2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjgwggIi
-MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDDUtd9
-thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQM
-cas9UX4PB99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefG
-L9ItWY16Ck6WaVICqjaY7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15i
-NA9wBj4gGFrO93IbJWyTdBSTo3OxDqqHECNZXyAFGUftaI6SEspd/NYrspI8IM/h
-X68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyIplD9amML9ZMWGxmPsu2b
-m8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctXMbScyJCy
-Z/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirja
-EbsXLZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/T
-KI8xWVvTyQKmtFLKbpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF
-6NkBiDkal4ZkQdU7hwxu+g/GvUgUvzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVh
-OSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYD
-VR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlzeurNR4APn7VdMActHNHDhpkLzCBpgYD
-VR0gBIGeMIGbMIGYBgRVHSAAMIGPMC8GCCsGAQUFBwIBFiNodHRwOi8vd3d3LmZp
-cm1hcHJvZmVzaW9uYWwuY29tL2NwczBcBggrBgEFBQcCAjBQHk4AUABhAHMAZQBv
-ACAAZABlACAAbABhACAAQgBvAG4AYQBuAG8AdgBhACAANAA3ACAAQgBhAHIAYwBl
-AGwAbwBuAGEAIAAwADgAMAAxADcwDQYJKoZIhvcNAQEFBQADggIBABd9oPm03cXF
-661LJLWhAqvdpYhKsg9VSytXjDvlMd3+xDLx51tkljYyGOylMnfX40S2wBEqgLk9
-am58m9Ot/MPWo+ZkKXzR4Tgegiv/J2Wv+xYVxC5xhOW1//qkR71kMrv2JYSiJ0L1
-ILDCExARzRAVukKQKtJE4ZYm6zFIEv0q2skGz3QeqUvVhyj5eTSSPi5E6PaPT481
-PyWzOdxjKpBrIF/EUhJOlywqrJ2X3kjyo2bbwtKDlaZmp54lD+kLM5FlClrD2VQS
-3a/DTg4fJl4N3LON7NWBcN7STyQF82xO9UxJZo3R/9ILJUFI/lGExkKvgATP0H5k
-SeTy36LssUzAKh3ntLFlosS88Zj0qnAHY7S42jtM+kAiMFsRpvAFDsYCA0irhpuF
-3dvd6qJ2gHN99ZwExEWN57kci57q13XRcrHedUTnQn3iV2t93Jm8PYMo6oCTjcVM
-ZcFwgbg4/EMxsvYDNEeyrPsiBsse3RdHHF9mudMaotoRsaS8I8nkvof/uZS2+F0g
-StRf571oe2XyFR7SOqkt6dhrJKyXWERHrVkY8SFlcN7ONGCoQPHzPKTDKCOM/icz
-Q0CgFzzr6juwcqajuUpLXhZI9LK8yIySxZ2frHI2vDSANGupi5LAuBft7HZT9SQB
-jLMi6Et8Vcad+qMUu2WFbm5PEn4KPJ2V
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
-RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD
-VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX
-DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y
-ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy
-VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr
-mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr
-IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK
-mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu
-XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy
-dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye
-jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1
-BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3
-DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92
-9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx
-jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0
-Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz
-ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS
-R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd
-MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg
-Q2xhc3MgMiBSb290IENBMB4XDTEwMTAyNjA4MzgwM1oXDTQwMTAyNjA4MzgwM1ow
-TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw
-HgYDVQQDDBdCdXlwYXNzIENsYXNzIDIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB
-BQADggIPADCCAgoCggIBANfHXvfBB9R3+0Mh9PT1aeTuMgHbo4Yf5FkNuud1g1Lr
-6hxhFUi7HQfKjK6w3Jad6sNgkoaCKHOcVgb/S2TwDCo3SbXlzwx87vFKu3MwZfPV
-L4O2fuPn9Z6rYPnT8Z2SdIrkHJasW4DptfQxh6NR/Md+oW+OU3fUl8FVM5I+GC91
-1K2GScuVr1QGbNgGE41b/+EmGVnAJLqBcXmQRFBoJJRfuLMR8SlBYaNByyM21cHx
-MlAQTn/0hpPshNOOvEu/XAFOBz3cFIqUCqTqc/sLUegTBxj6DvEr0VQVfTzh97QZ
-QmdiXnfgolXsttlpF9U6r0TtSsWe5HonfOV116rLJeffawrbD02TTqigzXsu8lkB
-arcNuAeBfos4GzjmCleZPe4h6KP1DBbdi+w0jpwqHAAVF41og9JwnxgIzRFo1clr
-Us3ERo/ctfPYV3Me6ZQ5BL/T3jjetFPsaRyifsSP5BtwrfKi+fv3FmRmaZ9JUaLi
-FRhnBkp/1Wy1TbMz4GHrXb7pmA8y1x1LPC5aAVKRCfLf6o3YBkBjqhHk/sM3nhRS
-P/TizPJhk9H9Z2vXUq6/aKtAQ6BXNVN48FP4YUIHZMbXb5tMOA1jrGKvNouicwoN
-9SG9dKpN6nIDSdvHXx1iY8f93ZHsM+71bbRuMGjeyNYmsHVee7QHIJihdjK4TWxP
-AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMmAd+BikoL1Rpzz
-uvdMw964o605MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAU18h
-9bqwOlI5LJKwbADJ784g7wbylp7ppHR/ehb8t/W2+xUbP6umwHJdELFx7rxP462s
-A20ucS6vxOOto70MEae0/0qyexAQH6dXQbLArvQsWdZHEIjzIVEpMMpghq9Gqx3t
-OluwlN5E40EIosHsHdb9T7bWR9AUC8rmyrV7d35BH16Dx7aMOZawP5aBQW9gkOLo
-+fsicdl9sz1Gv7SEr5AcD48Saq/v7h56rgJKihcrdv6sVIkkLE8/trKnToyokZf7
-KcZ7XC25y2a2t6hbElGFtQl+Ynhw/qlqYLYdDnkM/crqJIByw5c/8nerQyIKx+u2
-DISCLIBrQYoIwOula9+ZEsuK1V6ADJHgJgg2SMX6OBE1/yWDLfJ6v9r9jv6ly0Us
-H8SIU653DtmadsWOLB2jutXsMq7Aqqz30XpN69QH4kj3Io6wpJ9qzo6ysmD0oyLQ
-I+uUWnpp3Q+/QFesa1lQ2aOZ4W7+jQF5JyMV3pKdewlNWudLSDBaGOYKbeaP4NK7
-5t98biGCwWg5TbSYWGZizEqQXsP6JwSxeRV0mcy+rSDeJmAc61ZRpqPq5KM/p/9h
-3PFaTWwyI0PurKju7koSCTxdccK+efrCh2gdC/1cacwG0Jp9VJkqyTkaGa9LKkPz
-Y11aWOIv4x3kqdbQCtCev9eBCfHJxyYNrJgWVqA=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd
-MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg
-Q2xhc3MgMyBSb290IENBMB4XDTEwMTAyNjA4Mjg1OFoXDTQwMTAyNjA4Mjg1OFow
-TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw
-HgYDVQQDDBdCdXlwYXNzIENsYXNzIDMgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB
-BQADggIPADCCAgoCggIBAKXaCpUWUOOV8l6ddjEGMnqb8RB2uACatVI2zSRHsJ8Y
-ZLya9vrVediQYkwiL944PdbgqOkcLNt4EemOaFEVcsfzM4fkoF0LXOBXByow9c3E
-N3coTRiR5r/VUv1xLXA+58bEiuPwKAv0dpihi4dVsjoT/Lc+JzeOIuOoTyrvYLs9
-tznDDgFHmV0ST9tD+leh7fmdvhFHJlsTmKtdFoqwNxxXnUX/iJY2v7vKB3tvh2PX
-0DJq1l1sDPGzbjniazEuOQAnFN44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c
-/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X
-KhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY
-zIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS
-O1UQRwUVZ2J+GGOmRj8JDlQyXr8NYnon74Do29lLBlo3WiXQCBJ31G8JUJc9yB3D
-34xFMFbG02SrZvPAXpacw8Tvw3xrizp5f7NJzz3iiZ+gMEuFuZyUJHmPfWupRWgP
-K9Dx2hzLabjKSWJtyNBjYt1gD1iqj6G8BaVmos8bdrKEZLFMOVLAMLrwjEsCsLa3
-AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEe4zf/lb+74suwv
-Tg75JbCOPGvDMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAACAj
-QTUEkMJAYmDv4jVM1z+s4jSQuKFvdvoWFqRINyzpkMLyPPgKn9iB5btb2iUspKdV
-cSQy9sgL8rxq+JOssgfCX5/bzMiKqr5qb+FJEMwx14C7u8jYog5kV+qi9cKpMRXS
-IGrs/CIBKM+GuIAeqcwRpTzyFrNHnfzSgCHEy9BHcEGhyoMZCCxt8l13nIoUE9Q2
-HJLw5QY33KbmkJs4j1xrG0aGQ0JfPgEHU1RdZX33inOhmlRaHylDFCfChQ+1iHsa
-O5S3HWCntZznKWlXWpuTekMwGwPXYshApqr8ZORK15FTAaggiG6cX0S5y2CBNOxv
-033aSF/rtJC8LakcC6wc1aJoIIAE1vyxjy+7SjENSoYc6+I2KSb12tjE8nVhz36u
-dmNKekBlk4f4HoCMhuWG1o8O/FMsYOgWYRqiPkN7zTlgVGr18okmAWiDSKIz6MkE
-kbIRNBE+6tBDGR8Dk5AM/1E9V/RBbuHLoL7ryWPNbczk+DaqaJ3tvV2XcEQNtg41
-3OEMXbugUZTLfhbrES+jkkXITHHZvMmZUldGL1DPvTVp9D0VzgalLA8+9oG6lLvD
-u79leNKGef9JOxqDDPDeeOzI8k1MGt6CKfjBWtrt7uYnXuhF0J0cUahoq0Tj0Itq
-4/g7u9xN12TyUb7mqqta6THuBrxzvxNiCp/HuZc=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFaTCCA1GgAwIBAgIJAJK4iNuwisFjMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNV
-BAYTAlNLMRMwEQYDVQQHEwpCcmF0aXNsYXZhMRMwEQYDVQQKEwpEaXNpZyBhLnMu
-MRkwFwYDVQQDExBDQSBEaXNpZyBSb290IFIyMB4XDTEyMDcxOTA5MTUzMFoXDTQy
-MDcxOTA5MTUzMFowUjELMAkGA1UEBhMCU0sxEzARBgNVBAcTCkJyYXRpc2xhdmEx
-EzARBgNVBAoTCkRpc2lnIGEucy4xGTAXBgNVBAMTEENBIERpc2lnIFJvb3QgUjIw
-ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCio8QACdaFXS1tFPbCw3Oe
-NcJxVX6B+6tGUODBfEl45qt5WDza/3wcn9iXAng+a0EE6UG9vgMsRfYvZNSrXaNH
-PWSb6WiaxswbP7q+sos0Ai6YVRn8jG+qX9pMzk0DIaPY0jSTVpbLTAwAFjxfGs3I
-x2ymrdMxp7zo5eFm1tL7A7RBZckQrg4FY8aAamkw/dLukO8NJ9+flXP04SXabBbe
-QTg06ov80egEFGEtQX6sx3dOy1FU+16SGBsEWmjGycT6txOgmLcRK7fWV8x8nhfR
-yyX+hk4kLlYMeE2eARKmK6cBZW58Yh2EhN/qwGu1pSqVg8NTEQxzHQuyRpDRQjrO
-QG6Vrf/GlK1ul4SOfW+eioANSW1z4nuSHsPzwfPrLgVv2RvPN3YEyLRa5Beny912
-H9AZdugsBbPWnDTYltxhh5EF5EQIM8HauQhl1K6yNg3ruji6DOWbnuuNZt2Zz9aJ
-QfYEkoopKW1rOhzndX0CcQ7zwOe9yxndnWCywmZgtrEE7snmhrmaZkCo5xHtgUUD
-i/ZnWejBBhG93c+AAk9lQHhcR1DIm+YfgXvkRKhbhZri3lrVx/k6RGZL5DJUfORs
-nLMOPReisjQS1n6yqEm70XooQL6iFh/f5DcfEXP7kAplQ6INfPgGAVUzfbANuPT1
-rqVCV3w2EYx7XsQDnYx5nQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
-DwEB/wQEAwIBBjAdBgNVHQ4EFgQUtZn4r7CU9eMg1gqtzk5WpC5uQu0wDQYJKoZI
-hvcNAQELBQADggIBACYGXnDnZTPIgm7ZnBc6G3pmsgH2eDtpXi/q/075KMOYKmFM
-tCQSin1tERT3nLXK5ryeJ45MGcipvXrA1zYObYVybqjGom32+nNjf7xueQgcnYqf
-GopTpti72TVVsRHFqQOzVju5hJMiXn7B9hJSi+osZ7z+Nkz1uM/Rs0mSO9MpDpkb
-lvdhuDvEK7Z4bLQjb/D907JedR+Zlais9trhxTF7+9FGs9K8Z7RiVLoJ92Owk6Ka
-+elSLotgEqv89WBW7xBci8QaQtyDW2QOy7W81k/BfDxujRNt+3vrMNDcTa/F1bal
-TFtxyegxvug4BkihGuLq0t4SOVga/4AOgnXmt8kHbA7v/zjxmHHEt38OFdAlab0i
-nSvtBfZGR6ztwPDUO+Ls7pZbkBNOHlY667DvlruWIxG68kOGdGSVyCh13x01utI3
-gzhTODY7z2zp+WsO0PsE6E9312UBeIYMej4hYvF/Y3EMyZ9E26gnonW+boE+18Dr
-G5gPcFw0sorMwIUY6256s/daoQe/qUKS82Ail+QUoQebTnbAjn39pCXHR+3/H3Os
-zMOl6W8KjptlwlCFtaOgUxLMVYdh84GuEEZhvUQhuMI9dM9+JDX6HAcOmz0iyu8x
-L4ysEr3vQCj8KWefshNPZiTEUxnpHikV7+ZtsH8tZ/3zbBt1RqPlShfppNcL
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFjTCCA3WgAwIBAgIEGErM1jANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJD
-TjEwMC4GA1UECgwnQ2hpbmEgRmluYW5jaWFsIENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJPT1QwHhcNMTIwODA4MDMwNzAxWhcNMjkx
-MjMxMDMwNzAxWjBWMQswCQYDVQQGEwJDTjEwMC4GA1UECgwnQ2hpbmEgRmluYW5j
-aWFsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJP
-T1QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXXWvNED8fBVnVBU03
-sQ7smCuOFR36k0sXgiFxEFLXUWRwFsJVaU2OFW2fvwwbwuCjZ9YMrM8irq93VCpL
-TIpTUnrD7i7es3ElweldPe6hL6P3KjzJIx1qqx2hp/Hz7KDVRM8Vz3IvHWOX6Jn5
-/ZOkVIBMUtRSqy5J35DNuF++P96hyk0g1CXohClTt7GIH//62pCfCqktQT+x8Rgp
-7hZZLDRJGqgG16iI0gNyejLi6mhNbiyWZXvKWfry4t3uMCz7zEasxGPrb382KzRz
-EpR/38wmnvFyXVBlWY9ps4deMm/DGIq1lY+wejfeWkU7xzbh72fROdOXW3NiGUgt
-hxwG+3SYIElz8AXSG7Ggo7cbcNOIabla1jj0Ytwli3i/+Oh+uFzJlU9fpy25IGvP
-a931DfSCt/SyZi4QKPaXWnuWFo8BGS1sbn85WAZkgwGDg8NNkt0yxoekN+kWzqot
-aK8KgWU6cMGbrU1tVMoqLUuFG7OA5nBFDWteNfB/O7ic5ARwiRIlk9oKmSJgamNg
-TnYGmE69g60dWIolhdLHZR4tjsbftsbhf4oEIRUpdPA+nJCdDC7xij5aqgwJHsfV
-PKPtl8MeNPo4+QgO48BdK4PRVmrJtqhUUy54Mmc9gn900PvhtgVguXDbjgv5E1hv
-cWAQUhC5wUEJ73IfZzF4/5YFjQIDAQABo2MwYTAfBgNVHSMEGDAWgBTj/i39KNAL
-tbq2osS/BqoFjJP7LzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd
-BgNVHQ4EFgQU4/4t/SjQC7W6tqLEvwaqBYyT+y8wDQYJKoZIhvcNAQELBQADggIB
-ACXGumvrh8vegjmWPfBEp2uEcwPenStPuiB/vHiyz5ewG5zz13ku9Ui20vsXiObT
-ej/tUxPQ4i9qecsAIyjmHjdXNYmEwnZPNDatZ8POQQaIxffu2Bq41gt/UP+TqhdL
-jOztUmCypAbqTuv0axn96/Ua4CUqmtzHQTb3yHQFhDmVOdYLO6Qn+gjYXB74BGBS
-ESgoA//vU2YApUo0FmZ8/Qmkrp5nGm9BC2sGE5uPhnEFtC+NiWYzKXZUmhH4J/qy
-P5Hgzg0b8zAarb8iXRvTvyUFTeGSGn+ZnzxEk8rUQElsgIfXBDrDMlI1Dlb4pd19
-xIsNER9Tyx6yF7Zod1rg1MvIB671Oi6ON7fQAUtDKXeMOZePglr4UeWJoBjnaH9d
-Ci77o0cOPaYjesYBx4/IXr9tgFa+iiS6M+qf4TIRnvHST4D2G0CvOJ4RUHlzEhLN
-5mydLIhyPDCBBpEi6lmt2hkuIsKNuYyH4Ga8cyNfIWRjgEj1oDwYPZTISEEdQLpe
-/v5WOaHIz16eGWRGENoXkbcFgKyLmZJ956LYBws2J+dIeWCKw9cTXPhyQN9Ky8+Z
-AAoACxGV2lZFA4gKn2fQ1XmxqI1AbQ3CekD6819kR5LLU7m7Wc5P/dAVUwHY3+vZ
-5nbv0CO7O6l5s9UCKc2Jo5YPSjXnTkLAdc0Hz+Ys63su
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB
-gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
-A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV
-BAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEyMDEwMDAw
-MDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
-YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P
-RE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3
-UcEbVASY06m/weaKXTuH+7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI
-2GqGd0S7WWaXUF601CxwRM/aN5VCaTwwxHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8
-Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV4EajcNxo2f8ESIl33rXp
-+2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA1KGzqSX+
-DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5O
-nKVIrLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW
-/zAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6g
-PKA6hjhodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9u
-QXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAPpiem/Yb6dc5t3iuHXIY
-SdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CPOGEIqB6BCsAv
-IC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/
-RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4
-zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
-BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB
-ZQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL
-MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
-BxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMT
-IkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwMzA2MDAw
-MDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy
-ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09N
-T0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlv
-biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSR
-FtSrYpn1PlILBs5BAH+X4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0J
-cfRK9ChQtP6IHG4/bC8vCVlbpVsLM5niwz2J+Wos77LTBumjQjBAMB0GA1UdDgQW
-BBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
-BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VGFAkK+qDm
-fQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdv
-GDeAU/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB
-hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
-A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
-BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5
-MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
-EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
-Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh
-dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR
-6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X
-pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC
-9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV
-/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf
-Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z
-+pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w
-qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah
-SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC
-u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf
-Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq
-crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E
-FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
-/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl
-wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM
-4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV
-2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna
-FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ
-CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK
-boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke
-jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL
-S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb
-QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
-0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB
-NVOFBkpdn627G190
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEvTCCA6WgAwIBAgIBADANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJFVTEn
-MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL
-ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMg
-b2YgQ29tbWVyY2UgUm9vdDAeFw0wMzA5MzAxNjEzNDNaFw0zNzA5MzAxNjEzNDRa
-MH8xCzAJBgNVBAYTAkVVMScwJQYDVQQKEx5BQyBDYW1lcmZpcm1hIFNBIENJRiBB
-ODI3NDMyODcxIzAhBgNVBAsTGmh0dHA6Ly93d3cuY2hhbWJlcnNpZ24ub3JnMSIw
-IAYDVQQDExlDaGFtYmVycyBvZiBDb21tZXJjZSBSb290MIIBIDANBgkqhkiG9w0B
-AQEFAAOCAQ0AMIIBCAKCAQEAtzZV5aVdGDDg2olUkfzIx1L4L1DZ77F1c2VHfRtb
-unXF/KGIJPov7coISjlUxFF6tdpg6jg8gbLL8bvZkSM/SAFwdakFKq0fcfPJVD0d
-BmpAPrMMhe5cG3nCYsS4No41XQEMIwRHNaqbYE6gZj3LJgqcQKH0XZi/caulAGgq
-7YN6D6IUtdQis4CwPAxaUWktWBiP7Zme8a7ileb2R6jWDA+wWFjbw2Y3npuRVDM3
-0pQcakjJyfKl2qUMI/cjDpwyVV5xnIQFUZot/eZOKjRa3spAN2cMVCFVd9oKDMyX
-roDclDZK9D7ONhMeU+SsTjoF7Nuucpw4i9A5O4kKPnf+dQIBA6OCAUQwggFAMBIG
-A1UdEwEB/wQIMAYBAf8CAQwwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5j
-aGFtYmVyc2lnbi5vcmcvY2hhbWJlcnNyb290LmNybDAdBgNVHQ4EFgQU45T1sU3p
-26EpW1eLTXYGduHRooowDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIA
-BzAnBgNVHREEIDAegRxjaGFtYmVyc3Jvb3RAY2hhbWJlcnNpZ24ub3JnMCcGA1Ud
-EgQgMB6BHGNoYW1iZXJzcm9vdEBjaGFtYmVyc2lnbi5vcmcwWAYDVR0gBFEwTzBN
-BgsrBgEEAYGHLgoDATA+MDwGCCsGAQUFBwIBFjBodHRwOi8vY3BzLmNoYW1iZXJz
-aWduLm9yZy9jcHMvY2hhbWJlcnNyb290Lmh0bWwwDQYJKoZIhvcNAQEFBQADggEB
-AAxBl8IahsAifJ/7kPMa0QOx7xP5IV8EnNrJpY0nbJaHkb5BkAFyk+cefV/2icZd
-p0AJPaxJRUXcLo0waLIJuvvDL8y6C98/d3tGfToSJI6WjzwFCm/SlCgdbQzALogi
-1djPHRPH8EjX1wWnz8dHnjs8NMiAT9QUu/wNUPf6s+xCX6ndbcj0dc97wXImsQEc
-XCz9ek60AcUFV7nnPKoF2YjpB0ZBzu9Bga5Y34OirsrXdx/nADydb47kMgkdTXg0
-eDQ8lJsm7U9xxhl6vSAiSFr+S30Dt+dYvsYyTnQeaN2oaFuzPu5ifdmA6Ap1erfu
-tGWaIZDgqtCYvDi1czyL+Nw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIExTCCA62gAwIBAgIBADANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJFVTEn
-MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL
-ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4GA1UEAxMXR2xvYmFsIENo
-YW1iZXJzaWduIFJvb3QwHhcNMDMwOTMwMTYxNDE4WhcNMzcwOTMwMTYxNDE4WjB9
-MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgy
-NzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEgMB4G
-A1UEAxMXR2xvYmFsIENoYW1iZXJzaWduIFJvb3QwggEgMA0GCSqGSIb3DQEBAQUA
-A4IBDQAwggEIAoIBAQCicKLQn0KuWxfH2H3PFIP8T8mhtxOviteePgQKkotgVvq0
-Mi+ITaFgCPS3CU6gSS9J1tPfnZdan5QEcOw/Wdm3zGaLmFIoCQLfxS+EjXqXd7/s
-QJ0lcqu1PzKY+7e3/HKE5TWH+VX6ox8Oby4o3Wmg2UIQxvi1RMLQQ3/bvOSiPGpV
-eAp3qdjqGTK3L/5cPxvusZjsyq16aUXjlg9V9ubtdepl6DJWk0aJqCWKZQbua795
-B9Dxt6/tLE2Su8CoX6dnfQTyFQhwrJLWfQTSM/tMtgsL+xrJxI0DqX5c8lCrEqWh
-z0hQpe/SyBoT+rB/sYIcd2oPX9wLlY/vQ37mRQklAgEDo4IBUDCCAUwwEgYDVR0T
-AQH/BAgwBgEB/wIBDDA/BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vY3JsLmNoYW1i
-ZXJzaWduLm9yZy9jaGFtYmVyc2lnbnJvb3QuY3JsMB0GA1UdDgQWBBRDnDafsJ4w
-TcbOX60Qq+UDpfqpFDAOBgNVHQ8BAf8EBAMCAQYwEQYJYIZIAYb4QgEBBAQDAgAH
-MCoGA1UdEQQjMCGBH2NoYW1iZXJzaWducm9vdEBjaGFtYmVyc2lnbi5vcmcwKgYD
-VR0SBCMwIYEfY2hhbWJlcnNpZ25yb290QGNoYW1iZXJzaWduLm9yZzBbBgNVHSAE
-VDBSMFAGCysGAQQBgYcuCgEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly9jcHMuY2hh
-bWJlcnNpZ24ub3JnL2Nwcy9jaGFtYmVyc2lnbnJvb3QuaHRtbDANBgkqhkiG9w0B
-AQUFAAOCAQEAPDtwkfkEVCeR4e3t/mh/YV3lQWVPMvEYBZRqHN4fcNs+ezICNLUM
-bKGKfKX0j//U2K0X1S0E0T9YgOKBWYi+wONGkyT+kL0mojAt6JcmVzWJdJYY9hXi
-ryQZVgICsroPFOrGimbBhkVVi76SvpykBMdJPJ7oKXqJ1/6v/2j1pReQvayZzKWG
-VwlnRtvWFsJG8eSpUPWP0ZIV018+xgBJOm5YstHRJw0lyDL4IBHNfTIzSJRUTN3c
-ecQwn+uOuFW114hcxWokPbLTBQNRxgfvzBRydD1ucs4YKIxKoHflCStFREest2d/
-AYoFWpO+ocH/+OcOZ6RHSXZddZAa9SaP8A==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNV
-BAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4X
-DTA3MDYyOTE1MTMwNVoXDTI3MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQ
-BgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwIQ2VydGlnbmEwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7qXOEm7RFHYeGifBZ4
-QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyHGxny
-gQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbw
-zBfsV1/pogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q
-130yGLMLLGq/jj8UEYkgDncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2
-JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKfIrjxwo1p3Po6WAbfAgMBAAGjgbwwgbkw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQtCRZvgHyUtVF9lo53BEw
-ZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJBgNVBAYT
-AkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzj
-AQ/JSP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG
-9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h
-bV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc
-fca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu
-HWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY1gkIl2PlwS6w
-t0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw
-WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGWzCCBEOgAwIBAgIRAMrpG4nxVQMNo+ZBbcTjpuEwDQYJKoZIhvcNAQELBQAw
-WjELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCURoaW15b3RpczEcMBoGA1UECwwTMDAw
-MiA0ODE0NjMwODEwMDAzNjEZMBcGA1UEAwwQQ2VydGlnbmEgUm9vdCBDQTAeFw0x
-MzEwMDEwODMyMjdaFw0zMzEwMDEwODMyMjdaMFoxCzAJBgNVBAYTAkZSMRIwEAYD
-VQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMDgxMDAwMzYxGTAX
-BgNVBAMMEENlcnRpZ25hIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
-ggIKAoICAQDNGDllGlmx6mQWDoyUJJV8g9PFOSbcDO8WV43X2KyjQn+Cyu3NW9sO
-ty3tRQgXstmzy9YXUnIo245Onoq2C/mehJpNdt4iKVzSs9IGPjA5qXSjklYcoW9M
-CiBtnyN6tMbaLOQdLNyzKNAT8kxOAkmhVECe5uUFoC2EyP+YbNDrihqECB63aCPu
-I9Vwzm1RaRDuoXrC0SIxwoKF0vJVdlB8JXrJhFwLrN1CTivngqIkicuQstDuI7pm
-TLtipPlTWmR7fJj6o0ieD5Wupxj0auwuA0Wv8HT4Ks16XdG+RCYyKfHx9WzMfgIh
-C59vpD++nVPiz32pLHxYGpfhPTc3GGYo0kDFUYqMwy3OU4gkWGQwFsWq4NYKpkDf
-ePb1BHxpE4S80dGnBs8B92jAqFe7OmGtBIyT46388NtEbVncSVmurJqZNjBBe3Yz
-IoejwpKGbvlw7q6Hh5UbxHq9MfPU0uWZ/75I7HX1eBYdpnDBfzwboZL7z8g81sWT
-Co/1VTp2lc5ZmIoJlXcymoO6LAQ6l73UL77XbJuiyn1tJslV1c/DeVIICZkHJC1k
-JWumIWmbat10TWuXekG9qxf5kBdIjzb5LdXF2+6qhUVB+s06RbFo5jZMm5BX7CO5
-hwjCxAnxl4YqKE3idMDaxIzb3+KhF1nOJFl0Mdp//TBt2dzhauH8XwIDAQABo4IB
-GjCCARYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
-FBiHVuBud+4kNTxOc5of1uHieX4rMB8GA1UdIwQYMBaAFBiHVuBud+4kNTxOc5of
-1uHieX4rMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwczov
-L3d3d3cuY2VydGlnbmEuZnIvYXV0b3JpdGVzLzBtBgNVHR8EZjBkMC+gLaArhilo
-dHRwOi8vY3JsLmNlcnRpZ25hLmZyL2NlcnRpZ25hcm9vdGNhLmNybDAxoC+gLYYr
-aHR0cDovL2NybC5kaGlteW90aXMuY29tL2NlcnRpZ25hcm9vdGNhLmNybDANBgkq
-hkiG9w0BAQsFAAOCAgEAlLieT/DjlQgi581oQfccVdV8AOItOoldaDgvUSILSo3L
-6btdPrtcPbEo/uRTVRPPoZAbAh1fZkYJMyjhDSSXcNMQH+pkV5a7XdrnxIxPTGRG
-HVyH41neQtGbqH6mid2PHMkwgu07nM3A6RngatgCdTer9zQoKJHyBApPNeNgJgH6
-0BGM+RFq7q89w1DTj18zeTyGqHNFkIwgtnJzFyO+B2XleJINugHA64wcZr+shncB
-lA2c5uk5jR+mUYyZDDl34bSb+hxnV29qao6pK0xXeXpXIs/NX2NGjVxZOob4Mkdi
-o2cNGJHc+6Zr9UhhcyNZjgKnvETq9Emd8VRY+WCv2hikLyhF3HqgiIZd8zvn/yk1
-gPxkQ5Tm4xxvvq0OKmOZK8l+hfZx6AYDlf7ej0gcWtSS6Cvu5zHbugRqh5jnxV/v
-faci9wHYTfmJ0A6aBVmknpjZbyvKcL5kwlWj9Omvw5Ip3IgWJJk8jSaYtlu3zM63
-Nwf9JtmYhST/WSMDmu2dnajkXjjO11INb9I/bbEFa0nOipFGc/T2L/Coc3cOZayh
-jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw
-3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFkjCCA3qgAwIBAgIBATANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJGUjET
-MBEGA1UEChMKQ2VydGlub21pczEXMBUGA1UECxMOMDAwMiA0MzM5OTg5MDMxHTAb
-BgNVBAMTFENlcnRpbm9taXMgLSBSb290IENBMB4XDTEzMTAyMTA5MTcxOFoXDTMz
-MTAyMTA5MTcxOFowWjELMAkGA1UEBhMCRlIxEzARBgNVBAoTCkNlcnRpbm9taXMx
-FzAVBgNVBAsTDjAwMDIgNDMzOTk4OTAzMR0wGwYDVQQDExRDZXJ0aW5vbWlzIC0g
-Um9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANTMCQosP5L2
-fxSeC5yaah1AMGT9qt8OHgZbn1CF6s2Nq0Nn3rD6foCWnoR4kkjW4znuzuRZWJfl
-LieY6pOod5tK8O90gC3rMB+12ceAnGInkYjwSond3IjmFPnVAy//ldu9n+ws+hQV
-WZUKxkd8aRi5pwP5ynapz8dvtF4F/u7BUrJ1Mofs7SlmO/NKFoL21prbcpjp3vDF
-TKWrteoB4owuZH9kb/2jJZOLyKIOSY008B/sWEUuNKqEUL3nskoTuLAPrjhdsKkb
-5nPJWqHZZkCqqU2mNAKthH6yI8H7KsZn9DS2sJVqM09xRLWtwHkziOC/7aOgFLSc
-CbAK42C++PhmiM1b8XcF4LVzbsF9Ri6OSyemzTUK/eVNfaoqoynHWmgE6OXWk6Ri
-wsXm9E/G+Z8ajYJJGYrKWUM66A0ywfRMEwNvbqY/kXPLynNvEiCL7sCCeN5LLsJJ
-wx3tFvYk9CcbXFcx3FXuqB5vbKziRcxXV4p1VxngtViZSTYxPDMBbRZKzbgqg4SG
-m/lg0h9tkQPTYKbVPZrdd5A9NaSfD171UkRpucC63M9933zZxKyGIjK8e2uR73r4
-F2iw4lNVYC2vPsKD2NkJK/DAZNuHi5HMkesE/Xa0lZrmFAYb1TQdvtj/dBxThZng
-WVJKYe2InmtJiUZ+IFrZ50rlau7SZRFDAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIB
-BjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTvkUz1pcMw6C8I6tNxIqSSaHh0
-2TAfBgNVHSMEGDAWgBTvkUz1pcMw6C8I6tNxIqSSaHh02TANBgkqhkiG9w0BAQsF
-AAOCAgEAfj1U2iJdGlg+O1QnurrMyOMaauo++RLrVl89UM7g6kgmJs95Vn6RHJk/
-0KGRHCwPT5iVWVO90CLYiF2cN/z7ZMF4jIuaYAnq1fohX9B0ZedQxb8uuQsLrbWw
-F6YSjNRieOpWauwK0kDDPAUwPk2Ut59KA9N9J0u2/kTO+hkzGm2kQtHdzMjI1xZS
-g081lLMSVX3l4kLr5JyTCcBMWwerx20RoFAXlCOotQqSD7J6wWAsOMwaplv/8gzj
-qh8c3LigkyfeY+N/IZ865Z764BNqdeuWXGKRlI5nU7aJ+BIJy29SWwNyhlCVCNSN
-h4YVH5Uk2KRvms6knZtt0rJ2BobGVgjF6wnaNsIbW0G+YSrjcOa4pvi2WsS9Iff/
-ql+hbHY5ZtbqTFXhADObE5hjyW/QASAJN1LnDE8+zbz1X5YnpyACleAu6AdBBR8V
-btaw5BngDwKTACdyxYvRVB9dSsNAl35VpnzBMwQUAR1JIGkLGZOdblgi90AMRgwj
-Y/M50n92Uaf0yKHxDHYiI0ZSKS3io0EHVmmY0gUJvGnHWmHNj4FgFU2A3ZDifcRQ
-8ow7bkrHxuaAKzyBvBGAFhAn1/DNP3nMcyrDflOR1m749fPH0FFNjkulW+YZFzvW
-gQncItzujrnEj1PhZ7szuIgVRs/taTX/dQ1G885x4cVrhkIGuUE=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDkjCCAnqgAwIBAgIRAIW9S/PY2uNp9pTXX8OlRCMwDQYJKoZIhvcNAQEFBQAw
-PTELMAkGA1UEBhMCRlIxETAPBgNVBAoTCENlcnRwbHVzMRswGQYDVQQDExJDbGFz
-cyAyIFByaW1hcnkgQ0EwHhcNOTkwNzA3MTcwNTAwWhcNMTkwNzA2MjM1OTU5WjA9
-MQswCQYDVQQGEwJGUjERMA8GA1UEChMIQ2VydHBsdXMxGzAZBgNVBAMTEkNsYXNz
-IDIgUHJpbWFyeSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxQ
-ltAS+DXSCHh6tlJw/W/uz7kRy1134ezpfgSN1sxvc0NXYKwzCkTsA18cgCSR5aiR
-VhKC9+Ar9NuuYS6JEI1rbLqzAr3VNsVINyPi8Fo3UjMXEuLRYE2+L0ER4/YXJQyL
-kcAbmXuZVg2v7tK8R1fjeUl7NIknJITesezpWE7+Tt9avkGtrAjFGA7v0lPubNCd
-EgETjdyAYveVqUSISnFOYFWe2yMZeVYHDD9jC1yw4r5+FfyUM1hBOHTE4Y+L3yas
-H7WLO7dDWWuwJKZtkIvEcupdM5i3y95ee++U8Rs+yskhwcWYAqqi9lt3m/V+llU0
-HGdpwPFC40es/CgcZlUCAwEAAaOBjDCBiTAPBgNVHRMECDAGAQH/AgEKMAsGA1Ud
-DwQEAwIBBjAdBgNVHQ4EFgQU43Mt38sOKAze3bOkynm4jrvoMIkwEQYJYIZIAYb4
-QgEBBAQDAgEGMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly93d3cuY2VydHBsdXMu
-Y29tL0NSTC9jbGFzczIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQCnVM+IRBnL39R/
-AN9WM2K191EBkOvDP9GIROkkXe/nFL0gt5o8AP5tn9uQ3Nf0YtaLcF3n5QRIqWh8
-yfFC82x/xXp8HVGIutIKPidd3i1RTtMTZGnkLuPT55sJmabglZvOGtd/vjzOUrMR
-FcEPF80Du5wlFbqidon8BvEY0JNLDnyCt6X09l/+7UCmnYR0ObncHoUW2ikbhiMA
-ybuJfm6AiB4vFLQDJKgybwOaRywwvlbGp0ICcBvqQNi6BQNwB6SW//1IMwrh3KWB
-kJtN3X3n57LNXMhqlfil9o3EXXgIvnsG1knPGTZQIy4I5p4FTUcY1Rbpsda2ENW7
-l7+ijrRU
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDDDCCAfSgAwIBAgIDAQAgMA0GCSqGSIb3DQEBBQUAMD4xCzAJBgNVBAYTAlBM
-MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD
-QTAeFw0wMjA2MTExMDQ2MzlaFw0yNzA2MTExMDQ2MzlaMD4xCzAJBgNVBAYTAlBM
-MRswGQYDVQQKExJVbml6ZXRvIFNwLiB6IG8uby4xEjAQBgNVBAMTCUNlcnR1bSBD
-QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM6xwS7TT3zNJc4YPk/E
-jG+AanPIW1H4m9LcuwBcsaD8dQPugfCI7iNS6eYVM42sLQnFdvkrOYCJ5JdLkKWo
-ePhzQ3ukYbDYWMzhbGZ+nPMJXlVjhNWo7/OxLjBos8Q82KxujZlakE403Daaj4GI
-ULdtlkIJ89eVgw1BS7Bqa/j8D35in2fE7SZfECYPCE/wpFcozo+47UX2bu4lXapu
-Ob7kky/ZR6By6/qmW6/KUz/iDsaWVhFu9+lmqSbYf5VT7QqFiLpPKaVCjF62/IUg
-AKpoC6EahQGcxEZjgoi2IrHu/qpGWX7PNSzVttpd90gzFFS269lvzs2I1qsb2pY7
-HVkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEA
-uI3O7+cUus/usESSbLQ5PqKEbq24IXfS1HeCh+YgQYHu4vgRt2PRFze+GXYkHAQa
-TOs9qmdvLdTN/mUxcMUbpgIKumB7bVjCmkn+YzILa+M6wKyrO7Do0wlRjBCDxjTg
-xSvgGrZgFCdsMneMvLJymM/NzD+5yCRCFNZX/OYmQ6kd5YCQzgNUKD73P9P4Te1q
-CjqTE5s7FCMTY5w/0YcneeVMUeMBrYVdGjux1XMQpNPyvG5k9VpWkKjHDkx0Dy5x
-O/fIR/RpbxXyEV6DHpx8Uq79AtoSqFlnGNu8cN2bsWntgM6JQEhqDjXKKWYVIZQs
-6GAqm4VKQPNriiTsBhYscw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDuzCCAqOgAwIBAgIDBETAMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAlBM
-MSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5D
-ZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBU
-cnVzdGVkIE5ldHdvcmsgQ0EwHhcNMDgxMDIyMTIwNzM3WhcNMjkxMjMxMTIwNzM3
-WjB+MQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg
-Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIw
-IAYDVQQDExlDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBMIIBIjANBgkqhkiG9w0B
-AQEFAAOCAQ8AMIIBCgKCAQEA4/t9o3K6wvDJFIf1awFO4W5AB7ptJ11/91sts1rH
-UV+rpDKmYYe2bg+G0jACl/jXaVehGDldamR5xgFZrDwxSjh80gTSSyjoIF87B6LM
-TXPb865Px1bVWqeWifrzq2jUI4ZZJ88JJ7ysbnKDHDBy3+Ci6dLhdHUZvSqeexVU
-BBvXQzmtVSjF4hq79MDkrjhJM8x2hZ85RdKknvISjFH4fOQtf/WsX+sWn7Et0brM
-kUJ3TCXJkDhv2/DM+44el1k+1WBO5gUo7Ul5E0u6SNsv+XLTOcr+H9g0cvW0QM8x
-AcPs3hEtF10fuFDRXhmnad4HMyjKUJX5p1TLVIZQRan5SQIDAQABo0IwQDAPBgNV
-HRMBAf8EBTADAQH/MB0GA1UdDgQWBBQIds3LB/8k9sXN7buQvOKEN0Z19zAOBgNV
-HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEFBQADggEBAKaorSLOAT2mo/9i0Eidi15y
-sHhE49wcrwn9I0j6vSrEuVUEtRCjjSfeC4Jj0O7eDDd5QVsisrCaQVymcODU0HfL
-I9MA4GxWL+FpDQ3Zqr8hgVDZBqWo/5U30Kr+4rP1mS1FhIrlQgnXdAIv94nYmem8
-J9RHjboNRhx3zxSkHLmkMcScKHQDNP8zGSal6Q10tz6XxnboJ5ajZt3hrvJBW8qY
-VoNzcOSGGtIxQbovvi0TWnZvTuhOgQ4/WwMioBK+ZlgRSssDxLQqKi2WF+A5VLxI
-03YnnZotBqbJ7DnSq9ufmgsnAjUpsUCV5/nonFWIGUbWtzT1fs45mtk48VH3Tyw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF0jCCA7qgAwIBAgIQIdbQSk8lD8kyN/yqXhKN6TANBgkqhkiG9w0BAQ0FADCB
-gDELMAkGA1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMu
-QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIG
-A1UEAxMbQ2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMCIYDzIwMTExMDA2MDgz
-OTU2WhgPMjA0NjEwMDYwODM5NTZaMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZ
-VW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRp
-ZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3
-b3JrIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9+Xj45tWA
-DGSdhhuWZGc/IjoedQF97/tcZ4zJzFxrqZHmuULlIEub2pt7uZld2ZuAS9eEQCsn
-0+i6MLs+CRqnSZXvK0AkwpfHp+6bJe+oCgCXhVqqndwpyeI1B+twTUrWwbNWuKFB
-OJvR+zF/j+Bf4bE/D44WSWDXBo0Y+aomEKsq09DRZ40bRr5HMNUuctHFY9rnY3lE
-fktjJImGLjQ/KUxSiyqnwOKRKIm5wFv5HdnnJ63/mgKXwcZQkpsCLL2puTRZCr+E
-Sv/f/rOf69me4Jgj7KZrdxYq28ytOxykh9xGc14ZYmhFV+SQgkK7QtbwYeDBoz1m
-o130GO6IyY0XRSmZMnUCMe4pJshrAua1YkV/NxVaI2iJ1D7eTiew8EAMvE0Xy02i
-sx7QBlrd9pPPV3WZ9fqGGmd4s7+W/jTcvedSVuWz5XV710GRBdxdaeOVDUO5/IOW
-OZV7bIBaTxNyxtd9KXpEulKkKtVBRgkg/iKgtlswjbyJDNXXcPiHUv3a76xRLgez
-Tv7QCdpw75j6VuZt27VXS9zlLCUVyJ4ueE742pyehizKV/Ma5ciSixqClnrDvFAS
-adgOWkaLOusm+iPJtrCBvkIApPjW/jAux9JG9uWOdf3yzLnQh1vMBhBgu4M1t15n
-3kfsmUjxpKEV/q2MYo45VU85FrmxY53/twIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
-AQH/MB0GA1UdDgQWBBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMC
-AQYwDQYJKoZIhvcNAQENBQADggIBAHGlDs7k6b8/ONWJWsQCYftMxRQXLYtPU2sQ
-F/xlhMcQSZDe28cmk4gmb3DWAl45oPePq5a1pRNcgRRtDoGCERuKTsZPpd1iHkTf
-CVn0W3cLN+mLIMb4Ck4uWBzrM9DPhmDJ2vuAL55MYIR4PSFk1vtBHxgP58l1cb29
-XN40hz5BsA72udY/CROWFC/emh1auVbONTqwX3BNXuMp8SMoclm2q8KMZiYcdywm
-djWLKKdpoPk79SPdhRB0yZADVpHnr7pH1BKXESLjokmUbOe3lEu6LaTaM4tMpkT/
-WjzGHWTYtTHkpjx6qFcL2+1hGsvxznN3Y6SHb0xRONbkX8eftoEq5IVIeVheO/jb
-AoJnwTnbw3RLPTYe+SmTiGhbqEQZIfCn6IENLOiTNrQ3ssqwGyZ6miUfmpqAnksq
-P/ujmv5zMnHCnsZy4YpoJ/HkD7TETKVhk/iXEAcqMCWpuchxuO9ozC1+9eB+D4Ko
-b7a6bINDd82Kkhehnlt4Fj1F4jNy3eFmypnTycUm/Q1oBEauttmbjL4ZvrHG8hnj
-XALKLNhvSgfZyTXaQHXyxKcZb55CEJh15pWLYLztxRLXis7VmFxWlgPF7ncGNf/P
-5O4/E2Hu29othfDNrp2yGAlFw5Khchf8R7agCyzxxN5DaAhqXzvwdmP7zAYspsbi
-DrW5viSP
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIHTzCCBTegAwIBAgIJAKPaQn6ksa7aMA0GCSqGSIb3DQEBBQUAMIGuMQswCQYD
-VQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBhZGRyZXNzIGF0
-IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJQTgyNzQzMjg3
-MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMTIENoYW1iZXJz
-IG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4MB4XDTA4MDgwMTEyMjk1MFoXDTM4MDcz
-MTEyMjk1MFowga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBj
-dXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIw
-EAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEp
-MCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAtIDIwMDgwggIiMA0G
-CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCvAMtwNyuAWko6bHiUfaN/Gh/2NdW9
-28sNRHI+JrKQUrpjOyhYb6WzbZSm891kDFX29ufyIiKAXuFixrYp4YFs8r/lfTJq
-VKAyGVn+H4vXPWCGhSRv4xGzdz4gljUha7MI2XAuZPeEklPWDrCQiorjh40G072Q
-DuKZoRuGDtqaCrsLYVAGUvGef3bsyw/QHg3PmTA9HMRFEFis1tPo1+XqxQEHd9ZR
-5gN/ikilTWh1uem8nk4ZcfUyS5xtYBkL+8ydddy/Js2Pk3g5eXNeJQ7KXOt3EgfL
-ZEFHcpOrUMPrCXZkNNI5t3YRCQ12RcSprj1qr7V9ZS+UWBDsXHyvfuK2GNnQm05a
-Sd+pZgvMPMZ4fKecHePOjlO+Bd5gD2vlGts/4+EhySnB8esHnFIbAURRPHsl18Tl
-UlRdJQfKFiC4reRB7noI/plvg6aRArBsNlVq5331lubKgdaX8ZSD6e2wsWsSaR6s
-+12pxZjptFtYer49okQ6Y1nUCyXeG0+95QGezdIp1Z8XGQpvvwyQ0wlf2eOKNcx5
-Wk0ZN5K3xMGtr/R5JJqyAQuxr1yW84Ay+1w9mPGgP0revq+ULtlVmhduYJ1jbLhj
-ya6BXBg14JC7vjxPNyK5fuvPnnchpj04gftI2jE9K+OJ9dC1vX7gUMQSibMjmhAx
-hduub+84Mxh2EQIDAQABo4IBbDCCAWgwEgYDVR0TAQH/BAgwBgEB/wIBDDAdBgNV
-HQ4EFgQU+SSsD7K1+HnA+mCIG8TZTQKeFxkwgeMGA1UdIwSB2zCB2IAU+SSsD7K1
-+HnA+mCIG8TZTQKeFxmhgbSkgbEwga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpN
-YWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29t
-L2FkZHJlc3MpMRIwEAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVy
-ZmlybWEgUy5BLjEpMCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAt
-IDIwMDiCCQCj2kJ+pLGu2jAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRV
-HSAAMCowKAYIKwYBBQUHAgEWHGh0dHA6Ly9wb2xpY3kuY2FtZXJmaXJtYS5jb20w
-DQYJKoZIhvcNAQEFBQADggIBAJASryI1wqM58C7e6bXpeHxIvj99RZJe6dqxGfwW
-PJ+0W2aeaufDuV2I6A+tzyMP3iU6XsxPpcG1Lawk0lgH3qLPaYRgM+gQDROpI9CF
-5Y57pp49chNyM/WqfcZjHwj0/gF/JM8rLFQJ3uIrbZLGOU8W6jx+ekbURWpGqOt1
-glanq6B8aBMz9p0w8G8nOSQjKpD9kCk18pPfNKXG9/jvjA9iSnyu0/VU+I22mlaH
-FoI6M6taIgj3grrqLuBHmrS1RaMFO9ncLkVAO+rcf+g769HsJtg1pDDFOqxXnrN2
-pSB7+R5KBWIBpih1YJeSDW4+TTdDDZIVnBgizVGZoCkaPF+KMjNbMMeJL0eYD6MD
-xvbxrN8y8NmBGuScvfaAFPDRLLmF9dijscilIeUcE5fuDr3fKanvNFNb0+RqE4QG
-tjICxFKuItLcsiFCGtpA8CnJ7AoMXOLQusxI0zcKzBIKinmwPQN/aUv0NCB9szTq
-jktk9T79syNnFQ0EuPAtwQlRPLJsFfClI9eDdOTlLsn+mCdCxqvGnrDQWzilm1De
-fhiYtUU79nm06PcaewaD+9CL2rvHvRirCG88gGtAPxkZumWK5r7VXNM21+9AUiRg
-OGcEMeyP84LG3rlV8zsxkVrctQgVrXYlCg17LofiDKYGvCYQbTed7N14jHyAxfDZ
-d0jQ
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
-MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
-GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
-YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
-MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
-BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
-GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
-BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
-3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
-YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
-rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
-ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
-oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
-MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
-QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
-b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
-AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
-GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
-Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
-G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
-l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
-smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDoTCCAomgAwIBAgILBAAAAAABD4WqLUgwDQYJKoZIhvcNAQEFBQAwOzEYMBYG
-A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh
-bCBSb290MB4XDTA2MTIxNTA4MDAwMFoXDTIxMTIxNTA4MDAwMFowOzEYMBYGA1UE
-ChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2JhbCBS
-b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+Mi8vRRQZhP/8NN5
-7CPytxrHjoXxEnOmGaoQ25yiZXRadz5RfVb23CO21O1fWLE3TdVJDm71aofW0ozS
-J8bi/zafmGWgE07GKmSb1ZASzxQG9Dvj1Ci+6A74q05IlG2OlTEQXO2iLb3VOm2y
-HLtgwEZLAfVJrn5GitB0jaEMAs7u/OePuGtm839EAL9mJRQr3RAwHQeWP032a7iP
-t3sMpTjr3kfb1V05/Iin89cqdPHoWqI7n1C6poxFNcJQZZXcY4Lv3b93TZxiyWNz
-FtApD0mpSPCzqrdsxacwOUBdrsTiXSZT8M4cIwhhqJQZugRiQOwfOHB3EgZxpzAY
-XSUnpQIDAQABo4GlMIGiMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/
-MB0GA1UdDgQWBBS2CHsNesysIEyGVjJez6tuhS1wVzA/BgNVHR8EODA2MDSgMqAw
-hi5odHRwOi8vd3d3Mi5wdWJsaWMtdHJ1c3QuY29tL2NybC9jdC9jdHJvb3QuY3Js
-MB8GA1UdIwQYMBaAFLYIew16zKwgTIZWMl7Pq26FLXBXMA0GCSqGSIb3DQEBBQUA
-A4IBAQBW7wojoFROlZfJ+InaRcHUowAl9B8Tq7ejhVhpwjCt2BWKLePJzYFa+HMj
-Wqd8BfP9IjsO0QbE2zZMcwSO5bAi5MXzLqXZI+O4Tkogp24CJJ8iYGd7ix1yCcUx
-XOl5n4BHPa2hCwcUPUf/A2kaDAtE52Mlp3+yybh2hO0j9n0Hq0V+09+zv+mKts2o
-omcrUtW3ZfA5TGOgkXmTUg9U3YO7n9GPp1Nzw8v/MOx8BLjYRB+TX3EJIrduPuoc
-A06dGiBh+4E37F78CkWr1+cXVdCg6mCbpvbjjFspwgZgFJ0tl0ypkxWdYcQBX0jW
-WL1WMRJOEcgh4LMRkWXbtKaIOM5V
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEDjCCAvagAwIBAgIDD92sMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkRF
-MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxHzAdBgNVBAMMFkQtVFJVU1QgUm9vdCBD
-QSAzIDIwMTMwHhcNMTMwOTIwMDgyNTUxWhcNMjgwOTIwMDgyNTUxWjBFMQswCQYD
-VQQGEwJERTEVMBMGA1UECgwMRC1UcnVzdCBHbWJIMR8wHQYDVQQDDBZELVRSVVNU
-IFJvb3QgQ0EgMyAyMDEzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
-xHtCkoIf7O1UmI4SwMoJ35NuOpNcG+QQd55OaYhs9uFp8vabomGxvQcgdJhl8Ywm
-CM2oNcqANtFjbehEeoLDbF7eu+g20sRoNoyfMr2EIuDcwu4QRjltr5M5rofmw7wJ
-ySxrZ1vZm3Z1TAvgu8XXvD558l++0ZBX+a72Zl8xv9Ntj6e6SvMjZbu376Ml1wrq
-WLbviPr6ebJSWNXwrIyhUXQplapRO5AyA58ccnSQ3j3tYdLl4/1kR+W5t0qp9x+u
-loYErC/jpIF3t1oW/9gPP/a3eMykr/pbPBJbqFKJcu+I89VEgYaVI5973bzZNO98
-lDyqwEHC451QGsDkGSL8swIDAQABo4IBBTCCAQEwDwYDVR0TAQH/BAUwAwEB/zAd
-BgNVHQ4EFgQUP5DIfccVb/Mkj6nDL0uiDyGyL+cwDgYDVR0PAQH/BAQDAgEGMIG+
-BgNVHR8EgbYwgbMwdKByoHCGbmxkYXA6Ly9kaXJlY3RvcnkuZC10cnVzdC5uZXQv
-Q049RC1UUlVTVCUyMFJvb3QlMjBDQSUyMDMlMjAyMDEzLE89RC1UcnVzdCUyMEdt
-YkgsQz1ERT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0MDugOaA3hjVodHRwOi8v
-Y3JsLmQtdHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2FfM18yMDEzLmNybDAN
-BgkqhkiG9w0BAQsFAAOCAQEADlkOWOR0SCNEzzQhtZwUGq2aS7eziG1cqRdw8Cqf
-jXv5e4X6xznoEAiwNStfzwLS05zICx7uBVSuN5MECX1sj8J0vPgclL4xAUAt8yQg
-t4RVLFzI9XRKEBmLo8ftNdYJSNMOwLo5qLBGArDbxohZwr78e7Erz35ih1WWzAFv
-m2chlTWL+BD8cRu3SzdppjvW7IvuwbDzJcmPkn2h6sPKRL8mpXSSnON065102ctN
-h9j8tGlsi6BDB2B4l+nZk3zCRrybN1Kj7Yo8E6l7U0tJmhEFLAtuVqwfLoJs4Gln
-tQ5tLdnkwBXxP/oYcuEVbSdbLTAoK59ImmQrme/ydUlfXA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
-MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
-bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NTha
-ME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMM
-HkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOADER03
-UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42
-tSHKXzlABF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9R
-ySPocq60vFYJfxLLHLGvKZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsM
-lFqVlNpQmvH/pStmMaTJOKDfHR+4CS7zp+hnUquVH+BGPtikw8paxTGA6Eian5Rp
-/hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUCAwEAAaOCARowggEWMA8G
-A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ4PGEMA4G
-A1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVj
-dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUy
-MENBJTIwMiUyMDIwMDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRl
-cmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js
-L2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL
-BQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni
-acfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0
-o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4K
-zCUqNQT4YJEVdT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8
-PIWmawomDeCTmGCufsYkl4phX5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3Y
-Johw1+qRzT65ysCQblrGXnRl11z+o+I=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEQzCCAyugAwIBAgIDCYP0MA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkRF
-MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBD
-bGFzcyAzIENBIDIgRVYgMjAwOTAeFw0wOTExMDUwODUwNDZaFw0yOTExMDUwODUw
-NDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV
-BAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn
-ljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JUut8Mxk2og+KbgPCdM0
-3TP1YtHhzRnp7hhPTFiu4h7WDFsVWtg6uMQYZB7jM7K1iXdODL/ZlGsTl28So/6Z
-qQTMFexgaDbtCHu39b+T7WYxg4zGcTSHThfqr4uRjRxWQa4iN1438h3Z0S0NL2lR
-p75mpoo6Kr3HGrHhFPC+Oh25z1uxav60sUYgovseO3Dvk5h9jHOW8sXvhXCtKSb8
-HgQ+HKDYD8tSg2J87otTlZCpV6LqYQXY+U3EJ/pure3511H3a6UCAwEAAaOCASQw
-ggEgMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNOUikxiEyoZLsyvcop9Ntea
-HNxnMA4GA1UdDwEB/wQEAwIBBjCB3QYDVR0fBIHVMIHSMIGHoIGEoIGBhn9sZGFw
-Oi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xh
-c3MlMjAzJTIwQ0ElMjAyJTIwRVYlMjAyMDA5LE89RC1UcnVzdCUyMEdtYkgsQz1E
-RT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0MEagRKBChkBodHRwOi8vd3d3LmQt
-dHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2xhc3NfM19jYV8yX2V2XzIwMDku
-Y3JsMA0GCSqGSIb3DQEBCwUAA4IBAQA07XtaPKSUiO8aEXUHL7P+PPoeUSbrh/Yp
-3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05
-nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNF
-CSuGdXzfX2lXANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7na
-xpeG0ILD5EJt/rDiZE4OJudANCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqX
-KVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVvw9y4AyHqnxbxLFS1
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
-MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
-DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
-PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
-Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
-rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
-OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
-xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
-7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
-aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
-HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
-SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
-ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
-AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
-R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
-JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
-Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDnzCCAoegAwIBAgIBJjANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJERTEc
-MBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxlU2Vj
-IFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290IENB
-IDIwHhcNOTkwNzA5MTIxMTAwWhcNMTkwNzA5MjM1OTAwWjBxMQswCQYDVQQGEwJE
-RTEcMBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxl
-U2VjIFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290
-IENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrC6M14IspFLEU
-ha88EOQ5bzVdSq7d6mGNlUn0b2SjGmBmpKlAIoTZ1KXleJMOaAGtuU1cOs7TuKhC
-QN/Po7qCWWqSG6wcmtoIKyUn+WkjR/Hg6yx6m/UTAtB+NHzCnjwAWav12gz1Mjwr
-rFDa1sPeg5TKqAyZMg4ISFZbavva4VhYAUlfckE8FQYBjl2tqriTtM2e66foai1S
-NNs671x1Udrb8zH57nGYMsRUFUQM+ZtV7a3fGAigo4aKSe5TBY8ZTNXeWHmb0moc
-QqvF1afPaA+W5OFhmHZhyJF81j4A4pFQh+GdCuatl9Idxjp9y7zaAzTVjlsB9WoH
-txa2bkp/AgMBAAGjQjBAMB0GA1UdDgQWBBQxw3kbuvVT1xfgiXotF2wKsyudMzAP
-BgNVHRMECDAGAQH/AgEFMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC
-AQEAlGRZrTlk5ynrE/5aw4sTV8gEJPB0d8Bg42f76Ymmg7+Wgnxu1MM9756Abrsp
-tJh6sTtU6zkXR34ajgv8HzFZMQSyzhfzLMdiNlXiItiJVbSYSKpk+tYcNthEeFpa
-IzpXl/V6ME+un2pMSyuOoAPjPuCp1NJ70rOo4nI8rZ7/gFnkm0W09juwzTkZmDLl
-6iFhkOQxIY40sfcvNUqFENrnijchvllj4PKFiDFT1FQUhXB59C4Gdyd1Lx+4ivn+
-xbrYNuSD7Odlt79jWvNGr4GUN9RBjNYj1h7P9WgbRGOiWrqnNVmh5XAFmw4jV5mU
-Cm26OWMohpLzGITY+9HPBVZkVw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
-b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG
-EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
-cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c
-JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP
-mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+
-wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4
-VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/
-AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB
-AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun
-pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC
-dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf
-fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm
-NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx
-H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
-+o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDljCCAn6gAwIBAgIQC5McOtY5Z+pnI7/Dr5r0SzANBgkqhkiG9w0BAQsFADBl
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
-b3QgRzIwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQG
-EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
-cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ5ygvUj82ckmIkzTz+GoeMVSA
-n61UQbVH35ao1K+ALbkKz3X9iaV9JPrjIgwrvJUXCzO/GU1BBpAAvQxNEP4Htecc
-biJVMWWXvdMX0h5i89vqbFCMP4QMls+3ywPgym2hFEwbid3tALBSfK+RbLE4E9Hp
-EgjAALAcKxHad3A2m67OeYfcgnDmCXRwVWmvo2ifv922ebPynXApVfSr/5Vh88lA
-bx3RvpO704gqu52/clpWcTs/1PPRCv4o76Pu2ZmvA9OPYLfykqGxvYmJHzDNw6Yu
-YjOuFgJ3RFrngQo8p0Quebg/BLxcoIfhG69Rjs3sLPr4/m3wOnyqi+RnlTGNAgMB
-AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQW
-BBTOw0q5mVXyuNtgv6l+vVa1lzan1jANBgkqhkiG9w0BAQsFAAOCAQEAyqVVjOPI
-QW5pJ6d1Ee88hjZv0p3GeDgdaZaikmkuOGybfQTUiaWxMTeKySHMq2zNixya1r9I
-0jJmwYrA8y8678Dj1JGG0VDjA9tzd29KOVPt3ibHtX2vK0LRdWLjSisCx1BL4Gni
-lmwORGYQRI+tBev4eaymG+g3NJ1TyWGqolKvSnAWhsI6yLETcDbYz+70CjTVW0z9
-B5yiutkBclzzTcHdDrEcDcRjvq30FPuJ7KJBDkzMyFdA0G4Dqs0MjomZmWzwPDCv
-ON9vvKO+KSAnq3T/EyJ43pdSVR6DtVQgA+6uwE9W3jfMw3+qBCe703e4YtsXfJwo
-IhNzbM8m9Yop5w==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICRjCCAc2gAwIBAgIQC6Fa+h3foLVJRK/NJKBs7DAKBggqhkjOPQQDAzBlMQsw
-CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu
-ZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3Qg
-RzMwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQGEwJV
-UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
-Y29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzMwdjAQBgcq
-hkjOPQIBBgUrgQQAIgNiAAQZ57ysRGXtzbg/WPuNsVepRC0FFfLvC/8QdJ+1YlJf
-Zn4f5dwbRXkLzMZTCp2NXQLZqVneAlr2lSoOjThKiknGvMYDOAdfVdp+CW7if17Q
-RSAPWXYQ1qAk8C3eNvJsKTmjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
-BAQDAgGGMB0GA1UdDgQWBBTL0L2p4ZgFUaFNN6KDec6NHSrkhDAKBggqhkjOPQQD
-AwNnADBkAjAlpIFFAmsSS3V0T8gj43DydXLefInwz5FyYZ5eEJJZVrmDxxDnOOlY
-JjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy1vUhZscv
-6pZjamVFkpUBtA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
-QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
-MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
-b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
-CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
-nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
-43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
-T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
-gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
-BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
-TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
-DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
-hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
-06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
-PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
-YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
-CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
-MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT
-MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
-b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI
-2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx
-1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ
-q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz
-tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ
-vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV
-5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY
-1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4
-NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG
-Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91
-8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe
-pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
-MrY=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICPzCCAcWgAwIBAgIQBVVWvPJepDU1w6QP1atFcjAKBggqhkjOPQQDAzBhMQsw
-CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu
-ZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMzAe
-Fw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUw
-EwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x
-IDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEczMHYwEAYHKoZIzj0CAQYF
-K4EEACIDYgAE3afZu4q4C/sLfyHS8L6+c/MzXRq8NOrexpu80JX28MzQC7phW1FG
-fp4tn+6OYwwX7Adw9c+ELkCDnOg/QW07rdOkFFk2eJ0DQ+4QE2xy3q6Ip6FrtUPO
-Z9wj/wMco+I+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAd
-BgNVHQ4EFgQUs9tIpPmhxdiuNkHMEWNpYim8S8YwCgYIKoZIzj0EAwMDaAAwZQIx
-AK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y3maTD/HMsQmP3Wyr+mt/
-oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8
-sycX
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
-+OkuE6N36B9K
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
-RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
-UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
-Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
-ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
-xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
-ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
-DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
-jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
-CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
-EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
-fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
-uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
-chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
-9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
-hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
-ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
-SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
-+SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
-fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
-sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
-cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
-0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
-4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
-r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
-/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
-gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNV
-BAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBC
-aWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNV
-BAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQDDB9FLVR1
-Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMwNTEyMDk0OFoXDTIz
-MDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+
-BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhp
-em1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN
-ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4vU/kwVRHoViVF56C/UY
-B4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vdhQd2h8y/L5VMzH2nPbxH
-D5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5KCKpbknSF
-Q9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEo
-q1+gElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3D
-k14opz8n8Y4e0ypQBaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcH
-fC425lAcP9tDJMW/hkd5s3kc91r0E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsut
-dEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gzrt48Ue7LE3wBf4QOXVGUnhMM
-ti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAqjqFGOjGY5RH8
-zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn
-rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUX
-U8u3Zg5mTPj5dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6
-Jyr+zE7S6E5UMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5
-XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAF
-Nzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAKkEh47U6YA5n+KGCR
-HTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jOXKqY
-GwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c
-77NCR807VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3
-+GbHeJAAFS6LrVE1Uweoa2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WK
-vJUawSg5TB9D0pH0clmKuVb8P7Sd2nCcdlqMQ1DujjByTd//SffGqWfZbawCEeI6
-FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEVKV0jq9BgoRJP3vQXzTLl
-yb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gTDx4JnW2P
-AJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpD
-y4Q08ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8d
-NL/+I5c30jn6PQ0GC7TbO6Orb1wdtn7os4I07QZcJA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFVjCCBD6gAwIBAgIQ7is969Qh3hSoYqwE893EATANBgkqhkiG9w0BAQUFADCB
-8zELMAkGA1UEBhMCRVMxOzA5BgNVBAoTMkFnZW5jaWEgQ2F0YWxhbmEgZGUgQ2Vy
-dGlmaWNhY2lvIChOSUYgUS0wODAxMTc2LUkpMSgwJgYDVQQLEx9TZXJ2ZWlzIFB1
-YmxpY3MgZGUgQ2VydGlmaWNhY2lvMTUwMwYDVQQLEyxWZWdldSBodHRwczovL3d3
-dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbCAoYykwMzE1MDMGA1UECxMsSmVyYXJxdWlh
-IEVudGl0YXRzIGRlIENlcnRpZmljYWNpbyBDYXRhbGFuZXMxDzANBgNVBAMTBkVD
-LUFDQzAeFw0wMzAxMDcyMzAwMDBaFw0zMTAxMDcyMjU5NTlaMIHzMQswCQYDVQQG
-EwJFUzE7MDkGA1UEChMyQWdlbmNpYSBDYXRhbGFuYSBkZSBDZXJ0aWZpY2FjaW8g
-KE5JRiBRLTA4MDExNzYtSSkxKDAmBgNVBAsTH1NlcnZlaXMgUHVibGljcyBkZSBD
-ZXJ0aWZpY2FjaW8xNTAzBgNVBAsTLFZlZ2V1IGh0dHBzOi8vd3d3LmNhdGNlcnQu
-bmV0L3ZlcmFycmVsIChjKTAzMTUwMwYDVQQLEyxKZXJhcnF1aWEgRW50aXRhdHMg
-ZGUgQ2VydGlmaWNhY2lvIENhdGFsYW5lczEPMA0GA1UEAxMGRUMtQUNDMIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyLHT+KXQpWIR4NA9h0X84NzJB5R
-85iKw5K4/0CQBXCHYMkAqbWUZRkiFRfCQ2xmRJoNBD45b6VLeqpjt4pEndljkYRm
-4CgPukLjbo73FCeTae6RDqNfDrHrZqJyTxIThmV6PttPB/SnCWDaOkKZx7J/sxaV
-HMf5NLWUhdWZXqBIoH7nF2W4onW4HvPlQn2v7fOKSGRdghST2MDk/7NQcvJ29rNd
-QlB50JQ+awwAvthrDk4q7D7SzIKiGGUzE3eeml0aE9jD2z3Il3rucO2n5nzbcc8t
-lGLfbdb1OL4/pYUKGbio2Al1QnDE6u/LDsg0qBIimAy4E5S2S+zw0JDnJwIDAQAB
-o4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4
-opvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo
-dHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAjApGidW
-ZWdldSBodHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbCAwDQYJKoZIhvcN
-AQEFBQADggEBAKBIW4IB9k1IuDlVNZyAelOZ1Vr/sXE7zDkJlF7W2u++AVtd0x7Y
-/X1PzaBB4DSTv8vihpw3kpBWHNzrKQXlxJ7HNd+KDM3FIUPpqojlNcAZQmNaAl6k
-SBg6hW/cnbw/nZzBh7h6YQjpdwt/cKt63dmXLGQehb+8dJahw3oS7AwaboMMPOhy
-Rp/7SNVel+axofjk70YllJyJ22k4vuxcDlbHZVHlUIiIv0LVKz3l+bqeLrPK9HOS
-Agu+TGbrIP65y7WZf+a2E/rKS03Z7lNGBjvGTq2TWoF+bCpLagVFjPIhpDGQh2xl
-nJ2lYJU6Un/10asIbvPuW/mIPX64b24D5EI=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEAzCCAuugAwIBAgIQVID5oHPtPwBMyonY43HmSjANBgkqhkiG9w0BAQUFADB1
-MQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1
-czEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG
-CSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy
-MTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aWZpdHNl
-ZXJpbWlza2Vza3VzMSgwJgYDVQQDDB9FRSBDZXJ0aWZpY2F0aW9uIENlbnRyZSBS
-b290IENBMRgwFgYJKoZIhvcNAQkBFglwa2lAc2suZWUwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQDIIMDs4MVLqwd4lfNE7vsLDP90jmG7sWLqI9iroWUy
-euuOF0+W2Ap7kaJjbMeMTC55v6kF/GlclY1i+blw7cNRfdCT5mzrMEvhvH2/UpvO
-bntl8jixwKIy72KyaOBhU8E2lf/slLo2rpwcpzIP5Xy0xm90/XsY6KxX7QYgSzIw
-WFv9zajmofxwvI6Sc9uXp3whrj3B9UiHbCe9nyV0gVWw93X2PaRka9ZP585ArQ/d
-MtO8ihJTmMmJ+xAdTX7Nfh9WDSFwhfYggx/2uh8Ej+p3iDXE/+pOoYtNP2MbRMNE
-1CV2yreN1x5KZmTNXMWcg+HCCIia7E6j8T4cLNlsHaFLAgMBAAGjgYowgYcwDwYD
-VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBLyWj7qVhy/
-zQas8fElyalL1BSZMEUGA1UdJQQ+MDwGCCsGAQUFBwMCBggrBgEFBQcDAQYIKwYB
-BQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkwDQYJKoZIhvcNAQEF
-BQADggEBAHv25MANqhlHt01Xo/6tu7Fq1Q+e2+RjxY6hUFaTlrg4wCQiZrxTFGGV
-v9DHKpY5P30osxBAIWrEr7BSdxjhlthWXePdNl4dp1BUoMUq5KqMlIpPnTX/dqQG
-E5Gion0ARD9V04I8GtVbvFZMIi5GQ4okQC3zErg7cBqklrkar4dBGmoYDQZPxz5u
-uSlNDUmJEYcyW+ZLBMjkXOZ0c5RdFpgTlf7727FE5TpwrDdr5rMzcijJs1eg9gIW
-iAYLtqZLICjU3j2LrTcFU3T+bsy8QxdxXvnFzBqpYe73dgzzcvRyrc9yAjYHR8/v
-GVCJYMzpJJUPwssd8m92kMfMdcGWxZ0=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEKjCCAxKgAwIBAgIEOGPe+DANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
-RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp
-bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5
-IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRp
-ZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0yOTA3
-MjQxNDE1MTJaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3
-LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp
-YWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG
-A1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQq
-K0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQe
-sYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuX
-MlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVT
-XTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/
-HoZdenoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH
-4QIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
-HQ4EFgQUVeSB0RGAvtiJuQijMfmhJAkWuXAwDQYJKoZIhvcNAQEFBQADggEBADub
-j1abMOdTmXx6eadNl9cZlZD7Bh/KM3xGY4+WZiT6QBshJ8rmcnPyT/4xmf3IDExo
-U8aAghOY+rat2l098c5u9hURlIIM7j+VrxGrD9cv3h8Dj1csHsm7mhpElesYT6Yf
-zX1XEC+bBAlahLVu2B064dae0Wx5XnkcFMXj0EyTO2U87d89vqbllRrDtRnDvV5b
-u/8j72gZyxKTJ1wDLW8w0B62GqzeWvfRqqgnpv55gcR5mTNXuhKwqeBCbJPKVt7+
-bYQLCIt+jerXmCHG8+c8eS9enNFMFY3h7CI3zJpDC5fcgJCNs2ebb0gIFVbPv/Er
-fF6adulZkMV8gzURZVE=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC
-VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0
-Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW
-KGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsGA1UEAxMkRW50cnVzdCBSb290IENl
-cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0MloXDTI2MTEyNzIw
-NTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw
-NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSBy
-ZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNV
-BAMTJEVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBALaVtkNC+sZtKm9I35RMOVcF7sN5EUFo
-Nu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYszA9u3g3s+IIRe7bJWKKf4
-4LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOwwCj0Yzfv9
-KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGI
-rb68j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi
-94DkZfs0Nw4pgHBNrziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOB
-sDCBrTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAi
-gA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1MzQyWjAfBgNVHSMEGDAWgBRo
-kORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DHhmak8fdLQ/uE
-vW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA
-A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9t
-O1KzKtvn1ISMY/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6Zua
-AGAT/3B+XxFNSRuzFVJ7yVTav52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP
-9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTSW3iDVuycNsMm4hH2Z0kdkquM++v/
-eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0tHuu2guQOHXvgR1m
-0vdXcDazv/wor3ElhVsT/h5/WrQ8
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIC+TCCAoCgAwIBAgINAKaLeSkAAAAAUNCR+TAKBggqhkjOPQQDAzCBvzELMAkG
-A1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3
-d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDEyIEVu
-dHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEzMDEGA1UEAxMq
-RW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRUMxMB4XDTEy
-MTIxODE1MjUzNloXDTM3MTIxODE1NTUzNlowgb8xCzAJBgNVBAYTAlVTMRYwFAYD
-VQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0
-L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxMiBFbnRydXN0LCBJbmMuIC0g
-Zm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMzAxBgNVBAMTKkVudHJ1c3QgUm9vdCBD
-ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEVDMTB2MBAGByqGSM49AgEGBSuBBAAi
-A2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHyAsWfoPZb1YsGGYZPUxBt
-ByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef9eNi1KlH
-Bz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
-BBYEFLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVC
-R98crlOZF7ZvHH3hvxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nX
-hTcGtXsI/esni0qU+eH6p44mCOh8kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMC
-VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50
-cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3Qs
-IEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVz
-dCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwHhcNMDkwNzA3MTcy
-NTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVu
-dHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwt
-dGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0
-aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmlj
-YXRpb24gQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP/vaCeb9zYQYKpSfYs1/T
-RU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXzHHfV1IWN
-cCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hW
-wcKUs/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1
-U1+cPvQXLOZprE4yTGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0
-jaWvYkxN4FisZDQSA/i2jZRjJKRxAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
-BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ60B7vfec7aVHUbI2fkBJmqzAN
-BgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5ZiXMRrEPR9RP/
-jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ
-Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v
-1fN2D807iDginWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4R
-nAuknZoh8/CbCzB428Hch0P+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmH
-VHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xOe4pIb4tF9g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFiDCCA3CgAwIBAgIIfQmX/vBH6nowDQYJKoZIhvcNAQELBQAwYjELMAkGA1UE
-BhMCQ04xMjAwBgNVBAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZ
-IENPLixMVEQuMR8wHQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMB4XDTE0
-MTEyNjA1MTMxNVoXDTQwMTIzMTE1NTk1OVowYjELMAkGA1UEBhMCQ04xMjAwBgNV
-BAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZIENPLixMVEQuMR8w
-HQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMIICIjANBgkqhkiG9w0BAQEF
-AAOCAg8AMIICCgKCAgEA2aMW8Mh0dHeb7zMNOwZ+Vfy1YI92hhJCfVZmPoiC7XJj
-Dp6L3TQsAlFRwxn9WVSEyfFrs0yw6ehGXTjGoqcuEVe6ghWinI9tsJlKCvLriXBj
-TnnEt1u9ol2x8kECK62pOqPseQrsXzrj/e+APK00mxqriCZ7VqKChh/rNYmDf1+u
-KU49tm7srsHwJ5uu4/Ts765/94Y9cnrrpftZTqfrlYwiOXnhLQiPzLyRuEH3FMEj
-qcOtmkVEs7LXLM3GKeJQEK5cy4KOFxg2fZfmiJqwTTQJ9Cy5WmYqsBebnh52nUpm
-MUHfP/vFBu8btn4aRjb3ZGM74zkYI+dndRTVdVeSN72+ahsmUPI2JgaQxXABZG12
-ZuGR224HwGGALrIuL4xwp9E7PLOR5G62xDtw8mySlwnNR30YwPO7ng/Wi64HtloP
-zgsMR6flPri9fcebNaBhlzpBdRfMK5Z3KpIhHtmVdiBnaM8Nvd/WHwlqmuLMc3Gk
-L30SgLdTMEZeS1SZD2fJpcjyIMGC7J0R38IC+xo70e0gmu9lZJIQDSri3nDxGGeC
-jGHeuLzRL5z7D9Ar7Rt2ueQ5Vfj4oR24qoAATILnsn8JuLwwoC8N9VKejveSswoA
-HQBUlwbgsQfZxw9cZX08bVlX5O2ljelAU58VS6Bx9hoh49pwBiFYFIeFd3mqgnkC
-AwEAAaNCMEAwHQYDVR0OBBYEFOLJQJ9NzuiaoXzPDj9lxSmIahlRMA8GA1UdEwEB
-/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQDRSVfg
-p8xoWLoBDysZzY2wYUWsEe1jUGn4H3++Fo/9nesLqjJHdtJnJO29fDMylyrHBYZm
-DRd9FBUb1Ov9H5r2XpdptxolpAqzkT9fNqyL7FeoPueBihhXOYV0GkLH6VsTX4/5
-COmSdI31R9KrO9b7eGZONn356ZLpBN79SWP8bfsUcZNnL0dKt7n/HipzcEYwv1ry
-L3ml4Y0M2fmyYzeMN2WFcGpcWwlyua1jPLHd+PwyvzeG5LuOmCd+uh8W4XAR8gPf
-JWIyJyYYMoSf/wA6E7qaTfRPuBRwIrHKK5DOKcFw9C+df/KQHtZa37dG/OaG+svg
-IHZ6uqbL9XzeYqWxi+7egmaKTjowHz+Ay60nugxe19CxVsp3cbK1daFQqUBDF8Io
-2c9Si1vIY9RCPqAzekYu9wogRlR+ak8x8YF+QnQ4ZXMn7sZ8uI7XpTrXmKGcjBBV
-09tL7ECQ8s1uV9JiDnxXk7Gnbc2dg7sq5+W2O3FYrf3RRbxake5TFW/TRQl1brqQ
-XR4EzzffHqhmsYzmIGrv/EhOdJhCrylvLmrH+33RZjEizIYAfmaDDEL0vTSSwxrq
-T8p+ck0LcIymSLumoRT2+1hEmRSuqguTaaApJUqlyyvdimYHFngVV3Eb7PVHhPOe
-MTd61X8kreS8/f3MboPoDKi3QWwH3b08hpcv0g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFWjCCA0KgAwIBAgIQbkepxUtHDA3sM9CJuRz04TANBgkqhkiG9w0BAQwFADBH
-MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM
-QzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIy
-MDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNl
-cnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaM
-f/vo27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vX
-mX7wCl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7
-zUjwTcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0P
-fyblqAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtc
-vfaHszVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4
-Zor8Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUsp
-zBmkMiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOO
-Rc92wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYW
-k70paDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+
-DVrNVjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgF
-lQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
-HQ4EFgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBADiW
-Cu49tJYeX++dnAsznyvgyv3SjgofQXSlfKqE1OXyHuY3UjKcC9FhHb8owbZEKTV1
-d5iyfNm9dKyKaOOpMQkpAWBz40d8U6iQSifvS9efk+eCNs6aaAyC58/UEBZvXw6Z
-XPYfcX3v73svfuo21pdwCxXu11xWajOl40k4DLh9+42FpLFZXvRq4d2h9mREruZR
-gyFmxhE+885H7pwoHyXa/6xmld01D1zvICxi/ZG6qcz8WpyTgYMpl0p8WnK0OdC3
-d8t5/Wk6kjftbjhlRn7pYL15iJdfOBL07q9bgsiG1eGZbYwE8na6SfZu6W0eX6Dv
-J4J2QPim01hcDyxC2kLGe4g0x8HYRZvBPsVhHdljUEn2NIVq4BjFbkerQUIpm/Zg
-DdIx02OYI5NaAIFItO/Nis3Jz5nu2Z6qNuFoS3FJFDYoOj0dzpqPJeaAcWErtXvM
-+SUWgeExX6GjfhaknBZqlxi9dnKlC54dNuYvoS++cJEPqOba+MSSQGwlfnuzCdyy
-F62ARPBopY+Udf90WuioAnwMCeKpSwughQtiue+hMZL77/ZRBIls6Kl0obsXs7X9
-SQ98POyDGCBDTtWTurQ0sR8WNh8M5mQ5Fkzc4P4dyKliPUDqysU0ArSuiYgzNdws
-E3PYJ/HQcu51OyLemGhmW/HGY0dVHLqlCFF1pkgl
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFWjCCA0KgAwIBAgIQbkepxlqz5yDFMJo/aFLybzANBgkqhkiG9w0BAQwFADBH
-MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM
-QzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIy
-MDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNl
-cnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3Lv
-CvptnfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3Kg
-GjSY6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9Bu
-XvAuMC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOd
-re7kRXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXu
-PuWgf9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1
-mKPV+3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K
-8YzodDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqj
-x5RWIr9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsR
-nTKaG73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0
-kzCqgc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9Ok
-twIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
-HQ4EFgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBALZp
-8KZ3/p7uC4Gt4cCpx/k1HUCCq+YEtN/L9x0Pg/B+E02NjO7jMyLDOfxA325BS0JT
-vhaI8dI4XsRomRyYUpOM52jtG2pzegVATX9lO9ZY8c6DR2Dj/5epnGB3GFW1fgiT
-z9D2PGcDFWEJ+YF59exTpJ/JjwGLc8R3dtyDovUMSRqodt6Sm2T4syzFJ9MHwAiA
-pJiS4wGWAqoC7o87xdFtCjMwc3i5T1QWvwsHoaRc5svJXISPD+AVdyx+Jn7axEvb
-pxZ3B7DNdehyQtaVhJ2Gg/LkkM0JR9SLA3DaWsYDQvTtN6LwG1BUSw7YhN4ZKJmB
-R64JGz9I0cNv4rBgF/XuIwKl2gBbbZCr7qLpGzvpx0QnRY5rn/WkhLx3+WuXrD5R
-RaIRpsyF7gpo8j5QOHokYh4XIDdtak23CZvJ/KRY9bb7nE4Yu5UC56GtmwfuNmsk
-0jmGwZODUNKBRqhfYlcsu2xkiAhu7xNUX90txGdj08+JN7+dIPT7eoOboB6BAFDC
-5AwiWVIQ7UNWhwD4FFKnHYuTjKJNRn8nxnGbJN7k2oaLDX5rIMHAnuFl2GqjpuiF
-izoHCBy69Y9Vmhh1fuXsgWbRIXOhNUQLgD1bnF5vKheW0YMjiGZt5obicDIvUiLn
-yOd/xCxgXS/Dr55FBcOEArf9LAhST4Ldo/DUhgkC
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICDDCCAZGgAwIBAgIQbkepx2ypcyRAiQ8DVd2NHTAKBggqhkjOPQQDAzBHMQsw
-CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-MBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQA
-IgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout
-736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2A
-DDL24CejQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
-DgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEAgFuk
-fCPAlaUs3L6JbyO5o91lAFJekazInXJ0glMLfalAvWhgxeG4VDvBNhcl2MG9AjEA
-njWSdIUlUfUk7GRSJFClH9voy8l27OyCbvWFGFPouOOaKaqW04MjyaR7YbPMAuhd
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICCjCCAZGgAwIBAgIQbkepyIuUtui7OyrYorLBmTAKBggqhkjOPQQDAzBHMQsw
-CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-MBIGA1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQA
-IgNiAATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzu
-hXyiQHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/l
-xKvRHYqjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
-DgQWBBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNnADBkAjBqUFJ0
-CMRw3J5QdCHojXohw0+WbhXRIjVhLfoIN+4Zba3bssx9BzT1YBkstTTZbyACMANx
-sbqjYAuG7ZoIapVon+Kz4ZNkfF6Tpt95LY2F45TPI11xzPKwTdb+mciUqXWi4w==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
-MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
-YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
-EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
-R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
-9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
-fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
-iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
-1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
-bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
-MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
-ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
-uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
-Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
-tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
-PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
-hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
-5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDfDCCAmSgAwIBAgIQGKy1av1pthU6Y2yv2vrEoTANBgkqhkiG9w0BAQUFADBY
-MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjExMC8GA1UEAxMo
-R2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEx
-MjcwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQK
-Ew1HZW9UcnVzdCBJbmMuMTEwLwYDVQQDEyhHZW9UcnVzdCBQcmltYXJ5IENlcnRp
-ZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAvrgVe//UfH1nrYNke8hCUy3f9oQIIGHWAVlqnEQRr+92/ZV+zmEwu3qDXwK9
-AWbK7hWNb6EwnL2hhZ6UOvNWiAAxz9juapYC2e0DjPt1befquFUWBRaa9OBesYjA
-ZIVcFU2Ix7e64HXprQU9nceJSOC7KMgD4TCTZF5SwFlwIjVXiIrxlQqD17wxcwE0
-7e9GceBrAqg1cmuXm2bgyxx5X9gaBGgeRwLmnWDiNpcB3841kt++Z8dtd1k7j53W
-kBWUvEI0EME5+bEnPn7WinXFsq+W06Lem+SYvn3h6YGttm/81w7a4DSwDRp35+MI
-mO9Y+pyEtzavwt+s0vQQBnBxNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4G
-A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQULNVQQZcVi/CPNmFbSvtr2ZnJM5IwDQYJ
-KoZIhvcNAQEFBQADggEBAFpwfyzdtzRP9YZRqSa+S7iq8XEN3GHHoOo0Hnp3DwQ1
-6CePbJC/kRYkRj5KTs4rFtULUh38H2eiAkUxT87z+gOneZ1TatnaYzr4gNfTmeGl
-4b7UVXGYNTq+k+qurUKykG/g/CFNNWMziUnWm07Kx+dOCQD32sfvmWKZd7aVIl6K
-oKv0uHiYyjgZmclynnjNS6yvGaBzEi38wkG6gZHaFloxt/m0cYASSJlyc1pZU8Fj
-UjPtp8nSOQJw+uCxQmYpqptR7TBUIhRf2asdweSU8Pj1K/fqynhG1riR/aYNKxoU
-AT6A8EKglQdebc3MS6RFjasS6LPeWuWgfOgPIh1a6Vk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICrjCCAjWgAwIBAgIQPLL0SAoA4v7rJDteYD7DazAKBggqhkjOPQQDAzCBmDEL
-MAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsTMChj
-KSAyMDA3IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTE2
-MDQGA1UEAxMtR2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
-eSAtIEcyMB4XDTA3MTEwNTAwMDAwMFoXDTM4MDExODIzNTk1OVowgZgxCzAJBgNV
-BAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTkwNwYDVQQLEzAoYykgMjAw
-NyBHZW9UcnVzdCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxNjA0BgNV
-BAMTLUdlb1RydXN0IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH
-MjB2MBAGByqGSM49AgEGBSuBBAAiA2IABBWx6P0DFUPlrOuHNxFi79KDNlJ9RVcL
-So17VDs6bl8VAsBQps8lL33KSLjHUGMcKiEIfJo22Av+0SbFWDEwKCXzXV2juLal
-tJLtbCyf691DiaI8S0iRHVDsJt/WYC69IaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO
-BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBVfNVdRVfslsq0DafwBo/q+EVXVMAoG
-CCqGSM49BAMDA2cAMGQCMGSWWaboCd6LuvpaiIjwH5HTRqjySkwCY/tsXzjbLkGT
-qQ7mndwxHLKgpxgceeHHNgIwOlavmnRs9vuD4DPTCF+hnMJbn0bWtsuRBmOiBucz
-rD6ogRLQy7rQkgu2npaqBA+K
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID/jCCAuagAwIBAgIQFaxulBmyeUtB9iepwxgPHzANBgkqhkiG9w0BAQsFADCB
-mDELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsT
-MChjKSAyMDA4IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s
-eTE2MDQGA1UEAxMtR2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eSAtIEczMB4XDTA4MDQwMjAwMDAwMFoXDTM3MTIwMTIzNTk1OVowgZgxCzAJ
-BgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTkwNwYDVQQLEzAoYykg
-MjAwOCBHZW9UcnVzdCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxNjA0
-BgNVBAMTLUdlb1RydXN0IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANziXmJYHTNXOTIz
-+uvLh4yn1ErdBojqZI4xmKU4kB6Yzy5jK/BGvESyiaHAKAxJcCGVn2TAppMSAmUm
-hsalifD614SgcK9PGpc/BkTVyetyEH3kMSj7HGHmKAdEc5IiaacDiGydY8hS2pgn
-5whMcD60yRLBxWeDXTPzAxHsatBT4tG6NmCUgLthY2xbF37fQJQeqw3CIShwiP/W
-JmxsYAQlTlV+fe+/lEjetx3dcI0FX4ilm/LC7urRQEFtYjgdVgbFA0dRIBn8exAL
-DmKudlW/X3e+PkkBUz2YJQN2JFodtNuJ6nnltrM7P7pMKEF/BqxqjsHQ9gUdfeZC
-huOl1UcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
-HQYDVR0OBBYEFMR5yo6hTgMdHNxr2zFblD4/MH8tMA0GCSqGSIb3DQEBCwUAA4IB
-AQAtxRPPVoB7eni9n64smefv2t+UXglpp+duaIy9cr5HqQ6XErhK8WTTOd8lNNTB
-zU6B8A8ExCSzNJbGpqow32hhc9f5joWJ7w5elShKKiePEI4ufIbEAp7aDHdlDkQN
-kv39sxY2+hENHYwOB4lqKVb3cvTdFZx3NWZXqxNT2I7BQMXXExZacse3aQHEerGD
-AWh9jUGhlBjBJVz88P6DAod8DQ3PLghcSkANPuyBYeYk28rgDi0Hsj5W3I31QYUH
-SJsMC8tJP33st/3LjWeJGqvtux6jAAgIFyqCXDFdRootD4abdNlF+9RAsXqqaC2G
-spki4cErx5z481+oghLrGREt
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFaDCCA1CgAwIBAgIBATANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJVUzEW
-MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEeMBwGA1UEAxMVR2VvVHJ1c3QgVW5pdmVy
-c2FsIENBMB4XDTA0MDMwNDA1MDAwMFoXDTI5MDMwNDA1MDAwMFowRTELMAkGA1UE
-BhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xHjAcBgNVBAMTFUdlb1RydXN0
-IFVuaXZlcnNhbCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKYV
-VaCjxuAfjJ0hUNfBvitbtaSeodlyWL0AG0y/YckUHUWCq8YdgNY96xCcOq9tJPi8
-cQGeBvV8Xx7BDlXKg5pZMK4ZyzBIle0iN430SppyZj6tlcDgFgDgEB8rMQ7XlFTT
-QjOgNB0eRXbdT8oYN+yFFXoZCPzVx5zw8qkuEKmS5j1YPakWaDwvdSEYfyh3peFh
-F7em6fgemdtzbvQKoiFs7tqqhZJmr/Z6a4LauiIINQ/PQvE1+mrufislzDoR5G2v
-c7J2Ha3QsnhnGqQ5HFELZ1aD/ThdDc7d8Lsrlh/eezJS/R27tQahsiFepdaVaH/w
-mZ7cRQg+59IJDTWU3YBOU5fXtQlEIGQWFwMCTFMNaN7VqnJNk22CDtucvc+081xd
-VHppCZbW2xHBjXWotM85yM48vCR85mLK4b19p71XZQvk/iXttmkQ3CgaRr0BHdCX
-teGYO8A3ZNY9lO4L4fUorgtWv3GLIylBjobFS1J72HGrH4oVpjuDWtdYAVHGTEHZ
-f9hBZ3KiKN9gg6meyHv8U3NyWfWTehd2Ds735VzZC1U0oqpbtWpU5xPKV+yXbfRe
-Bi9Fi1jUIxaS5BZuKGNZMN9QAZxjiRqf2xeUgnA3wySemkfWWspOqGmJch+RbNt+
-nhutxx9z3SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB
-/wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY
-MBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG
-9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc
-aanQmjg8+uUfNeVE44B5lGiku8SfPeE0zTBGi1QrlaXv9z+ZhP015s8xxtxqv6fX
-IwjhmF7DWgh2qaavdy+3YL1ERmrvl/9zlcGO6JP7/TG37FcREUWbMPEaiDnBTzyn
-ANXH/KttgCJwpQzgXQQpAvvLoJHRfNbDflDVnVi+QTjruXU8FdmbyUqDWcDaU/0z
-uzYYm4UPFd3uLax2k7nZAY1IEKj79TiG8dsKxr2EoyNB3tZ3b4XUhRxQ4K5RirqN
-Pnbiucon8l+f725ZDQbYKxek0nxru18UGkiPGkzns0ccjkxFKyDuSN/n3QmOGKja
-QI2SJhFTYXNd673nxE0pN2HrrDktZy4W1vUAg4WhzH92xH3kt0tm7wNFYGm2DFKW
-koRepqO1pD4r2czYG0eq8kTaT/kD6PAUyz/zg97QwVTjt+gKN02LIFkDMBmhLMi9
-ER/frslKxfMnZmaGrGiR/9nmUxwPi1xpZQomyB40w11Re9epnAahNt3ViZS82eQt
-DF4JbAiXfKM9fJP/P6EUp8+1Xevb2xzEdt+Iub1FBZUbrvxGakyvSOPOrg/Sfuvm
-bJxPgWp6ZKy7PtXny3YuxadIwVyQD8vIP/rmMuGNG2+k5o7Y+SlIis5z/iw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFbDCCA1SgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMQswCQYDVQQGEwJVUzEW
-MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1c3QgVW5pdmVy
-c2FsIENBIDIwHhcNMDQwMzA0MDUwMDAwWhcNMjkwMzA0MDUwMDAwWjBHMQswCQYD
-VQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1
-c3QgVW5pdmVyc2FsIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
-AQCzVFLByT7y2dyxUxpZKeexw0Uo5dfR7cXFS6GqdHtXr0om/Nj1XqduGdt0DE81
-WzILAePb63p3NeqqWuDW6KFXlPCQo3RWlEQwAx5cTiuFJnSCegx2oG9NzkEtoBUG
-FF+3Qs17j1hhNNwqCPkuwwGmIkQcTAeC5lvO0Ep8BNMZcyfwqph/Lq9O64ceJHdq
-XbboW0W63MOhBW9Wjo8QJqVJwy7XQYci4E+GymC16qFjwAGXEHm9ADwSbSsVsaxL
-se4YuU6W3Nx2/zu+z18DwPw76L5GG//aQMJS9/7jOvdqdzXQ2o3rXhhqMcceujwb
-KNZrVMaqW9eiLBsZzKIC9ptZvTdrhrVtgrrY6slWvKk2WP0+GfPtDCapkzj4T8Fd
-IgbQl+rhrcZV4IErKIM6+vR7IVEAvlI4zs1meaj0gVbi0IMJR1FbUGrP20gaXT73
-y/Zl92zxlfgCOzJWgjl6W70viRu/obTo/3+NjN8D8WBOWBFM66M/ECuDmgFz2ZRt
-hAAnZqzwcEAJQpKtT5MNYQlRJNiS1QuUYbKHsu3/mjX/hVTK7URDrBs8FmtISgoc
-QIgfksILAAX/8sgCSqSqqcyZlpwvWOB94b67B9xfBHJcMTTD7F8t4D1kkCLm0ey4
-Lt1ZrtmhN79UNdxzMk+MBB4zsslG8dhcyFVQyWi9qLo2CQIDAQABo2MwYTAPBgNV
-HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAfBgNV
-HSMEGDAWgBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAOBgNVHQ8BAf8EBAMCAYYwDQYJ
-KoZIhvcNAQEFBQADggIBAGbBxiPz2eAubl/oz66wsCVNK/g7WJtAJDday6sWSf+z
-dXkzoS9tcBc0kf5nfo/sm+VegqlVHy/c1FEHEv6sFj4sNcZj/NwQ6w2jqtB8zNHQ
-L1EuxBRa3ugZ4T7GzKQp5y6EqgYweHZUcyiYWTjgAA1i00J9IZ+uPTqM1fp3DRgr
-Fg5fNuH8KrUwJM/gYwx7WBr+mbpCErGR9Hxo4sjoryzqyX6uuyo9DRXcNJW2GHSo
-ag/HtPQTxORb7QrSpJdMKu0vbBKJPfEncKpqA1Ihn0CoZ1Dy81of398j9tx4TuaY
-T1U6U+Pv8vSfx3zYWK8pIpe44L2RLrB27FcRz+8pRPPphXpgY+RdM4kX2TGq2tbz
-GDVyz4crL2MjhF2EjD9XoIj8mZEoJmmZ1I+XRL6O1UixpCgp8RW04eWe3fiPpm8m
-1wk8OhwRDqZsN/etRIcsKMfYdIKz0G9KV7s1KSegi+ghp4dkNl3M2Basx7InQJJV
-OCiNUW7dFGdTbHFcJoRNdVq2fmBWqU2t+5sel/MN2dKXVHfaPRK34B7vCAas+YWH
-6aLcr34YEoP9VhdBLtUpgn2Z9DH2canPLAEnpQW5qrJITirvn5NSUZU8UnOOVkwX
-QMAJKOSLakhT2+zNVVXxxvjpoixMptEmX36vWkzaH6byHCx+rgIW0lbQL1dTR+iS
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIB4TCCAYegAwIBAgIRKjikHJYKBN5CsiilC+g0mAIwCgYIKoZIzj0EAwIwUDEk
-MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI0MRMwEQYDVQQKEwpH
-bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX
-DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD
-QSAtIFI0MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMZ5049sJQ6fLjkZHAOkrprlOQcJ
-FspjsbmG+IpXwVfOQvpzofdlQv8ewQCybnMO/8ch5RikqtlxP6jUuc6MHaNCMEAw
-DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFSwe61F
-uOJAf/sKbvu+M8k8o4TVMAoGCCqGSM49BAMCA0gAMEUCIQDckqGgE6bPA7DmxCGX
-kPoUVy0D7O48027KqGx2vKLeuwIgJ6iFJzWbVsaj8kfSt24bAgAXqmemFZHe+pTs
-ewv4n4Q=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICHjCCAaSgAwIBAgIRYFlJ4CYuu1X5CneKcflK2GwwCgYIKoZIzj0EAwMwUDEk
-MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI1MRMwEQYDVQQKEwpH
-bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX
-DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD
-QSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc
-8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke
-hOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD
-VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUPeYpSJvqB8ohREom3m7e0oPQn1kwCgYI
-KoZIzj0EAwMDaAAwZQIxAOVpEslu28YxuglB4Zf4+/2a4n0Sye18ZNPLBSWLVtmg
-515dTguDnFt2KaAJJiFqYgIwcdK1j1zqO+F4CYWodZI7yFz9SO8NdCKoCOJuxUnO
-xwy8p2Fp8fc74SrL+SvzZpA3
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
-A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
-b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
-MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
-YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
-aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
-jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
-xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
-1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
-snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
-U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
-9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
-AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
-yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
-38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
-AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
-DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
-HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G
-A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp
-Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1
-MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG
-A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAKbPJA6+Lm8omUVCxKs+IVSbC9N/hHD6ErPL
-v4dfxn+G07IwXNb9rfF73OX4YJYJkhD10FPe+3t+c4isUoh7SqbKSaZeqKeMWhG8
-eoLrvozps6yWJQeXSpkqBy+0Hne/ig+1AnwblrjFuTosvNYSuetZfeLQBoZfXklq
-tTleiDTsvHgMCJiEbKjNS7SgfQx5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzd
-C9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ/gkwpRl4pa
-zq+r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCB
-mTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm+IH
-V2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5n
-bG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG
-3lm0mi3f3BmGLjANBgkqhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4Gs
-J0/WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk7mpM0sYmsL4h4hO
-291xNBrBVNpGP+DTKqttVCL1OmLNIG+6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavS
-ot+3i9DAgBkcRcAtjOj4LaR0VknFBbVPFd5uRHg5h6h+u/N5GJG79G+dwfCMNYxd
-AfvDbbnvRG15RjF+Cv6pgsH/76tuIMRQyV+dTZsXjAzlAcmgQWpzU/qlULRuJQ/7
-TBj0/VLZjmmx6BEP3ojY+x1J96relc8geMJgEtslQIxq/H5COEBkEveegeGTLg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
-A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
-Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
-MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
-A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
-RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
-gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
-KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
-QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
-XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
-DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
-LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
-RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
-jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
-6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
-mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
-Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
-WD9f
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFgzCCA2ugAwIBAgIORea7A4Mzw4VlSOb/RVEwDQYJKoZIhvcNAQEMBQAwTDEg
-MB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjYxEzARBgNVBAoTCkdsb2Jh
-bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTQxMjEwMDAwMDAwWhcNMzQx
-MjEwMDAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSNjET
-MBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCAiIwDQYJ
-KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJUH6HPKZvnsFMp7PPcNCPG0RQssgrRI
-xutbPK6DuEGSMxSkb3/pKszGsIhrxbaJ0cay/xTOURQh7ErdG1rG1ofuTToVBu1k
-ZguSgMpE3nOUTvOniX9PeGMIyBJQbUJmL025eShNUhqKGoC3GYEOfsSKvGRMIRxD
-aNc9PIrFsmbVkJq3MQbFvuJtMgamHvm566qjuL++gmNQ0PAYid/kD3n16qIfKtJw
-LnvnvJO7bVPiSHyMEAc4/2ayd2F+4OqMPKq0pPbzlUoSB239jLKJz9CgYXfIWHSw
-1CM69106yqLbnQneXUQtkPGBzVeS+n68UARjNN9rkxi+azayOeSsJDa38O+2HBNX
-k7besvjihbdzorg1qkXy4J02oW9UivFyVm4uiMVRQkQVlO6jxTiWm05OWgtH8wY2
-SXcwvHE35absIQh1/OZhFj931dmRl4QKbNQCTXTAFO39OfuD8l4UoQSwC+n+7o/h
-bguyCLNhZglqsQY6ZZZZwPA1/cnaKI0aEYdwgQqomnUdnjqGBQCe24DWJfncBZ4n
-WUx2OVvq+aWh2IMP0f/fMBH5hc8zSPXKbWQULHpYT9NLCEnFlWQaYw55PfWzjMpY
-rZxCRXluDocZXFSxZba/jJvcE+kNb7gu3GduyYsRtYQUigAZcIN5kZeR1Bonvzce
-MgfYFGM8KEyvAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD
-AQH/MB0GA1UdDgQWBBSubAWjkxPioufi1xzWx/B/yGdToDAfBgNVHSMEGDAWgBSu
-bAWjkxPioufi1xzWx/B/yGdToDANBgkqhkiG9w0BAQwFAAOCAgEAgyXt6NH9lVLN
-nsAEoJFp5lzQhN7craJP6Ed41mWYqVuoPId8AorRbrcWc+ZfwFSY1XS+wc3iEZGt
-Ixg93eFyRJa0lV7Ae46ZeBZDE1ZXs6KzO7V33EByrKPrmzU+sQghoefEQzd5Mr61
-55wsTLxDKZmOMNOsIeDjHfrYBzN2VAAiKrlNIC5waNrlU/yDXNOd8v9EDERm8tLj
-vUYAGm0CuiVdjaExUd1URhxN25mW7xocBFymFe944Hn+Xds+qkxV/ZoVqW/hpvvf
-cDDpw+5CRu3CkwWJ+n1jez/QcYF8AOiYrg54NMMl+68KnyBr3TsTjxKM4kEaSHpz
-oHdpx7Zcf4LIHv5YGygrqGytXm3ABdJ7t+uA/iU3/gKbaKxCXcPu9czc8FB10jZp
-nOZ7BN9uBmm23goJSFmH63sUYHpkqmlD75HHTOwY3WzvUy2MmeFe8nI+z1TIvWfs
-pA9MRf/TuTAjB0yPEL+GltmZWrSZVxykzLsViVO6LAUP5MSeGbEYNNVMnbrt9x+v
-JJUEeKgDu+6B5dpffItKoZB0JaezPkvILFa9x8jvOOJckvB595yEunQtYQEgfn7R
-8k8HWV+LLUNS60YMlOH1Zkd5d9VUWx+tJDfLRVpOoERIyNiwmcUVhAn21klJwGW4
-5hpxbqCo8YLoRT5s1gLXCmeDBVrJpBA=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIHSTCCBTGgAwIBAgIJAMnN0+nVfSPOMA0GCSqGSIb3DQEBBQUAMIGsMQswCQYD
-VQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBhZGRyZXNzIGF0
-IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJQTgyNzQzMjg3
-MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMTHkdsb2JhbCBD
-aGFtYmVyc2lnbiBSb290IC0gMjAwODAeFw0wODA4MDExMjMxNDBaFw0zODA3MzEx
-MjMxNDBaMIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3Vy
-cmVudCBhZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAG
-A1UEBRMJQTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAl
-BgNVBAMTHkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwODCCAiIwDQYJKoZI
-hvcNAQEBBQADggIPADCCAgoCggIBAMDfVtPkOpt2RbQT2//BthmLN0EYlVJH6xed
-KYiONWwGMi5HYvNJBL99RDaxccy9Wglz1dmFRP+RVyXfXjaOcNFccUMd2drvXNL7
-G706tcuto8xEpw2uIRU/uXpbknXYpBI4iRmKt4DS4jJvVpyR1ogQC7N0ZJJ0YPP2
-zxhPYLIj0Mc7zmFLmY/CDNBAspjcDahOo7kKrmCgrUVSY7pmvWjg+b4aqIG7HkF4
-ddPB/gBVsIdU6CeQNR1MM62X/JcumIS/LMmjv9GYERTtY/jKmIhYF5ntRQOXfjyG
-HoiMvvKRhI9lNNgATH23MRdaKXoKGCQwoze1eqkBfSbW+Q6OWfH9GzO1KTsXO0G2
-Id3UwD2ln58fQ1DJu7xsepeY7s2MH/ucUa6LcL0nn3HAa6x9kGbo1106DbDVwo3V
-yJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e
-beksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r
-6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh
-wZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33SdNDWKBWY8o9PeU1VlnpDsog
-zCtLkykPAgMBAAGjggFqMIIBZjASBgNVHRMBAf8ECDAGAQH/AgEMMB0GA1UdDgQW
-BBS5CcqcHtvTbDprru1U8VuTBjUuXjCB4QYDVR0jBIHZMIHWgBS5CcqcHtvTbDpr
-ru1U8VuTBjUuXqGBsqSBrzCBrDELMAkGA1UEBhMCRVUxQzBBBgNVBAcTOk1hZHJp
-ZCAoc2VlIGN1cnJlbnQgYWRkcmVzcyBhdCB3d3cuY2FtZXJmaXJtYS5jb20vYWRk
-cmVzcykxEjAQBgNVBAUTCUE4Mjc0MzI4NzEbMBkGA1UEChMSQUMgQ2FtZXJmaXJt
-YSBTLkEuMScwJQYDVQQDEx5HbG9iYWwgQ2hhbWJlcnNpZ24gUm9vdCAtIDIwMDiC
-CQDJzdPp1X0jzjAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCow
-KAYIKwYBBQUHAgEWHGh0dHA6Ly9wb2xpY3kuY2FtZXJmaXJtYS5jb20wDQYJKoZI
-hvcNAQEFBQADggIBAICIf3DekijZBZRG/5BXqfEv3xoNa/p8DhxJJHkn2EaqbylZ
-UohwEurdPfWbU1Rv4WCiqAm57OtZfMY18dwY6fFn5a+6ReAJ3spED8IXDneRRXoz
-X1+WLGiLwUePmJs9wOzL9dWCkoQ10b42OFZyMVtHLaoXpGNR6woBrX/sdZ7LoR/x
-fxKxueRkf2fWIyr0uDldmOghp+G9PUIadJpwr2hsUF1Jz//7Dl3mLEfXgTpZALVz
-a2Mg9jFFCDkO9HB+QHBaP9BrQql0PSgvAm11cpUJjUhjxsYjV5KTXjXBjfkK9yyd
-Yhz2rXzdpjEetrHHfoUm+qRqtdpjMNHvkzeyZi99Bffnt0uYlDXA2TopwZ2yUDMd
-SqlapskD7+3056huirRXhOukP9DuqqqHW2Pok+JrqNS4cnhrG+055F3Lm6qH1U9O
-AP7Zap88MQ8oAgF9mOinsKJknnn4SPIVqczmyETrP3iZ8ntxPjzxmKfFGBI/5rso
-M0LpRQp8bfKGeS/Fghl9CYl8slR2iK7ewfPM4W7bMdaTrpmg7yVqc5iJWzouE4ge
-v8CSlDQb4ye3ix5vQv/n6TebUB0tovkC7stYWDpxvGjjqsGvHCgfotwjZT+B6q6Z
-09gwzxMNTxXJhLynSC34MCN32EZLeW32jO06f2ARePTpm67VVMB0gNELQp/B
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh
-MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE
-YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3
-MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo
-ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg
-MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN
-ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA
-PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w
-wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi
-EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY
-avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+
-YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE
-sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h
-/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5
-IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj
-YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD
-ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy
-OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P
-TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ
-HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER
-dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf
-ReYNnyicsbkqWletNw+vHX/bvZ8=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
-EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
-EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
-ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIz
-NTk1OVowgYMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
-EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjExMC8GA1UE
-AxMoR28gRGFkZHkgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9xYgjx+lk09xvJGKP3gElY6SKD
-E6bFIEMBO4Tx5oVJnyfq9oQbTqC023CYxzIBsQU+B07u9PpPL1kwIuerGVZr4oAH
-/PMWdYA5UXvl+TW2dE6pjYIT5LY/qQOD+qK+ihVqf94Lw7YZFAXK6sOoBJQ7Rnwy
-DfMAZiLIjWltNowRGLfTshxgtDj6AozO091GB94KPutdfMh8+7ArU6SSYmlRJQVh
-GkSBjCypQ5Yj36w6gZoOKcUcqeldHraenjAKOc7xiID7S13MMuyFYkMlNAJWJwGR
-tDtwKj9useiciAF9n9T521NtYJ2/LOdYq7hfRvzOxBsDPAnrSTFcaUaz4EcCAwEA
-AaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
-FDqahQcQZyi27/a9BUFuIMGU2g/eMA0GCSqGSIb3DQEBCwUAA4IBAQCZ21151fmX
-WWcDYfF+OwYxdS2hII5PZYe096acvNjpL9DbWu7PdIxztDhC2gV7+AJ1uP2lsdeu
-9tfeE8tTEH6KRtGX+rcuKxGrkLAngPnon1rpN5+r5N9ss4UXnT3ZJE95kTXWXwTr
-gIOrmgIttRD02JDHBHNA7XIloKmf7J6raBKZV8aPEjoJpL1E/QYVN8Gb5DKj7Tjo
-2GTzLH4U/ALqn83/B2gX2yKQOC16jdFU8WnjXzPKej17CuPKf1855eJ1usV2GDPO
-LPAvTK33sefOT6jEm0pUBsV/fdUID+Ic/n4XuKxe9tQWskMJDE32p2u0mYRlynqI
-4uJEvlz36hz1
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICwzCCAkqgAwIBAgIBADAKBggqhkjOPQQDAjCBqjELMAkGA1UEBhMCR1IxDzAN
-BgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
-c2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxRDBCBgNVBAMTO0hl
-bGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgRUNDIFJv
-b3RDQSAyMDE1MB4XDTE1MDcwNzEwMzcxMloXDTQwMDYzMDEwMzcxMlowgaoxCzAJ
-BgNVBAYTAkdSMQ8wDQYDVQQHEwZBdGhlbnMxRDBCBgNVBAoTO0hlbGxlbmljIEFj
-YWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ2VydC4gQXV0aG9yaXR5
-MUQwQgYDVQQDEztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0
-dXRpb25zIEVDQyBSb290Q0EgMjAxNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJKg
-QehLgoRc4vgxEZmGZE4JJS+dQS8KrjVPdJWyUWRrjWvmP3CV8AVER6ZyOFB2lQJa
-jq4onvktTpnvLEhvTCUp6NFxW98dwXU3tNf6e3pCnGoKVlp8aQuqgAkkbH7BRqNC
-MEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFLQi
-C4KZJAEOnLvkDv2/+5cgk5kqMAoGCCqGSM49BAMCA2cAMGQCMGfOFmI4oqxiRaep
-lSTAGiecMjvAwNW6qef4BENThe5SId6d9SWDPp5YSy/XZxMOIQIwBeF1Ad5o7Sof
-TUwJCA3sS61kFyjndc5FZXIhF8siQQ6ME5g4mlRtm8rifOoCWCKR
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix
-RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1
-dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p
-YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw
-NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK
-EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl
-cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
-c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz
-dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ
-fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns
-bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD
-75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP
-FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV
-HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp
-5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu
-b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA
-A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p
-6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8
-TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7
-dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys
-Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI
-l7WdmplNsDz4SgCbZN2fOUvRJ9e4
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGCzCCA/OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBpjELMAkGA1UEBhMCR1Ix
-DzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5k
-IFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxQDA+BgNVBAMT
-N0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgUm9v
-dENBIDIwMTUwHhcNMTUwNzA3MTAxMTIxWhcNNDAwNjMwMTAxMTIxWjCBpjELMAkG
-A1UEBhMCR1IxDzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNh
-ZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkx
-QDA+BgNVBAMTN0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1
-dGlvbnMgUm9vdENBIDIwMTUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
-AQDC+Kk/G4n8PDwEXT2QNrCROnk8ZlrvbTkBSRq0t89/TSNTt5AA4xMqKKYx8ZEA
-4yjsriFBzh/a/X0SWwGDD7mwX5nh8hKDgE0GPt+sr+ehiGsxr/CL0BgzuNtFajT0
-AoAkKAoCFZVedioNmToUW/bLy1O8E00BiDeUJRtCvCLYjqOWXjrZMts+6PAQZe10
-4S+nfK8nNLspfZu2zwnI5dMK/IhlZXQK3HMcXM1AsRzUtoSMTFDPaI6oWa7CJ06C
-ojXdFPQf/7J31Ycvqm59JCfnxssm5uX+Zwdj2EUN3TpZZTlYepKZcj2chF6IIbjV
-9Cz82XBST3i4vTwri5WY9bPRaM8gFH5MXF/ni+X1NYEZN9cRCLdmvtNKzoNXADrD
-gfgXy5I2XdGj2HUb4Ysn6npIQf1FGQatJ5lOwXBH3bWfgVMS5bGMSF0xQxfjjMZ6
-Y5ZLKTBOhE5iGV48zpeQpX8B653g+IuJ3SWYPZK2fu/Z8VFRfS0myGlZYeCsargq
-NhEEelC9MoS+L9xy1dcdFkfkR2YgP/SWxa+OAXqlD3pk9Q0Yh9muiNX6hME6wGko
-LfINaFGq46V3xqSQDqE3izEjR8EJCOtu93ib14L8hCCZSRm2Ekax+0VVFqmjZayc
-Bw/qa9wfLgZy7IaIEuQt218FL+TwA9MmM+eAws1CoRc0CwIDAQABo0IwQDAPBgNV
-HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUcRVnyMjJvXVd
-ctA4GGqd83EkVAswDQYJKoZIhvcNAQELBQADggIBAHW7bVRLqhBYRjTyYtcWNl0I
-XtVsyIe9tC5G8jH4fOpCtZMWVdyhDBKg2mF+D1hYc2Ryx+hFjtyp8iY/xnmMsVMI
-M4GwVhO+5lFc2JsKT0ucVlMC6U/2DWDqTUJV6HwbISHTGzrMd/K4kPFox/la/vot
-9L/J9UUbzjgQKjeKeaO04wlshYaT/4mWJ3iBj2fjRnRUjtkNaeJK9E10A/+yd+2V
-Z5fkscWrv2oj6NSU4kQoYsRL4vDY4ilrGnB+JGGTe08DMiUNRSQrlrRGar9KC/ea
-j8GsGsVn82800vpzY4zvFrCopEYq+OsS7HK07/grfoxSwIuEVPkvPuNVqNxmsdnh
-X9izjFk0WaSrT2y7HxjbdavYy5LNlDhhDgcGH0tGEPEVvo2FXDtKK4F5D7Rpn0lQ
-l033DlZdwJVqwjbDG2jJ9SrcR5q+ss7FJej6A7na+RZukYT1HCjI/CbM1xyQVqdf
-bzoEvM14iQuODy+jqk+iGxI9FghAD/FGTNeqewjBCvVtJ94Cj8rDtSvK6evIIVM4
-pcw72Hc3MKJP2W/R8kCtQXoXxdZKNYm3QdV8hn9VTYNKpXMgwDqvkPGaJI7ZjnHK
-e7iG2rKPmT4dEw0SEe7Uq/DpFXYC5ODfqiAeW2GFZECpkJcNrVPSWh2HagCXZWK0
-vm9qp/UsQu0yrbYhnr68
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDMDCCAhigAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCSEsx
-FjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3Qg
-Um9vdCBDQSAxMB4XDTAzMDUxNTA1MTMxNFoXDTIzMDUxNTA0NTIyOVowRzELMAkG
-A1UEBhMCSEsxFjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdr
-b25nIFBvc3QgUm9vdCBDQSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEArP84tulmAknjorThkPlAj3n54r15/gK97iSSHSL22oVyaf7XPwnU3ZG1ApzQ
-jVrhVcNQhrkpJsLj2aDxaQMoIIBFIi1WpztUlVYiWR8o3x8gPW2iNr4joLFutbEn
-PzlTCeqrauh0ssJlXI6/fMN4hM2eFvz1Lk8gKgifd/PFHsSaUmYeSF7jEAaPIpjh
-ZY4bXSNmO7ilMlHIhqqhqZ5/dpTCpmy3QfDVyAY45tQM4vM7TG1QjMSDJ8EThFk9
-nnV0ttgCXjqQesBCNnLsak3c78QA3xMYV18meMjWCnl3v/evt3a5pQuEF10Q6m/h
-q5URX208o1xNg1vysxmKgIsLhwIDAQABoyYwJDASBgNVHRMBAf8ECDAGAQH/AgED
-MA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQUFAAOCAQEADkbVPK7ih9legYsC
-mEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI3
-7piol7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clB
-oiMBdDhViw+5LmeiIAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJs
-EhTkYY2sEJCehFC78JZvRZ+K88psT/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpO
-fMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilTc4afU9hDDl3WY4JxHYB0yvbi
-AmvZWg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
-WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
-ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
-MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
-h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
-0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
-A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
-T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
-B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
-B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
-KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
-OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
-jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
-qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
-rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
-HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
-hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
-ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
-3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
-NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
-ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
-TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
-jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
-oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
-4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
-mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
-emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFYDCCA0igAwIBAgIQCgFCgAAAAUUjyES1AAAAAjANBgkqhkiG9w0BAQsFADBK
-MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVu
-VHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwHhcNMTQwMTE2MTgxMjIzWhcNMzQw
-MTE2MTgxMjIzWjBKMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScw
-JQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCnUBneP5k91DNG8W9RYYKyqU+PZ4ldhNlT
-3Qwo2dfw/66VQ3KZ+bVdfIrBQuExUHTRgQ18zZshq0PirK1ehm7zCYofWjK9ouuU
-+ehcCuz/mNKvcbO0U59Oh++SvL3sTzIwiEsXXlfEU8L2ApeN2WIrvyQfYo3fw7gp
-S0l4PJNgiCL8mdo2yMKi1CxUAGc1bnO/AljwpN3lsKImesrgNqUZFvX9t++uP0D1
-bVoE/c40yiTcdCMbXTMTEl3EASX2MN0CXZ/g1Ue9tOsbobtJSdifWwLziuQkkORi
-T0/Br4sOdBeo0XKIanoBScy0RnnGF7HamB4HWfp1IYVl3ZBWzvurpWCdxJ35UrCL
-vYf5jysjCiN2O/cz4ckA82n5S6LgTrx+kzmEB/dEcH7+B1rlsazRGMzyNeVJSQjK
-Vsk9+w8YfYs7wRPCTY/JTw436R+hDmrfYi7LNQZReSzIJTj0+kuniVyc0uMNOYZK
-dHzVWYfCP04MXFL0PfdSgvHqo6z9STQaKPNBiDoT7uje/5kdX7rL6B7yuVBgwDHT
-c+XvvqDtMwt0viAgxGds8AgDelWAf0ZOlqf0Hj7h9tgJ4TNkK2PXMl6f+cB7D3hv
-l7yTmvmcEpB4eoCHFddydJxVdHixuuFucAS6T6C6aMN7/zHwcz09lCqxC0EOoP5N
-iGVreTO01wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQU7UQZwNPwBovupHu+QucmVMiONnYwDQYJKoZIhvcNAQELBQAD
-ggIBAA2ukDL2pkt8RHYZYR4nKM1eVO8lvOMIkPkp165oCOGUAFjvLi5+U1KMtlwH
-6oi6mYtQlNeCgN9hCQCTrQ0U5s7B8jeUeLBfnLOic7iPBZM4zY0+sLj7wM+x8uwt
-LRvM7Kqas6pgghstO8OEPVeKlh6cdbjTMM1gCIOQ045U8U1mwF10A0Cj7oV+wh93
-nAbowacYXVKV7cndJZ5t+qntozo00Fl72u1Q8zW/7esUTTHHYPTa8Yec4kjixsU3
-+wYQ+nVZZjFHKdp2mhzpgq7vmrlR94gjmmmVYjzlVYA211QC//G5Xc7UI2/YRYRK
-W2XviQzdFKcgyxilJbQN+QHwotL0AMh0jqEqSI5l2xPE4iUXfeu+h1sXIFRRk0pT
-AwvsXcoz7WL9RccvW9xYoIA55vrX/hMUpu09lEpCdNTDd1lzzY9GvlU47/rokTLq
-l1gEIt44w8y8bckzOmoKaT+gyOpyj4xjhiO9bTyWnpXgSUyqorkqG5w2gXjtw+hG
-4iZZRHUe2XWJUc0QhJ1hYMtd+ZciTY6Y5uN/9lu7rs3KSoFrXgvzUeF0K+l+J6fZ
-mUlO+KWA2yUPHGNiiskzZ2s8EIPGrd6ozRaOjfAHN3Gf8qv8QfXBi+wAN10J5U6A
-7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFZjCCA06gAwIBAgIQCgFCgAAAAUUjz0Z8AAAAAjANBgkqhkiG9w0BAQsFADBN
-MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MSowKAYDVQQDEyFJZGVu
-VHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwHhcNMTQwMTE2MTc1MzMyWhcN
-MzQwMTE2MTc1MzMyWjBNMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0
-MSowKAYDVQQDEyFJZGVuVHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwggIi
-MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2IpT8pEiv6EdrCvsnduTyP4o7
-ekosMSqMjbCpwzFrqHd2hCa2rIFCDQjrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy
-RBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS
-bdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF
-/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R
-3j6HEDbhuaR672BQssvKplbgN6+rNBM5Jeg5ZuSYeqoSmJxZZoY+rfGwyj4GD3vw
-EUs3oERte8uojHH01bWRNszwFcYr3lEXsZdMUD2xlVl8BX0tIdUAvwFnol57plzy
-9yLxkA2T26pEUWbMfXYD62qoKjgZl3YNa4ph+bz27nb9cCvdKTz4Ch5bQhyLVi9V
-GxyhLrXHFub4qjySjmm2AcG1hp2JDws4lFTo6tyePSW8Uybt1as5qsVATFSrsrTZ
-2fjXctscvG29ZV/viDUqZi/u9rNl8DONfJhBaUYPQxxp+pu10GFqzcpL2UyQRqsV
-WaFHVCkugyhfHMKiq3IXAAaOReyL4jM9f9oZRORicsPfIsbyVtTdX5Vy7W1f90gD
-W/3FKqD2cyOEEBsB5wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
-BAUwAwEB/zAdBgNVHQ4EFgQU43HgntinQtnbcZFrlJPrw6PRFKMwDQYJKoZIhvcN
-AQELBQADggIBAEf63QqwEZE4rU1d9+UOl1QZgkiHVIyqZJnYWv6IAcVYpZmxI1Qj
-t2odIFflAWJBF9MJ23XLblSQdf4an4EKwt3X9wnQW3IV5B4Jaj0z8yGa5hV+rVHV
-DRDtfULAj+7AmgjVQdZcDiFpboBhDhXAuM/FSRJSzL46zNQuOAXeNf0fb7iAaJg9
-TaDKQGXSc3z1i9kKlT/YPyNtGtEqJBnZhbMX73huqVjRI9PHE+1yJX9dsXNw0H8G
-lwmEKYBhHfpe/3OsoOOJuBxxFcbeMX8S3OFtm6/n6J91eEyrRjuazr8FGF1NFTwW
-mhlQBJqymm9li1JfPFgEKCXAZmExfrngdbkaqIHWchezxQMxNRF4eKLg6TCMf4Df
-WN88uieW4oA0beOY02QnrEh+KHdcxiVhJfiFDGX6xDIvpZgF5PgLZxYWxoK4Mhn5
-+bl53B/N66+rDt0b20XkeucC4pVd/GnwU2lhlXV5C15V5jgclKlZM57IcXR5f1GJ
-tshquDDIajjDbp7hNxbqBWJMWxJH7ae0s1hWx0nzfxJoCTFx8G34Tkf71oXuxVhA
-GaQdp/lLQzfcaFpPz+vCZHTetBXZ9FRUGi8c15dxVJCO2SCdUyt/q4/i6jC8UDfv
-8Ue1fXwsBOxonbRJRBD0ckscZOf85muQ3Wl9af0AVqW3rLatt8o+Ae+c
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF8TCCA9mgAwIBAgIQALC3WhZIX7/hy/WL1xnmfTANBgkqhkiG9w0BAQsFADA4
-MQswCQYDVQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6
-ZW5wZS5jb20wHhcNMDcxMjEzMTMwODI4WhcNMzcxMjEzMDgyNzI1WjA4MQswCQYD
-VQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5j
-b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ03rKDx6sp4boFmVq
-scIbRTJxldn+EFvMr+eleQGPicPK8lVx93e+d5TzcqQsRNiekpsUOqHnJJAKClaO
-xdgmlOHZSOEtPtoKct2jmRXagaKH9HtuJneJWK3W6wyyQXpzbm3benhB6QiIEn6H
-LmYRY2xU+zydcsC8Lv/Ct90NduM61/e0aL6i9eOBbsFGb12N4E3GVFWJGjMxCrFX
-uaOKmMPsOzTFlUFpfnXCPCDFYbpRR6AgkJOhkEvzTnyFRVSa0QUmQbC1TR0zvsQD
-yCV8wXDbO/QJLVQnSKwv4cSsPsjLkkxTOTcj7NMB+eAJRE1NZMDhDVqHIrytG6P+
-JrUV86f8hBnp7KGItERphIPzidF0BqnMC9bC3ieFUCbKF7jJeodWLBoBHmy+E60Q
-rLUk9TiRodZL2vG70t5HtfG8gfZZa88ZU+mNFctKy6lvROUbQc/hhqfK0GqfvEyN
-BjNaooXlkDWgYlwWTvDjovoDGrQscbNYLN57C9saD+veIR8GdwYDsMnvmfzAuU8L
-hij+0rnq49qlw0dpEuDb8PYZi+17cNcC1u2HGCgsBCRMd+RIihrGO5rUD8r6ddIB
-QFqNeb+Lz0vPqhbBleStTIo+F5HUsWLlguWABKQDfo2/2n+iD5dPDNMN+9fR5XJ+
-HMh3/1uaD7euBUbl8agW7EekFwIDAQABo4H2MIHzMIGwBgNVHREEgagwgaWBD2lu
-Zm9AaXplbnBlLmNvbaSBkTCBjjFHMEUGA1UECgw+SVpFTlBFIFMuQS4gLSBDSUYg
-QTAxMzM3MjYwLVJNZXJjLlZpdG9yaWEtR2FzdGVpeiBUMTA1NSBGNjIgUzgxQzBB
-BgNVBAkMOkF2ZGEgZGVsIE1lZGl0ZXJyYW5lbyBFdG9yYmlkZWEgMTQgLSAwMTAx
-MCBWaXRvcmlhLUdhc3RlaXowDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
-AQYwHQYDVR0OBBYEFB0cZQ6o8iV7tJHP5LGx5r1VdGwFMA0GCSqGSIb3DQEBCwUA
-A4ICAQB4pgwWSp9MiDrAyw6lFn2fuUhfGI8NYjb2zRlrrKvV9pF9rnHzP7MOeIWb
-laQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56
-awmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo
-JNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw
-LDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6kfLqCT
-VyvehQP5aTfLnnhqBbTFMXiJ7HqnheG5ezzevh55hM6fcA5ZwjUukCox2eRFekGk
-LhObNA5me0mrZJfQRsN5nXJQY6aYWwa9SG3YOYNw6DXwBdGqvOPbyALqfP2C2sJb
-UjWumDqtujWTI6cfSN01RpiyEGjkpTHCClguGYEQyVB1/OpaFs4R1+7vUIgtYf8/
-QnMFlEPVjjxOAToZpR9GTnfQXeWBIiGH/pR9hNiTrdZoQ0iy2+tzJOeRf1SktoA+
-naM8THLCV8Sg1Mw4J87VBp6iSNnpn86CcDaTmjvfliHjWbcM2pE38P1ZWrOZyGls
-QyYBNWNgVYkDOnXYukrZVP/u3oDYLdE41V4tC5h9Pmzb/CaIxw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFwzCCA6ugAwIBAgIUCn6m30tEntpqJIWe5rgV0xZ/u7EwDQYJKoZIhvcNAQEL
-BQAwRjELMAkGA1UEBhMCTFUxFjAUBgNVBAoMDUx1eFRydXN0IFMuQS4xHzAdBgNV
-BAMMFkx1eFRydXN0IEdsb2JhbCBSb290IDIwHhcNMTUwMzA1MTMyMTU3WhcNMzUw
-MzA1MTMyMTU3WjBGMQswCQYDVQQGEwJMVTEWMBQGA1UECgwNTHV4VHJ1c3QgUy5B
-LjEfMB0GA1UEAwwWTHV4VHJ1c3QgR2xvYmFsIFJvb3QgMjCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBANeFl78RmOnwYoNMPIf5U2o3C/IPPIfOb9wmKb3F
-ibrJgz337spbxm1Jc7TJRqMbNBM/wYlFV/TZsfs2ZUv7COJIcRHIbjuend+JZTem
-hfY7RBi2xjcwYkSSl2l9QjAk5A0MiWtj3sXh306pFGxT4GHO9hcvHTy95iJMHZP1
-EMShduxq3sVs35a0VkBCwGKSMKEtFZSg0iAGCW5qbeXrt77U8PEVfIvmTroTzEsn
-Xpk8F12PgX8zPU/TPxvsXD/wPEx1bvKm1Z3aLQdjAsZy6ZS8TEmVT4hSyNvoaYL4
-zDRbIvCGp4m9SAptZoFtyMhk+wHh9OHe2Z7d21vUKpkmFRseTJIpgp7VkoGSQXAZ
-96Tlk0u8d2cx3Rz9MXANF5kM+Qw5GSoXtTBxVdUPrljhPS80m8+f9niFwpN6cj5m
-j5wWEWCPnolvZ77gR1o7DJpni89Gxq44o/KnvObWhWszJHAiS8sIm7vI+AIpHb4g
-DEa/a4ebsypmQjVGbKq6rfmYe+lQVRQxv7HaLe2ArWgk+2mr2HETMOZns4dA/Yl+
-8kPREd8vZS9kzl8UubG/Mb2HeFpZZYiq/FkySIbWTLkpS5XTdvN3JW1CHDiDTf2j
-X5t/Lax5Gw5CMZdjpPuKadUiDTSQMC6otOBttpSsvItO13D8xTiOZCXhTTmQzsmH
-hFhxAgMBAAGjgagwgaUwDwYDVR0TAQH/BAUwAwEB/zBCBgNVHSAEOzA5MDcGByuB
-KwEBAQowLDAqBggrBgEFBQcCARYeaHR0cHM6Ly9yZXBvc2l0b3J5Lmx1eHRydXN0
-Lmx1MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBT/GCh2+UgFLKGu8SsbK7JT
-+Et8szAdBgNVHQ4EFgQU/xgodvlIBSyhrvErGyuyU/hLfLMwDQYJKoZIhvcNAQEL
-BQADggIBAGoZFO1uecEsh9QNcH7X9njJCwROxLHOk3D+sFTAMs2ZMGQXvw/l4jP9
-BzZAcg4atmpZ1gDlaCDdLnINH2pkMSCEfUmmWjfrRcmF9dTHF5kH5ptV5AzoqbTO
-jFu1EVzPig4N1qx3gf4ynCSecs5U89BvolbW7MM3LGVYvlcAGvI1+ut7MV3CwRI9
-loGIlonBWVx65n9wNOeD4rHh4bhY79SV5GCc8JaXcozrhAIuZY+kt9J/Z93I055c
-qqmkoCUUBpvsT34tC38ddfEz2O3OuHVtPlu5mB0xDVbYQw8wkbIEa91WvpWAVWe+
-2M2D2RjuLg+GLZKecBPs3lHJQ3gCpU3I+V/EkVhGFndadKpAvAefMLmx9xIX3eP/
-JEAdemrRTxgKqpAd60Ae36EeRJIQmvKN4dFLRp7oRUKX6kWZ8+xm1QL68qZKJKre
-zrnK+T+Tb/mjuuqlPpmt/f97mfVl7vBZKGfXkJWkE4SphMHozs51k2MavDzq1WQf
-LSoSOcbDWjLtR5EWDrw4wVDej8oqkDQc7kGUnF4ZLvhFSZl0kbAEb+MEWrGrKqv+
-x9CWttrhSmQGbmBNvUJO/3jaJMobtNeWOWyu8Q6qp31IiyBMz2TWuJdGsE7RKlY6
-oJO9r4Ak4Ap+58rVyuiFVdw2KuGUaJPHZnJED4AhMmwlxyOAgwrr
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIECjCCAvKgAwIBAgIJAMJ+QwRORz8ZMA0GCSqGSIb3DQEBCwUAMIGCMQswCQYD
-VQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFjAUBgNVBAoMDU1pY3Jvc2VjIEx0
-ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G
-CSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y
-OTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx
-FjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3pp
-Z25vIFJvb3QgQ0EgMjAwOTEfMB0GCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5o
-dTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOn4j/NjrdqG2KfgQvvP
-kd6mJviZpWNwrZuuyjNAfW2WbqEORO7hE52UQlKavXWFdCyoDh2Tthi3jCyoz/tc
-cbna7P7ofo/kLx2yqHWH2Leh5TvPmUpG0IMZfcChEhyVbUr02MelTTMuhTlAdX4U
-fIASmFDHQWe4oIBhVKZsTh/gnQ4H6cm6M+f+wFUoLAKApxn1ntxVUwOXewdI/5n7
-N4okxFnMUBBjjqqpGrCEGob5X7uxUG6k0QrM1XF+H6cbfPVTbiJfyyvm1HxdrtbC
-xkzlBQHZ7Vf8wSN5/PrIJIOV87VqUQHQd9bpEqH5GoP7ghu5sJf0dgYzQ0mg/wu1
-+rUCAwEAAaOBgDB+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G
-A1UdDgQWBBTLD8bfQkPMPcu1SCOhGnqmKrs0aDAfBgNVHSMEGDAWgBTLD8bfQkPM
-Pcu1SCOhGnqmKrs0aDAbBgNVHREEFDASgRBpbmZvQGUtc3ppZ25vLmh1MA0GCSqG
-SIb3DQEBCwUAA4IBAQDJ0Q5eLtXMs3w+y/w9/w0olZMEyL/azXm4Q5DwpL7v8u8h
-mLzU1F0G9u5C7DBsoKqpyvGvivo/C3NqPuouQH4frlRheesuCDfXI/OMn74dseGk
-ddug4lQUsbocKaQY9hK6ohQU4zE1yED/t+AFdlfBHFny+L/k7SViXITwfn4fs775
-tyERzAMBVnCnEJIeGzSBHq2cGsMEPO0CYdYeBvNfOofyK/FFh+U9rNHHV4S9a67c
-2Pm2G2JwCz02yULyMtd6YebS2z3PyKnJm9zbWETXbzivf3jTo60adbocwTZ8jx5t
-HMN1Rq41Bab2XD0h7lbwyYIiLXpUq3DDfSJlgnCW
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQG
-EwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5ldExvY2sgS2Z0LjE3
-MDUGA1UECwwuVGFuw7pzw610dsOhbnlraWFkw7NrIChDZXJ0aWZpY2F0aW9uIFNl
-cnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBBcmFueSAoQ2xhc3MgR29sZCkgRsWR
-dGFuw7pzw610dsOhbnkwHhcNMDgxMjExMTUwODIxWhcNMjgxMjA2MTUwODIxWjCB
-pzELMAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxOZXRM
-b2NrIEtmdC4xNzA1BgNVBAsMLlRhbsO6c8OtdHbDoW55a2lhZMOzayAoQ2VydGlm
-aWNhdGlvbiBTZXJ2aWNlcykxNTAzBgNVBAMMLE5ldExvY2sgQXJhbnkgKENsYXNz
-IEdvbGQpIEbFkXRhbsO6c8OtdHbDoW55MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAxCRec75LbRTDofTjl5Bu0jBFHjzuZ9lk4BqKf8owyoPjIMHj9DrT
-lF8afFttvzBPhCf2nx9JvMaZCpDyD/V/Q4Q3Y1GLeqVw/HpYzY6b7cNGbIRwXdrz
-AZAj/E4wqX7hJ2Pn7WQ8oLjJM2P+FpD/sLj916jAwJRDC7bVWaaeVtAkH3B5r9s5
-VA1lddkVQZQBr17s9o3x/61k/iCa11zr/qYfCGSji3ZVrR47KGAuhyXoqq8fxmRG
-ILdwfzzeSNuWU7c5d+Qa4scWhHaXWy+7GRWF+GmF9ZmnqfI0p6m2pgP8b4Y9VHx2
-BJtr+UBdADTHLpl1neWIA6pN+APSQnbAGwIDAKiLo0UwQzASBgNVHRMBAf8ECDAG
-AQH/AgEEMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUzPpnk/C2uNClwB7zU/2M
-U9+D15YwDQYJKoZIhvcNAQELBQADggEBAKt/7hwWqZw8UQCgwBEIBaeZ5m8BiFRh
-bvG5GK1Krf6BQCOUL/t1fC8oS2IkgYIL9WHxHG64YTjrgfpioTtaYtOUZcTh5m2C
-+C8lcLIhJsFyUR+MLMOEkMNaj7rP9KdlpeuY0fsFskZ1FSNqb4VjMIDw1Z4fKRzC
-bLBQWV2QWzuoDTDPv31/zvGdg73JRm4gpvlhUbohL3u+pRVjodSVh/GeufOJ8z2F
-uLjbvrW5KfnaNwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2
-XjG4Kvte9nHfRCaexOYNkbQudZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID5jCCAs6gAwIBAgIQV8szb8JcFuZHFhfjkDFo4DANBgkqhkiG9w0BAQUFADBi
-MQswCQYDVQQGEwJVUzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMu
-MTAwLgYDVQQDEydOZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3Jp
-dHkwHhcNMDYxMjAxMDAwMDAwWhcNMjkxMjMxMjM1OTU5WjBiMQswCQYDVQQGEwJV
-UzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMuMTAwLgYDVQQDEydO
-ZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkvH6SMG3G2I4rC7xGzuAnlt7e+foS0zwz
-c7MEL7xxjOWftiJgPl9dzgn/ggwbmlFQGiaJ3dVhXRncEg8tCqJDXRfQNJIg6nPP
-OCwGJgl6cvf6UDL4wpPTaaIjzkGxzOTVHzbRijr4jGPiFFlp7Q3Tf2vouAPlT2rl
-mGNpSAW+Lv8ztumXWWn4Zxmuk2GWRBXTcrA/vGp97Eh/jcOrqnErU2lBUzS1sLnF
-BgrEsEX1QV1uiUV7PTsmjHTC5dLRfbIR1PtYMiKagMnc/Qzpf14Dl847ABSHJ3A4
-qY5usyd2mFHgBeMhqxrVhSI8KbWaFsWAqPS7azCPL0YCorEMIuDTAgMBAAGjgZcw
-gZQwHQYDVR0OBBYEFCEwyfsA106Y2oeqKtCnLrFAMadMMA4GA1UdDwEB/wQEAwIB
-BjAPBgNVHRMBAf8EBTADAQH/MFIGA1UdHwRLMEkwR6BFoEOGQWh0dHA6Ly9jcmwu
-bmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zQ2VydGlmaWNhdGVBdXRob3Jp
-dHkuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8
-6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/
-h1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH
-/nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv
-wKeI8lN3s2Berq4o2jUsbzRF0ybh3uxbTydrFny9RAQYgrOJeRcQcT16ohZO9QHN
-pGxlaKFJdlxDydi8NmdspZS11My5vWo1ViHe2MPr+8ukYEywVaCge1ey
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID8TCCAtmgAwIBAgIQQT1yx/RrH4FDffHSKFTfmjANBgkqhkiG9w0BAQUFADCB
-ijELMAkGA1UEBhMCQ0gxEDAOBgNVBAoTB1dJU2VLZXkxGzAZBgNVBAsTEkNvcHly
-aWdodCAoYykgMjAwNTEiMCAGA1UECxMZT0lTVEUgRm91bmRhdGlvbiBFbmRvcnNl
-ZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwgUm9vdCBHQSBDQTAeFw0w
-NTEyMTExNjAzNDRaFw0zNzEyMTExNjA5NTFaMIGKMQswCQYDVQQGEwJDSDEQMA4G
-A1UEChMHV0lTZUtleTEbMBkGA1UECxMSQ29weXJpZ2h0IChjKSAyMDA1MSIwIAYD
-VQQLExlPSVNURSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBX
-SVNlS2V5IEdsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR
-VVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2
-w93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF
-mQvtRTEJysIA2/dyoJaqlYfQjse2YXMNdmaM3Bu0Y6Kff5MTMPGhJ9vZ/yxViJGg
-4E8HsChWjBgbl0SOid3gF27nKu+POQoxhILYQBRJLnpB5Kf+42TMwVlxSywhp1t9
-4B3RLoGbw9ho972WG6xwsRYUC9tguSYBBQIDAQABo1EwTzALBgNVHQ8EBAMCAYYw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUswN+rja8sHnR3JQmthG+IbJphpQw
-EAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBAEuh/wuHbrP5wUOx
-SPMowB0uyQlB+pQAHKSkq0lPjz0e701vvbyk9vImMMkQyh2I+3QZH4VFvbBsUfk2
-ftv1TDI6QU9bR8/oCy22xBmddMVHxjtqD6wU2zz0c5ypBd8A3HR4+vg1YFkCExh8
-vPtNsCBtQ7tgMHpnM1zFmdH4LTlSc/uMqpclXHLZCB6rTjzjgTGfA6b7wP4piFXa
-hNVQA7bihKOmNqoROgHhGEvWRGizPflTdISzRpFGlgC3gCy24eMQ4tui5yiPAZZi
-Fj4A4xylNoEYokxSdsARo27mHbrjWr42U8U+dY+GaSlYU7Wcu2+fXMUY7N0v4ZjJ
-/L7fCg0=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIQdrEgUnTwhYdGs/gjGvbCwDANBgkqhkiG9w0BAQsFADBt
-MQswCQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUg
-Rm91bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9i
-YWwgUm9vdCBHQiBDQTAeFw0xNDEyMDExNTAwMzJaFw0zOTEyMDExNTEwMzFaMG0x
-CzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBG
-b3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2Jh
-bCBSb290IEdCIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2Be3
-HEokKtaXscriHvt9OO+Y9bI5mE4nuBFde9IllIiCFSZqGzG7qFshISvYD06fWvGx
-WuR51jIjK+FTzJlFXHtPrby/h0oLS5daqPZI7H17Dc0hBt+eFf1Biki3IPShehtX
-1F1Q/7pn2COZH8g/497/b1t3sWtuuMlk9+HKQUYOKXHQuSP8yYFfTvdv37+ErXNk
-u7dCjmn21HYdfp2nuFeKUWdy19SouJVUQHMD9ur06/4oQnc/nSMbsrY9gBQHTC5P
-99UKFg29ZkM3fiNDecNAhvVMKdqOmq0NpQSHiB6F4+lT1ZvIiwNjeOvgGUpuuy9r
-M2RYk61pv48b74JIxwIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUw
-AwEB/zAdBgNVHQ4EFgQUNQ/INmNe4qPs+TtmFc5RUuORmj0wEAYJKwYBBAGCNxUB
-BAMCAQAwDQYJKoZIhvcNAQELBQADggEBAEBM+4eymYGQfp3FsLAmzYh7KzKNbrgh
-cViXfa43FK8+5/ea4n32cZiZBKpDdHij40lhPnOMTZTg+XHEthYOU3gf1qKHLwI5
-gSk8rxWYITD+KJAAjNHhy/peyP34EEY7onhCkRd0VQreUGdNZtGn//3ZwLWoo4rO
-ZvUPQ82nK1d7Y0Zqqi5S2PTt4W2tKZB4SLrhI6qjiey1q5bAtEuiHZeeevJuQHHf
-aPFlTc58Bd9TZaml8LGXBHAVRgOY1NK/VLSgWH1Sb9pWJmLU2NuJMW8c8CLC02Ic
-Nc1MaRVUGpCY3useX8p3x8uOPUNpnJpY0CQ73xtAln41rYHHTnG6iBM=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICaTCCAe+gAwIBAgIQISpWDK7aDKtARb8roi066jAKBggqhkjOPQQDAzBtMQsw
-CQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUgRm91
-bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwg
-Um9vdCBHQyBDQTAeFw0xNzA1MDkwOTQ4MzRaFw00MjA1MDkwOTU4MzNaMG0xCzAJ
-BgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBGb3Vu
-ZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2JhbCBS
-b290IEdDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETOlQwMYPchi82PG6s4ni
-eUqjFqdrVCTbUf/q9Akkwwsin8tqJ4KBDdLArzHkdIJuyiXZjHWd8dvQmqJLIX4W
-p2OQ0jnUsYd4XxiWD1AbNTcPasbc2RNNpI6QN+a9WzGRo1QwUjAOBgNVHQ8BAf8E
-BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUSIcUrOPDnpBgOtfKie7T
-rYy0UGYwEAYJKwYBBAGCNxUBBAMCAQAwCgYIKoZIzj0EAwMDaAAwZQIwJsdpW9zV
-57LnyAyMjMPdeYwbY9XJUpROTYJKcx6ygISpJcBMWm1JKWB4E+J+SOtkAjEA2zQg
-Mgj/mkkCtojeFK9dbJlxjRo/i9fgojaGHAeCOnZT/cKi7e97sIBPWA9LUzm9
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJC
-TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0
-aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0
-aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAzMTkxODMzMzNaFw0yMTAzMTcxODMz
-MzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUw
-IwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQDEyVR
-dW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Yp
-li4kVEAkOPcahdxYTMukJ0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2D
-rOpm2RgbaIr1VxqYuvXtdj182d6UajtLF8HVj71lODqV0D1VNk7feVcxKh7YWWVJ
-WCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeLYzcS19Dsw3sgQUSj7cug
-F+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWenAScOospU
-xbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCC
-Ak4wPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVv
-dmFkaXNvZmZzaG9yZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREw
-ggENMIIBCQYJKwYBBAG+WAABMIH7MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNl
-IG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh
-c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFy
-ZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh
-Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYI
-KwYBBQUHAgEWFmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3T
-KbkGGew5Oanwl4Rqy+/fMIGuBgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rq
-y+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1p
-dGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYD
-VQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6tlCL
-MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSk
-fnIYj9lofFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8
-7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R
-cHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y
-mQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW
-xFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi5nrQNiOK
-SnQ2+Q==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFYDCCA0igAwIBAgIUeFhfLq0sGUvjNwc1NBMotZbUZZMwDQYJKoZIhvcNAQEL
-BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
-BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMSBHMzAeFw0xMjAxMTIxNzI3NDRaFw00
-MjAxMTIxNzI3NDRaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
-aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDEgRzMwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCgvlAQjunybEC0BJyFuTHK3C3kEakEPBtV
-wedYMB0ktMPvhd6MLOHBPd+C5k+tR4ds7FtJwUrVu4/sh6x/gpqG7D0DmVIB0jWe
-rNrwU8lmPNSsAgHaJNM7qAJGr6Qc4/hzWHa39g6QDbXwz8z6+cZM5cOGMAqNF341
-68Xfuw6cwI2H44g4hWf6Pser4BOcBRiYz5P1sZK0/CPTz9XEJ0ngnjybCKOLXSoh
-4Pw5qlPafX7PGglTvF0FBM+hSo+LdoINofjSxxR3W5A2B4GbPgb6Ul5jxaYA/qXp
-UhtStZI5cgMJYr2wYBZupt0lwgNm3fME0UDiTouG9G/lg6AnhF4EwfWQvTA9xO+o
-abw4m6SkltFi2mnAAZauy8RRNOoMqv8hjlmPSlzkYZqn0ukqeI1RPToV7qJZjqlc
-3sX5kCLliEVx3ZGZbHqfPT2YfF72vhZooF6uCyP8Wg+qInYtyaEQHeTTRCOQiJ/G
-KubX9ZqzWB4vMIkIG1SitZgj7Ah3HJVdYdHLiZxfokqRmu8hqkkWCKi9YSgxyXSt
-hfbZxbGL0eUQMk1fiyA6PEkfM4VZDdvLCXVDaXP7a3F98N/ETH3Goy7IlXnLc6KO
-Tk0k+17kBL5yG6YnLUlamXrXXAkgt3+UuU/xDRxeiEIbEbfnkduebPRq34wGmAOt
-zCjvpUfzUwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
-BjAdBgNVHQ4EFgQUo5fW816iEOGrRZ88F2Q87gFwnMwwDQYJKoZIhvcNAQELBQAD
-ggIBABj6W3X8PnrHX3fHyt/PX8MSxEBd1DKquGrX1RUVRpgjpeaQWxiZTOOtQqOC
-MTaIzen7xASWSIsBx40Bz1szBpZGZnQdT+3Btrm0DWHMY37XLneMlhwqI2hrhVd2
-cDMT/uFPpiN3GPoajOi9ZcnPP/TJF9zrx7zABC4tRi9pZsMbj/7sPtPKlL92CiUN
-qXsCHKnQO18LwIE6PWThv6ctTr1NxNgpxiIY0MWscgKCP6o6ojoilzHdCGPDdRS5
-YCgtW2jgFqlmgiNR9etT2DGbe+m3nUvriBbP+V04ikkwj+3x6xn0dxoxGE1nVGwv
-b2X52z3sIexe9PSLymBlVNFxZPT5pqOBMzYzcfCkeF9OrYMh3jRJjehZrJ3ydlo2
-8hP0r+AJx2EqbPfgna67hkooby7utHnNkDPDs3b69fBsnQGQ+p6Q9pxyz0fawx/k
-NSBT8lTR32GDpgLiJTjehTItXnOQUl1CxM49S+H5GYQd1aJQzEH7QRTDvdbJWqNj
-ZgKAvQU6O0ec7AAmTPWIUb+oI38YB7AL7YsmoWTTYUrrXJ/es69nA7Mf3W1daWhp
-q1467HxpvMc7hU6eFbm0FU/DlXpY18ls6Wy58yljXrQs8C097Vpl4KlbQMJImYFt
-nh8GKjwStIsPm6Ik8KaN1nrgS7ZklmOVhMJKzRwuJIczYOXD
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
-GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
-b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV
-BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
-YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa
-GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg
-Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J
-WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB
-rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp
-+ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1
-ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i
-Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz
-PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og
-/zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH
-oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI
-yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud
-EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2
-A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL
-MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT
-ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f
-BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn
-g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl
-fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K
-WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha
-B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc
-hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR
-TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD
-mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z
-ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y
-4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza
-8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFYDCCA0igAwIBAgIURFc0JFuBiZs18s64KztbpybwdSgwDQYJKoZIhvcNAQEL
-BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
-BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMiBHMzAeFw0xMjAxMTIxODU5MzJaFw00
-MjAxMTIxODU5MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
-aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDIgRzMwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQChriWyARjcV4g/Ruv5r+LrI3HimtFhZiFf
-qq8nUeVuGxbULX1QsFN3vXg6YOJkApt8hpvWGo6t/x8Vf9WVHhLL5hSEBMHfNrMW
-n4rjyduYNM7YMxcoRvynyfDStNVNCXJJ+fKH46nafaF9a7I6JaltUkSs+L5u+9ym
-c5GQYaYDFCDy54ejiK2toIz/pgslUiXnFgHVy7g1gQyjO/Dh4fxaXc6AcW34Sas+
-O7q414AB+6XrW7PFXmAqMaCvN+ggOp+oMiwMzAkd056OXbxMmO7FGmh77FOm6RQ1
-o9/NgJ8MSPsc9PG/Srj61YxxSscfrf5BmrODXfKEVu+lV0POKa2Mq1W/xPtbAd0j
-IaFYAI7D0GoT7RPjEiuA3GfmlbLNHiJuKvhB1PLKFAeNilUSxmn1uIZoL1NesNKq
-IcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz
-8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh
-vNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l
-7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwNkALG
-cC4BrTwV1wIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
-BjAdBgNVHQ4EFgQU7edvdlq/YOxJW8ald7tyFnGbxD0wDQYJKoZIhvcNAQELBQAD
-ggIBAJHfgD9DCX5xwvfrs4iP4VGyvD11+ShdyLyZm3tdquXK4Qr36LLTn91nMX66
-AarHakE7kNQIXLJgapDwyM4DYvmL7ftuKtwGTTwpD4kWilhMSA/ohGHqPHKmd+RC
-roijQ1h5fq7KpVMNqT1wvSAZYaRsOPxDMuHBR//47PERIjKWnML2W2mWeyAMQ0Ga
-W/ZZGYjeVYg3UQt4XAoeo0L9x52ID8DyeAIkVJOviYeIyUqAHerQbj5hLja7NQ4n
-lv1mNDthcnPxFlxHBlRJAHpYErAK74X9sbgzdWqTHBLmYF5vHX/JHyPLhGGfHoJE
-+V+tYlUkmlKY7VHnoX6XOuYvHxHaU4AshZ6rNRDbIl9qxV6XU/IyAgkwo1jwDQHV
-csaxfGl7w/U2Rcxhbl5MlMVerugOXou/983g7aEOGzPuVBj+D77vfoRrQ+NwmNtd
-dbINWQeFFSM51vHfqSYP1kjHs6Yi9TM3WpVHn3u6GBVv/9YUZINJ0gpnIdsPNWNg
-KCLjsZWDzYWm3S8P52dSbrsvhXz1SnPnxT7AvSESBT/8twNJAlvIJebiVDj1eYeM
-HVOyToV7BjjHLPj4sHKNJeV3UvQDHEimUF+IIDBu8oJDqz2XhOdT+yHBTw8imoa4
-WSr2Rz0ZiC3oheGe7IUIarFsNMkd7EgrO3jtZsSOeWmD3n+M
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
-GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
-b3QgQ0EgMzAeFw0wNjExMjQxOTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNV
-BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
-YWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDM
-V0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNggDhoB
-4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUr
-H556VOijKTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd
-8lyyBTNvijbO0BNO/79KDDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9Cabwv
-vWhDFlaJKjdhkf2mrk7AyxRllDdLkgbvBNDInIjbC3uBr7E9KsRlOni27tyAsdLT
-mZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwpp5ijJUMv7/FfJuGITfhe
-btfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8nT8KKdjc
-T5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDt
-WAEXMJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZ
-c6tsgLjoC2SToJyMGf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A
-4iLItLRkT9a6fUg+qGkM17uGcclzuD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYD
-VR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHTBgkrBgEEAb5YAAMwgcUwgZMG
-CCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmljYXRlIGNvbnN0
-aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0
-aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu
-dC4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2Nw
-czALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4G
-A1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4ywLQoUmkRzBFMQswCQYDVQQGEwJC
-TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg
-Um9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0
-7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem
-d1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd
-+LJ2w/w4E6oM3kJpK27zPOuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B
-4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadN
-t54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp8kokUvd0/bpO5qgdAm6x
-DYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBCbjPsMZ57
-k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6s
-zHXug/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0j
-Wy10QJLZYxkNc91pvGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeT
-mJlglFwjz1onl14LBQaTNx47aTbrqZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK
-4SVhM7JZG+Ju1zdXtg2pEto=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFYDCCA0igAwIBAgIULvWbAiin23r/1aOp7r0DoM8Sah0wDQYJKoZIhvcNAQEL
-BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
-BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMyBHMzAeFw0xMjAxMTIyMDI2MzJaFw00
-MjAxMTIyMDI2MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
-aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDMgRzMwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCzyw4QZ47qFJenMioKVjZ/aEzHs286IxSR
-/xl/pcqs7rN2nXrpixurazHb+gtTTK/FpRp5PIpM/6zfJd5O2YIyC0TeytuMrKNu
-FoM7pmRLMon7FhY4futD4tN0SsJiCnMK3UmzV9KwCoWdcTzeo8vAMvMBOSBDGzXR
-U7Ox7sWTaYI+FrUoRqHe6okJ7UO4BUaKhvVZR74bbwEhELn9qdIoyhA5CcoTNs+c
-ra1AdHkrAj80//ogaX3T7mH1urPnMNA3I4ZyYUUpSFlob3emLoG+B01vr87ERROR
-FHAGjx+f+IdpsQ7vw4kZ6+ocYfx6bIrc1gMLnia6Et3UVDmrJqMz6nWB2i3ND0/k
-A9HvFZcba5DFApCTZgIhsUfei5pKgLlVj7WiL8DWM2fafsSntARE60f75li59wzw
-eyuxwHApw0BiLTtIadwjPEjrewl5qW3aqDCYz4ByA4imW0aucnl8CAMhZa634Ryl
-sSqiMd5mBPfAdOhx3v89WcyWJhKLhZVXGqtrdQtEPREoPHtht+KPZ0/l7DxMYIBp
-VzgeAVuNVejH38DMdyM0SXV89pgR6y3e7UEuFAUCf+D+IOs15xGsIs5XPd7JMG0Q
-A4XN8f+MFrXBsj6IbGB/kE+V9/YtrQE5BwT6dYB9v0lQ7e/JxHwc64B+27bQ3RP+
-ydOc17KXqQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
-BjAdBgNVHQ4EFgQUxhfQvKjqAkPyGwaZXSuQILnXnOQwDQYJKoZIhvcNAQELBQAD
-ggIBADRh2Va1EodVTd2jNTFGu6QHcrxfYWLopfsLN7E8trP6KZ1/AvWkyaiTt3px
-KGmPc+FSkNrVvjrlt3ZqVoAh313m6Tqe5T72omnHKgqwGEfcIHB9UqM+WXzBusnI
-FUBhynLWcKzSt/Ac5IYp8M7vaGPQtSCKFWGafoaYtMnCdvvMujAWzKNhxnQT5Wvv
-oxXqA/4Ti2Tk08HS6IT7SdEQTXlm66r99I0xHnAUrdzeZxNMgRVhvLfZkXdxGYFg
-u/BYpbWcC/ePIlUnwEsBbTuZDdQdm2NnL9DuDcpmvJRPpq3t/O5jrFc/ZSXPsoaP
-0Aj/uHYUbt7lJ+yreLVTubY/6CD50qi+YUbKh4yE8/nxoGibIh6BJpsQBJFxwAYf
-3KDTuVan45gtf4Od34wrnDKOMpTwATwiKp9Dwi7DmDkHOHv8XgBCH/MyJnmDhPbl
-8MFREsALHgQjDFSlTC9JxUrRtm5gDWv8a4uFJGS3iQ6rJUdbPM9+Sb3H6QrG2vd+
-DhcI00iX0HGS8A85PjRqHH3Y8iKuu2n0M7SmSFXRDw4m6Oy2Cy2nhTXN/VnIn9HN
-PlopNLk9hM6xZdRZkZFWdSHBd575euFgndOtBBj0fOtek49TSiIp+EgrPk2GrFt/
-ywaZWWDYWGWVjUTR939+J399roD1B0y2PpxxVJkES/1Y+Zj0
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIClDCCAhqgAwIBAgIILCmcWxbtBZUwCgYIKoZIzj0EAwIwfzELMAkGA1UEBhMC
-VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T
-U0wgQ29ycG9yYXRpb24xNDAyBgNVBAMMK1NTTC5jb20gRVYgUm9vdCBDZXJ0aWZp
-Y2F0aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNTIzWhcNNDEwMjEyMTgx
-NTIzWjB/MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv
-dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrU1NMLmNv
-bSBFViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49
-AgEGBSuBBAAiA2IABKoSR5CYG/vvw0AHgyBO8TCCogbR8pKGYfL2IWjKAMTH6kMA
-VIbc/R/fALhBYlzccBYy3h+Z1MzFB8gIH2EWB1E9fVwHU+M1OIzfzZ/ZLg1Kthku
-WnBaBu2+8KGwytAJKaNjMGEwHQYDVR0OBBYEFFvKXuXe0oGqzagtZFG22XKbl+ZP
-MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUW8pe5d7SgarNqC1kUbbZcpuX
-5k8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2gAMGUCMQCK5kCJN+vp1RPZ
-ytRrJPOwPYdGWBrssd9v+1a6cGvHOMzosYxPD/fxZ3YOg9AeUY8CMD32IygmTMZg
-h5Mmm7I1HrrW9zzRHM76JTymGoEVW/MSD2zuZYrJh6j5B+BimoxcSg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF6zCCA9OgAwIBAgIIVrYpzTS8ePYwDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNV
-BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
-CgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQDDC5TU0wuY29tIEVWIFJvb3QgQ2Vy
-dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyMB4XDTE3MDUzMTE4MTQzN1oXDTQy
-MDUzMDE4MTQzN1owgYIxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4G
-A1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQD
-DC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIy
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjzZlQOHWTcDXtOlG2mvq
-M0fNTPl9fb69LT3w23jhhqXZuglXaO1XPqDQCEGD5yhBJB/jchXQARr7XnAjssuf
-OePPxU7Gkm0mxnu7s9onnQqG6YE3Bf7wcXHswxzpY6IXFJ3vG2fThVUCAtZJycxa
-4bH3bzKfydQ7iEGonL3Lq9ttewkfokxykNorCPzPPFTOZw+oz12WGQvE43LrrdF9
-HSfvkusQv1vrO6/PgN3B0pYEW3p+pKk8OHakYo6gOV7qd89dAFmPZiw+B6KjBSYR
-aZfqhbcPlgtLyEDhULouisv3D5oi53+aNxPN8k0TayHRwMwi8qFG9kRpnMphNQcA
-b9ZhCBHqurj26bNg5U257J8UZslXWNvNh2n4ioYSA0e/ZhN2rHd9NCSFg83XqpyQ
-Gp8hLH94t2S42Oim9HizVcuE0jLEeK6jj2HdzghTreyI/BXkmg3mnxp3zkyPuBQV
-PWKchjgGAGYS5Fl2WlPAApiiECtoRHuOec4zSnaqW4EWG7WK2NAAe15itAnWhmMO
-pgWVSbooi4iTsjQc2KRVbrcc0N6ZVTsj9CLg+SlmJuwgUHfbSguPvuUCYHBBXtSu
-UDkiFCbLsjtzdFVHB3mBOagwE0TlBIqulhMlQg+5U8Sb/M3kHN48+qvWBkofZ6aY
-MBzdLNvcGJVXZsb/XItW9XcCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV
-HSMEGDAWgBT5YLvU49U09rj1BoAlp3PbRmmonjAdBgNVHQ4EFgQU+WC71OPVNPa4
-9QaAJadz20ZpqJ4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBW
-s47LCp1Jjr+kxJG7ZhcFUZh1++VQLHqe8RT6q9OKPv+RKY9ji9i0qVQBDb6Thi/5
-Sm3HXvVX+cpVHBK+Rw82xd9qt9t1wkclf7nxY/hoLVUE0fKNsKTPvDxeH3jnpaAg
-cLAExbf3cqfeIg29MyVGjGSSJuM+LmOW2puMPfgYCdcDzH2GguDKBAdRUNf/ktUM
-79qGn5nX67evaOI5JpS6aLe/g9Pqemc9YmeuJeVy6OLk7K4S9ksrPJ/psEDzOFSz
-/bdoyNrGj1E8svuR3Bznm53htw1yj+KkxKl4+esUrMZDBcJlOSgYAsOCsp0FvmXt
-ll9ldDz7CTUue5wT/RsPXcdtgTpWD8w74a8CLyKsRspGPKAcTNZEtF4uXBVmCeEm
-Kf7GUmG6sXP/wwyc5WxqlD8UykAWlYTzWamsX0xhk23RO8yilQwipmdnRC652dKK
-QbNmC1r7fSOl8hqw/96bg5Qu0T/fkreRrwU7ZcegbLHNYhLDkBvjJc40vG93drEQ
-w/cFGsDWr3RiSBd3kmmQYRzelYB0VI8YHMPzA9C/pEN1hlMYegouCRw2n5H9gooi
-S9EOUCXdywMMF8mDAAhONU2Ki+3wApRmLER/y5UnlhetCTCstnEXbosX9hwJ1C07
-mKVx01QT2WDz9UtmT/rx7iASjbSsV7FFY6GsdqnC+w==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICjTCCAhSgAwIBAgIIdebfy8FoW6gwCgYIKoZIzj0EAwIwfDELMAkGA1UEBhMC
-VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T
-U0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0
-aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNDAzWhcNNDEwMjEyMTgxNDAz
-WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0
-b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNvbSBS
-b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuB
-BAAiA2IABEVuqVDEpiM2nl8ojRfLliJkP9x6jh3MCLOicSS6jkm5BBtHllirLZXI
-7Z4INcgn64mMU1jrYor+8FsPazFSY0E7ic3s7LaNGdM0B9y7xgZ/wkWV7Mt/qCPg
-CemB+vNH06NjMGEwHQYDVR0OBBYEFILRhXMw5zUE044CkvvlpNHEIejNMA8GA1Ud
-EwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUgtGFczDnNQTTjgKS++Wk0cQh6M0wDgYD
-VR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2cAMGQCMG/n61kRpGDPYbCWe+0F+S8T
-kdzt5fxQaxFGRrMcIQBiu77D5+jNB5n5DQtdcj7EqgIwH7y6C+IwJPt8bYBVCpk+
-gA0z5Wajs6O7pdWLjwkspl1+4vAHCGht0nxpbl/f5Wpl
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF3TCCA8WgAwIBAgIIeyyb0xaAMpkwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UE
-BhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQK
-DA9TU0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZp
-Y2F0aW9uIEF1dGhvcml0eSBSU0EwHhcNMTYwMjEyMTczOTM5WhcNNDEwMjEyMTcz
-OTM5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv
-dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNv
-bSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBAPkP3aMrfcvQKv7sZ4Wm5y4bunfh4/WvpOz6Sl2R
-xFdHaxh3a3by/ZPkPQ/CFp4LZsNWlJ4Xg4XOVu/yFv0AYvUiCVToZRdOQbngT0aX
-qhvIuG5iXmmxX9sqAn78bMrzQdjt0Oj8P2FI7bADFB0QDksZ4LtO7IZl/zbzXmcC
-C52GVWH9ejjt/uIZALdvoVBidXQ8oPrIJZK0bnoix/geoeOy3ZExqysdBP+lSgQ3
-6YWkMyv94tZVNHwZpEpox7Ko07fKoZOI68GXvIz5HdkihCR0xwQ9aqkpk8zruFvh
-/l8lqjRYyMEjVJ0bmBHDOJx+PYZspQ9AhnwC9FwCTyjLrnGfDzrIM/4RJTXq/LrF
-YD3ZfBjVsqnTdXgDciLKOsMf7yzlLqn6niy2UUb9rwPW6mBo6oUWNmuF6R7As93E
-JNyAKoFBbZQ+yODJgUEAnl6/f8UImKIYLEJAs/lvOCdLToD0PYFH4Ih86hzOtXVc
-US4cK38acijnALXRdMbX5J+tB5O2UzU1/Dfkw/ZdFr4hc96SCvigY2q8lpJqPvi8
-ZVWb3vUNiSYE/CUapiVpy8JtynziWV+XrOvvLsi81xtZPCvM8hnIk2snYxnP/Okm
-+Mpxm3+T/jRnhE6Z6/yzeAkzcLpmpnbtG3PrGqUNxCITIJRWCk4sbE6x/c+cCbqi
-M+2HAgMBAAGjYzBhMB0GA1UdDgQWBBTdBAkHovV6fVJTEpKV7jiAJQ2mWTAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFN0ECQei9Xp9UlMSkpXuOIAlDaZZMA4G
-A1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAIBgRlCn7Jp0cHh5wYfGV
-cpNxJK1ok1iOMq8bs3AD/CUrdIWQPXhq9LmLpZc7tRiRux6n+UBbkflVma8eEdBc
-Hadm47GUBwwyOabqG7B52B2ccETjit3E+ZUfijhDPwGFpUenPUayvOUiaPd7nNgs
-PgohyC0zrL/FgZkxdMF1ccW+sfAjRfSda/wZY52jvATGGAslu1OJD7OAUN5F7kR/
-q5R4ZJjT9ijdh9hwZXT7DrkT66cPYakylszeu+1jTBi7qUD3oFRuIIhxdRjqerQ0
-cuAjJ3dctpDqhiVAq+8zD8ufgr6iIPv2tS0a5sKFsXQP+8hlAqRSAUfdSSLBv9jr
-a6x+3uxjMxW3IwiPxg+NQVrdjsW5j+VFP3jbutIbQLH+cU0/4IGiul607BXgk90I
-H37hVZkLId6Tngr75qNJvTYw/ud3sqB1l7UtgYgXZSD32pAAn8lSzDLKNXz1PQ/Y
-K9f1JmzJBjSWFupwWRoyeXkLtoh/D1JIPb9s2KJELtFOt3JY04kTlf5Eq/jXixtu
-nLwsoFvVagCvXzfh1foQC5ichucmj87w7G6KVwuA406ywKBjYZC6VWg3dGq2ktuf
-oYYitmUnDuy2n0Jg5GfCtdpBC8TTi2EbvPofkSvXRAdeuims2cXp71NIWuuA8ShY
-Ic2wBlX7Jz9TkHCpBB5XJ7k=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDcjCCAlqgAwIBAgIUPopdB+xV0jLVt+O2XwHrLdzk1uQwDQYJKoZIhvcNAQEL
-BQAwUTELMAkGA1UEBhMCUEwxKDAmBgNVBAoMH0tyYWpvd2EgSXpiYSBSb3psaWN6
-ZW5pb3dhIFMuQS4xGDAWBgNVBAMMD1NaQUZJUiBST09UIENBMjAeFw0xNTEwMTkw
-NzQzMzBaFw0zNTEwMTkwNzQzMzBaMFExCzAJBgNVBAYTAlBMMSgwJgYDVQQKDB9L
-cmFqb3dhIEl6YmEgUm96bGljemVuaW93YSBTLkEuMRgwFgYDVQQDDA9TWkFGSVIg
-Uk9PVCBDQTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vD5QqEvN
-QLXOYeeWyrSh2gwisPq1e3YAd4wLz32ohswmUeQgPYUM1ljj5/QqGJ3a0a4m7utT
-3PSQ1hNKDJA8w/Ta0o4NkjrcsbH/ON7Dui1fgLkCvUqdGw+0w8LBZwPd3BucPbOw
-3gAeqDRHu5rr/gsUvTaE2g0gv/pby6kWIK05YO4vdbbnl5z5Pv1+TW9NL++IDWr6
-3fE9biCloBK0TXC5ztdyO4mTp4CEHCdJckm1/zuVnsHMyAHs6A6KCpbns6aH5db5
-BSsNl0BwPLqsdVqc1U2dAgrSS5tmS0YHF2Wtn2yIANwiieDhZNRnvDF5YTy7ykHN
-XGoAyDw4jlivAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD
-AgEGMB0GA1UdDgQWBBQuFqlKGLXLzPVvUPMjX/hd56zwyDANBgkqhkiG9w0BAQsF
-AAOCAQEAtXP4A9xZWx126aMqe5Aosk3AM0+qmrHUuOQn/6mWmc5G4G18TKI4pAZw
-8PRBEew/R40/cof5O/2kbytTAOD/OblqBw7rHRz2onKQy4I9EYKL0rufKq8h5mOG
-nXkZ7/e7DDWQw4rtTw/1zBLZpD67oPwglV9PJi8RI4NOdQcPv5vRtB3pEAT+ymCP
-oky4rc/hkA/NrgrHXXu3UNLUYfrVFdvXn4dRVOul4+vJhaAlIDf7js4MNIThPIGy
-d05DpYhfhmehPea0XGG2Ptv+tyjFogeutcrKjSoS75ftwjCkySp6+/NNIxuZMzSg
-LvWpCz/UXeHPhJ/iGcJfitYgHuNztw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDbTCCAlWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJKUDEr
-MCkGA1UEChMiSmFwYW4gQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcywgSW5jLjEcMBoG
-A1UEAxMTU2VjdXJlU2lnbiBSb290Q0ExMTAeFw0wOTA0MDgwNDU2NDdaFw0yOTA0
-MDgwNDU2NDdaMFgxCzAJBgNVBAYTAkpQMSswKQYDVQQKEyJKYXBhbiBDZXJ0aWZp
-Y2F0aW9uIFNlcnZpY2VzLCBJbmMuMRwwGgYDVQQDExNTZWN1cmVTaWduIFJvb3RD
-QTExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/XeqpRyQBTvLTJsz
-i1oURaTnkBbR31fSIRCkF/3frNYfp+TbfPfs37gD2pRY/V1yfIw/XwFndBWW4wI8
-h9uuywGOwvNmxoVF9ALGOrVisq/6nL+k5tSAMJjzDbaTj6nU2DbysPyKyiyhFTOV
-MdrAG/LuYpmGYz+/3ZMqg6h2uRMft85OQoWPIucuGvKVCbIFtUROd6EgvanyTgp9
-UK31BQ1FT0Zx/Sg+U/sE2C3XZR1KG/rPO7AxmjVuyIsG0wCR8pQIZUyxNAYAeoni
-8McDWc/V1uinMrPmmECGxc0nEovMe863ETxiYAcjPitAbpSACW22s293bzUIUPsC
-h8U+iQIDAQABo0IwQDAdBgNVHQ4EFgQUW/hNT7KlhtQ60vFjmqC+CfZXt94wDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEB
-AKChOBZmLqdWHyGcBvod7bkixTgm2E5P7KN/ed5GIaGHd48HCJqypMWvDzKYC3xm
-KbabfSVSSUOrTC4rbnpwrxYO4wJs+0LmGJ1F2FXI6Dvd5+H0LgscNFxsWEr7jIhQ
-X5Ucv+2rIrVls4W6ng+4reV6G4pQOh29Dbx7VFALuUKvVaAYga1lme++5Jy/xIWr
-QbJUb9wlze144o4MjQlJ3WN7WmmWAiGovVJZ6X01y8hSyn+B/tlr0/cR7SXf+Of5
-pPpyl4RTDaXQMhhRdlkUbA/r7F+AjHVDg8OFmP9Mni0N5HeDk061lgeLKBObjBmN
-QSdJQO7e5iNEOdyhIta6A/I=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBI
-MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
-FzAVBgNVBAMTDlNlY3VyZVRydXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIz
-MTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1NlY3VyZVRydXN0IENv
-cnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQXOZEz
-Zum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO
-0gMdA+9tDWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIao
-wW8xQmxSPmjL8xk037uHGFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj
-7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b01k/unK8RCSc43Oz969XL0Imnal0ugBS
-8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmHursCAwEAAaOBnTCBmjAT
-BgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCeg
-JYYjaHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGC
-NxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt3
-6Z3q059c4EVlew3KW+JwULKUBRSuSceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/
-3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHfmbx8IVQr5Fiiu1cprp6poxkm
-D5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZnMUFdAvnZyPS
-CPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR
-3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBK
-MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
-GTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkx
-MjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3Qg
-Q29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jxYDiJ
-iQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa
-/FHtaMbQbqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJ
-jnIFHovdRIWCQtBJwB1g8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnI
-HmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYVHDGA76oYa8J719rO+TMg1fW9ajMtgQT7
-sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi0XPnj3pDAgMBAAGjgZ0w
-gZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCsw
-KaAnoCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsG
-AQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0L
-URYD7xh8yOOvaliTFGCRsoTciE6+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXO
-H0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cnCDpOGR86p1hcF895P4vkp9Mm
-I50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/53CYNv6ZHdAbY
-iNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc
-f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIBADANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJKUDEl
-MCMGA1UEChMcU0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UECxMe
-U2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBSb290Q0EyMB4XDTA5MDUyOTA1MDAzOVoX
-DTI5MDUyOTA1MDAzOVowXTELMAkGA1UEBhMCSlAxJTAjBgNVBAoTHFNFQ09NIFRy
-dXN0IFN5c3RlbXMgQ08uLExURC4xJzAlBgNVBAsTHlNlY3VyaXR5IENvbW11bmlj
-YXRpb24gUm9vdENBMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANAV
-OVKxUrO6xVmCxF1SrjpDZYBLx/KWvNs2l9amZIyoXvDjChz335c9S672XewhtUGr
-zbl+dp+++T42NKA7wfYxEUV0kz1XgMX5iZnK5atq1LXaQZAQwdbWQonCv/Q4EpVM
-VAX3NuRFg3sUZdbcDE3R3n4MqzvEFb46VqZab3ZpUql6ucjrappdUtAtCms1FgkQ
-hNBqyjoGADdH5H5XTz+L62e4iKrFvlNVspHEfbmwhRkGeC7bYRr6hfVKkaHnFtWO
-ojnflLhwHyg/i/xAXmODPIMqGplrz95Zajv8bxbXH/1KEOtOghY6rCcMU/Gt1SSw
-awNQwS08Ft1ENCcadfsCAwEAAaNCMEAwHQYDVR0OBBYEFAqFqXdlBZh8QIH4D5cs
-OPEK7DzPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
-DQEBCwUAA4IBAQBMOqNErLlFsceTfsgLCkLfZOoc7llsCLqJX2rKSpWeeo8HxdpF
-coJxDjrSzG+ntKEju/Ykn8sX/oymzsLS28yN/HH8AynBbF0zX2S2ZTuJbxh2ePXc
-okgfGT+Ok+vx+hfuzU7jBBJV1uXk3fs+BXziHV7Gp7yXT2g69ekuCkO2r1dcYmh8
-t/2jioSgrGK+KwmHNPBqAbubKVY8/gA3zyNs8U6qtnRGEmyR7jTV7JqR50S+kDFy
-1UkC9gLl9B/rfNmWVan/7Ir5mUf/NVoCqgTLiluHcSmRvaS0eg29mvVXIwAHIRc/
-SjnRBUkLp7Y3gaVdjKozXoEofKd9J+sAro03
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY
-MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t
-dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5
-WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD
-VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8
-9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ
-DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9
-Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N
-QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ
-xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G
-A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T
-AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG
-kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr
-Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5
-Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU
-JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot
-RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP
-MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAx
-MDQwNjA3Mjk0MFoXDTIxMDQwNjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNV
-BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3/Ei9vX+ALTU74W+o
-Z6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybTdXnt
-5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s
-3TmVToMGf+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2Ej
-vOr7nQKV0ba5cTppCD8PtOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu
-8nYybieDwnPz3BjotJPqdURrBGAgcVeHnfO+oJAjPYok4doh28MCAwEAAaMzMDEw
-DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITTXjwwCwYDVR0PBAQDAgEG
-MA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt0jSv9zil
-zqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/
-3DEIcbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvD
-FNr450kkkdAdavphOe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6
-Tk6ezAyNlNzZRZxe7EJQY670XcSxEtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2
-ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLHllpwrN9M
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFcDCCA1igAwIBAgIEAJiWjTANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJO
-TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSkwJwYDVQQDDCBTdGFh
-dCBkZXIgTmVkZXJsYW5kZW4gRVYgUm9vdCBDQTAeFw0xMDEyMDgxMTE5MjlaFw0y
-MjEyMDgxMTEwMjhaMFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIg
-TmVkZXJsYW5kZW4xKTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBS
-b290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA48d+ifkkSzrS
-M4M1LGns3Amk41GoJSt5uAg94JG6hIXGhaTK5skuU6TJJB79VWZxXSzFYGgEt9nC
-UiY4iKTWO0Cmws0/zZiTs1QUWJZV1VD+hq2kY39ch/aO5ieSZxeSAgMs3NZmdO3d
-Z//BYY1jTw+bbRcwJu+r0h8QoPnFfxZpgQNH7R5ojXKhTbImxrpsX23Wr9GxE46p
-rfNeaXUmGD5BKyF/7otdBwadQ8QpCiv8Kj6GyzyDOvnJDdrFmeK8eEEzduG/L13l
-pJhQDBXd4Pqcfzho0LKmeqfRMb1+ilgnQ7O6M5HTp5gVXJrm0w912fxBmJc+qiXb
-j5IusHsMX/FjqTf5m3VpTCgmJdrV8hJwRVXj33NeN/UhbJCONVrJ0yPr08C+eKxC
-KFhmpUZtcALXEPlLVPxdhkqHz3/KRawRWrUgUY0viEeXOcDPusBCAUCZSCELa6fS
-/ZbV0b5GnUngC6agIk440ME8MLxwjyx1zNDFjFE7PZQIZCZhfbnDZY8UnCHQqv0X
-cgOPvZuM5l5Tnrmd74K74bzickFbIZTTRTeU0d8JOV3nI6qaHcptqAqGhYqCvkIH
-1vI4gnPah1vlPNOePqc7nvQDs/nxfRN0Av+7oeX6AHkcpmZBiFxgV6YuCcS6/ZrP
-px9Aw7vMWgpVSzs4dlG4Y4uElBbmVvMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB
-/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFP6rAJCYniT8qcwaivsnuL8wbqg7
-MA0GCSqGSIb3DQEBCwUAA4ICAQDPdyxuVr5Os7aEAJSrR8kN0nbHhp8dB9O2tLsI
-eK9p0gtJ3jPFrK3CiAJ9Brc1AsFgyb/E6JTe1NOpEyVa/m6irn0F3H3zbPB+po3u
-2dfOWBfoqSmuc0iH55vKbimhZF8ZE/euBhD/UcabTVUlT5OZEAFTdfETzsemQUHS
-v4ilf0X8rLiltTMMgsT7B/Zq5SWEXwbKwYY5EdtYzXc7LMJMD16a4/CrPmEbUCTC
-wPTxGfARKbalGAKb12NMcIxHowNDXLldRqANb/9Zjr7dn3LDWyvfjFvO5QxGbJKy
-CqNMVEIYFRIYvdr8unRu/8G2oGTYqV9Vrp9canaW2HNnh/tNf1zuacpzEPuKqf2e
-vTY4SUmH9A4U8OmHuD+nT3pajnnUk+S7aFKErGzp85hwVXIy+TSrK0m1zSBi5Dp6
-Z2Orltxtrpfs/J92VoguZs9btsmksNcFuuEnL5O7Jiqik7Ab846+HUCjuTaPPoIa
-Gl6I6lD4WeKDRikL40Rc4ZW2aZCaFG+XroHPaO+Zmr615+F/+PoTRxZMzG0IQOeL
-eG9QgkRQP2YGiqtDhFZKDyAthg710tvSeopLzaXoTvFeJiUBWSOgftL2fiFX1ye8
-FVdMpEbB4IMeDExNH08GGeL5qPQ6gqGyeUN51q1veieQA6TqJIc/2b3Z6fJfUEkc
-7uzXLg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFyjCCA7KgAwIBAgIEAJiWjDANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJO
-TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSswKQYDVQQDDCJTdGFh
-dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQSAtIEcyMB4XDTA4MDMyNjExMTgxN1oX
-DTIwMDMyNTExMDMxMFowWjELMAkGA1UEBhMCTkwxHjAcBgNVBAoMFVN0YWF0IGRl
-ciBOZWRlcmxhbmRlbjErMCkGA1UEAwwiU3RhYXQgZGVyIE5lZGVybGFuZGVuIFJv
-b3QgQ0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291
-qj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp
-uOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU
-Z5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE
-pMfQ9XQ+pV0aCPKbJdL2rAQmPlU6Yiile7Iwr/g3wtG61jj99O9JMDeZJiFIhQGp
-5Rbn3JBV3w/oOM2ZNyFPXfUib2rFEhZgF1XyZWampzCROME4HYYEhLoaJXhena/M
-UGDWE4dS7WMfbWV9whUYdMrhfmQpjHLYFhN9C0lK8SgbIHRrxT3dsKpICT0ugpTN
-GmXZK4iambwYfp/ufWZ8Pr2UuIHOzZgweMFvZ9C+X+Bo7d7iscksWXiSqt8rYGPy
-5V6548r6f1CGPqI0GAwJaCgRHOThuVw+R7oyPxjMW4T182t0xHJ04eOLoEq9jWYv
-6q012iDTiIJh8BIitrzQ1aTsr1SIJSQ8p22xcik/Plemf1WvbibG/ufMQFxRRIEK
-eN5KzlW/HdXZt1bv8Hb/C3m1r737qWmRRpdogBQ2HbN/uymYNqUg+oJgYjOk7Na6
-B6duxc8UpufWkjTYgfX8HV2qXB72o007uPc5AgMBAAGjgZcwgZQwDwYDVR0TAQH/
-BAUwAwEB/zBSBgNVHSAESzBJMEcGBFUdIAAwPzA9BggrBgEFBQcCARYxaHR0cDov
-L3d3dy5wa2lvdmVyaGVpZC5ubC9wb2xpY2llcy9yb290LXBvbGljeS1HMjAOBgNV
-HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJFoMocVHYnitfGsNig0jQt8YojrMA0GCSqG
-SIb3DQEBCwUAA4ICAQCoQUpnKpKBglBu4dfYszk78wIVCVBR7y29JHuIhjv5tLyS
-CZa59sCrI2AGeYwRTlHSeYAz+51IvuxBQ4EffkdAHOV6CMqqi3WtFMTC6GY8ggen
-5ieCWxjmD27ZUD6KQhgpxrRW/FYQoAUXvQwjf/ST7ZwaUb7dRUG/kSS0H4zpX897
-IZmflZ85OkYcbPnNe5yQzSipx6lVu6xiNGI1E0sUOlWDuYaNkqbG9AclVMwWVxJK
-gnjIFNkXgiYtXSAfea7+1HAWFpWD2DU5/1JddRwWxRNVz0fMdWVSSt7wsKfkCpYL
-+63C4iWEst3kvX5ZbJvw8NjnyvLplzh+ib7M+zkXYT9y2zqR2GUBGR2tUKRXCnxL
-vJxxcypFURmFzI79R6d0lR2o0a9OF7FpJsKqeFdbxU2n5Z4FF5TKsl+gSRiNNOkm
-bEgeqmiSBeGCc1qb3AdbCG19ndeNIdn8FCCqwkXfP+cAslHkwvgFuXkajDTznlvk
-N1trSt8sV4pAWja63XVECDdCcAz+3F4hoKOKwJCcaNpQ5kUQR3i2TtJlycM33+FC
-Y7BXN0Ute4qcvwXqZVUz9zkQxSgqIXobisQk+T8VyJoVIPVVYpbtbZNQvOSqeK3Z
-ywplh6ZmwcSBo3c6WB4L7oOLnR7SUqTMHW+wmG2UMbX4cQrcufx9MmDm66+KAQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFdDCCA1ygAwIBAgIEAJiiOTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJO
-TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSswKQYDVQQDDCJTdGFh
-dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQSAtIEczMB4XDTEzMTExNDExMjg0MloX
-DTI4MTExMzIzMDAwMFowWjELMAkGA1UEBhMCTkwxHjAcBgNVBAoMFVN0YWF0IGRl
-ciBOZWRlcmxhbmRlbjErMCkGA1UEAwwiU3RhYXQgZGVyIE5lZGVybGFuZGVuIFJv
-b3QgQ0EgLSBHMzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL4yolQP
-cPssXFnrbMSkUeiFKrPMSjTysF/zDsccPVMeiAho2G89rcKezIJnByeHaHE6n3WW
-IkYFsO2tx1ueKt6c/DrGlaf1F2cY5y9JCAxcz+bMNO14+1Cx3Gsy8KL+tjzk7FqX
-xz8ecAgwoNzFs21v0IJyEavSgWhZghe3eJJg+szeP4TrjTgzkApyI/o1zCZxMdFy
-KJLZWyNtZrVtB0LrpjPOktvA9mxjeM3KTj215VKb8b475lRgsGYeCasH/lSJEULR
-9yS6YHgamPfJEf0WwTUaVHXvQ9Plrk7O53vDxk5hUUurmkVLoR9BvUhTFXFkC4az
-5S6+zqQbwSmEorXLCCN2QyIkHxcE1G6cxvx/K2Ya7Irl1s9N9WMJtxU51nus6+N8
-6U78dULI7ViVDAZCopz35HCz33JvWjdAidiFpNfxC95DGdRKWCyMijmev4SH8RY7
-Ngzp07TKbBlBUgmhHbBqv4LvcFEhMtwFdozL92TkA1CvjJFnq8Xy7ljY3r735zHP
-bMk7ccHViLVlvMDoFxcHErVc0qsgk7TmgoNwNsXNo42ti+yjwUOH5kPiNL6VizXt
-BznaqB16nzaeErAMZRKQFWDZJkBE41ZgpRDUajz9QdwOWke275dhdU/Z/seyHdTt
-XUmzqWrLZoQT1Vyg3N9udwbRcXXIV2+vD3dbAgMBAAGjQjBAMA8GA1UdEwEB/wQF
-MAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRUrfrHkleuyjWcLhL75Lpd
-INyUVzANBgkqhkiG9w0BAQsFAAOCAgEAMJmdBTLIXg47mAE6iqTnB/d6+Oea31BD
-U5cqPco8R5gu4RV78ZLzYdqQJRZlwJ9UXQ4DO1t3ApyEtg2YXzTdO2PCwyiBwpwp
-LiniyMMB8jPqKqrMCQj3ZWfGzd/TtiunvczRDnBfuCPRy5FOCvTIeuXZYzbB1N/8
-Ipf3YF3qKS9Ysr1YvY2WTxB1v0h7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp
-gZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh
-/WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw
-0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A
-fsbAddJu+2gw7OyLnflJNZoaLNmzlTnVHpL3prllL+U9bTpITAjc5CgSKL59NVzq
-4BZ+Extq1z7XnvwtdbLBFNUjA9tbbws+eC8N3jONFrdI54OagQ97wUNNVQQXOEpR
-1VmiiXTTn74eS9fGbbeIJG9gkaSChVtWQbzQRKtqE77RLFi3EjNYsjdj3BP1lB0/
-QFH1T/U67cjF68IeHRaVesd+QnGTbksVtzDfqu1XhUisHWrdOWnk4Xl4vs4Fv6EM
-94B7IWcnMFk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl
-MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp
-U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw
-NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE
-ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp
-ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3
-DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf
-8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN
-+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0
-X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa
-K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA
-1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G
-A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR
-zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0
-YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBD
-bGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8w
-DQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGsafPzWdqbAYcaT1epoXkJKtv3
-L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLMPUxA2IGvd56D
-eruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl
-xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp
-VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY
-WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx
-EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
-HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAMTKVN0YXJmaWVs
-ZCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAw
-MFoXDTM3MTIzMTIzNTk1OVowgY8xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6
-b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFyZmllbGQgVGVj
-aG5vbG9naWVzLCBJbmMuMTIwMAYDVQQDEylTdGFyZmllbGQgUm9vdCBDZXJ0aWZp
-Y2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBAL3twQP89o/8ArFvW59I2Z154qK3A2FWGMNHttfKPTUuiUP3oWmb3ooa/RMg
-nLRJdzIpVv257IzdIvpy3Cdhl+72WoTsbhm5iSzchFvVdPtrX8WJpRBSiUZV9Lh1
-HOZ/5FSuS/hVclcCGfgXcVnrHigHdMWdSL5stPSksPNkN3mSwOxGXn/hbVNMYq/N
-Hwtjuzqd+/x5AJhhdM8mgkBj87JyahkNmcrUDnXMN/uLicFZ8WJ/X7NfZTD4p7dN
-dloedl40wOiWVpmKs/B/pM293DIxfJHP4F8R+GuqSVzRmZTRouNjWwl2tVZi4Ut0
-HZbUJtQIBFnQmA4O5t78w+wfkPECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO
-BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFHwMMh+n2TB/xH1oo2Kooc6rB1snMA0G
-CSqGSIb3DQEBCwUAA4IBAQARWfolTwNvlJk7mh+ChTnUdgWUXuEok21iXQnCoKjU
-sHU48TRqneSfioYmUeYs0cYtbpUgSpIB7LiKZ3sx4mcujJUDJi5DnUox9g61DLu3
-4jd/IroAow57UvtruzvE03lRTs2Q9GcHGcg8RnoNAX3FWOdt5oUwF5okxBDgBPfg
-8n/Uqgr/Qh037ZTlZFkSIHc40zI+OIF1lnP6aI+xy84fxez6nH7PfrHxBy22/L/K
-pL/QlwVKvOoYKAKQvVR4CSFx09F9HdkWsKlhPdAKACL8x3vLCWRFCztAgfd9fDL1
-mMpYjn0q7pBZc2T5NnReJaH1ZgUufzkVqSr7UIuOhWn0
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx
-EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
-HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs
-ZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5
-MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNVBAYTAlVTMRAwDgYD
-VQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFy
-ZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2Vy
-dmljZXMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20p
-OsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm2
-8xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4PahHQUw2eeBGg6345AWh1K
-Ts9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLPLJGmpufe
-hRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk
-6mFBrMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAw
-DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+q
-AdcwKziIorhtSpzyEZGDMA0GCSqGSIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMI
-bw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPPE95Dz+I0swSdHynVv/heyNXB
-ve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTyxQGjhdByPq1z
-qwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd
-iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn
-0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN
-sSi6
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
-BAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2ln
-biBHb2xkIENBIC0gRzIwHhcNMDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBF
-MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMR8wHQYDVQQDExZT
-d2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
-CgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUqt2/8
-76LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+
-bbqBHH5CjCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c
-6bM8K8vzARO/Ws/BtQpgvd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqE
-emA8atufK+ze3gE/bk3lUIbLtK/tREDFylqM2tIrfKjuvqblCqoOpd8FUrdVxyJd
-MmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvRAiTysybUa9oEVeXBCsdt
-MDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuendjIj3o02y
-MszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69y
-FGkOpeUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPi
-aG59je883WX0XaxR7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxM
-gI93e2CaHt+28kgeDrpOVG2Y4OGiGqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCB
-qTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWyV7
-lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn
-8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov
-L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6
-45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczO
-UYrHUDFu4Up+GC9pWbY9ZIEr44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5
-O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOfMke6UiI0HTJ6CVanfCU2qT1L2sCC
-bwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6mGu6uLftIdxf+u+yv
-GPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxpmo/a
-77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCC
-hdiDyyJkvC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid3
-92qgQmwLOM7XdVAyksLfKzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEpp
-Ld6leNcG2mqeSz53OiATIgHQv2ieY2BrNU0LbbqhPcCT4H8js1WtciVORvnSFu+w
-ZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6LqjviOvrv1vA+ACOzB2+htt
-Qc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFwTCCA6mgAwIBAgIITrIAZwwDXU8wDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEjMCEGA1UEAxMaU3dpc3NTaWdu
-IFBsYXRpbnVtIENBIC0gRzIwHhcNMDYxMDI1MDgzNjAwWhcNMzYxMDI1MDgzNjAw
-WjBJMQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMSMwIQYDVQQD
-ExpTd2lzc1NpZ24gUGxhdGludW0gQ0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAMrfogLi2vj8Bxax3mCq3pZcZB/HL37PZ/pEQtZ2Y5Wu669y
-IIpFR4ZieIbWIDkm9K6j/SPnpZy1IiEZtzeTIsBQnIJ71NUERFzLtMKfkr4k2Htn
-IuJpX+UFeNSH2XFwMyVTtIc7KZAoNppVRDBopIOXfw0enHb/FZ1glwCNioUD7IC+
-6ixuEFGSzH7VozPY1kneWCqv9hbrS3uQMpe5up1Y8fhXSQQeol0GcN1x2/ndi5ob
-jM89o03Oy3z2u5yg+gnOI2Ky6Q0f4nIoj5+saCB9bzuohTEJfwvH6GXp43gOCWcw
-izSC+13gzJ2BbWLuCB4ELE6b7P6pT1/9aXjvCR+htL/68++QHkwFix7qepF6w9fl
-+zC8bBsQWJj3Gl/QKTIDE0ZNYWqFTFJ0LwYfexHihJfGmfNtf9dng34TaNhxKFrY
-zt3oEBSa/m0jh26OWnA81Y0JAKeqvLAxN23IhBQeW71FYyBrS3SMvds6DsHPWhaP
-pZjydomyExI7C3d3rLvlPClKknLKYRorXkzig3R3+jVIeoVNjZpTxN94ypeRSCtF
-KwH3HBqi7Ri6Cr2D+m+8jVeTO9TUps4e8aCxzqv9KyiaTxvXw3LbpMS/XUz13XuW
-ae5ogObnmLo2t/5u7Su9IPhlGdpVCX4l3P5hYnL5fhgC72O00Puv5TtjjGePAgMB
-AAGjgawwgakwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
-BBYEFFCvzAeHFUdvOMW0ZdHelarp35zMMB8GA1UdIwQYMBaAFFCvzAeHFUdvOMW0
-ZdHelarp35zMMEYGA1UdIAQ/MD0wOwYJYIV0AVkBAQEBMC4wLAYIKwYBBQUHAgEW
-IGh0dHA6Ly9yZXBvc2l0b3J5LnN3aXNzc2lnbi5jb20vMA0GCSqGSIb3DQEBBQUA
-A4ICAQAIhab1Fgz8RBrBY+D5VUYI/HAcQiiWjrfFwUF1TglxeeVtlspLpYhg0DB0
-uMoI3LQwnkAHFmtllXcBrqS3NQuB2nEVqXQXOHtYyvkv+8Bldo1bAbl93oI9ZLi+
-FHSjClTTLJUYFzX1UWs/j6KWYTl4a0vlpqD4U99REJNi54Av4tHgvI42Rncz7Lj7
-jposiU0xEQ8mngS7twSNC/K5/FqdOxa3L8iYq/6KUFkuozv8KV2LwUvJ4ooTHbG/
-u0IdUt1O2BReEMYxB+9xJ/cbOQncguqLs5WGXv312l0xpuAxtpTmREl0xRbl9x8D
-YSjFyMsSoEJL+WuICI20MhjzdZ/EfwBPBZWcoxcCw7NTm6ogOSkrZvqdr16zktK1
-puEa+S1BaYEUtLS17Yk9zvupnTVCRLEcFHOBzyoBNZox1S2PbYTfgE1X4z/FhHXa
-icYwu+uPyyIIoK6q8QNsOktNCaUOcsZWayFCTiMlFGiudgp8DAdwZPmaL/YFOSbG
-DI8Zf0NebvRbFS/bYV3mZy8/CJT5YLSYMdp08YSTcU1f+2BY0fvEwW2JorsgH51x
-kcsymxM9Pn2SUjWskpSi0xjCfMfqr3YFFt1nJ8J+HAciIfNAChs0B0QTwoRqjt8Z
-Wr9/6x3iGjjRXK9HkmuAtTClyY3YqzGBH9/CZjfTk6mFhnll0g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE
-BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu
-IFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow
-RzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMY
-U3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv
-Fz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7br
-YT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF
-nbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH
-6ATK72oxh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt
-eJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/
-c8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5FZGkECwJ
-MoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH
-HTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf
-jNFusB3hB48IHpmccelM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb6
-5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB
-rDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
-F6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c
-wpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0
-cDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIB
-AHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp
-WJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9
-xCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L3XWgwF15kIwb4FDm3jH+mHtwX6WQ
-2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ
-IseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8
-aRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X
-em1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR
-dAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/
-OMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+
-hAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy
-tGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF2TCCA8GgAwIBAgIQHp4o6Ejy5e/DfEoeWhhntjANBgkqhkiG9w0BAQsFADBk
-MQswCQYDVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0
-YWwgQ2VydGlmaWNhdGUgU2VydmljZXMxGzAZBgNVBAMTElN3aXNzY29tIFJvb3Qg
-Q0EgMjAeFw0xMTA2MjQwODM4MTRaFw0zMTA2MjUwNzM4MTRaMGQxCzAJBgNVBAYT
-AmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGlnaXRhbCBDZXJ0aWZp
-Y2F0ZSBTZXJ2aWNlczEbMBkGA1UEAxMSU3dpc3Njb20gUm9vdCBDQSAyMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAlUJOhJ1R5tMJ6HJaI2nbeHCOFvEr
-jw0DzpPMLgAIe6szjPTpQOYXTKueuEcUMncy3SgM3hhLX3af+Dk7/E6J2HzFZ++r
-0rk0X2s682Q2zsKwzxNoysjL67XiPS4h3+os1OD5cJZM/2pYmLcX5BtS5X4HAB1f
-2uY+lQS3aYg5oUFgJWFLlTloYhyxCwWJwDaCFCE/rtuh/bxvHGCGtlOUSbkrRsVP
-ACu/obvLP+DHVxxX6NZp+MEkUp2IVd3Chy50I9AU/SpHWrumnf2U5NGKpV+GY3aF
-y6//SSj8gO1MedK75MDvAe5QQQg1I3ArqRa0jG6F6bYRzzHdUyYb3y1aSgJA/MTA
-tukxGggo5WDDH8SQjhBiYEQN7Aq+VRhxLKX0srwVYv8c474d2h5Xszx+zYIdkeNL
-6yxSNLCK/RJOlrDrcH+eOfdmQrGrrFLadkBXeyq96G4DsguAhYidDMfCd7Camlf0
-uPoTXGiTOmekl9AbmbeGMktg2M7v0Ax/lZ9vh0+Hio5fCHyqW/xavqGRn1V9TrAL
-acywlKinh/LTSlDcX3KwFnUey7QYYpqwpzmqm59m2I2mbJYV4+by+PGDYmy7Velh
-k6M99bFXi08jsJvllGov34zflVEpYKELKeRcVVi3qPyZ7iVNTA6z00yPhOgpD/0Q
-VAKFyPnlw4vP5w8CAwEAAaOBhjCBgzAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0hBBYw
-FDASBgdghXQBUwIBBgdghXQBUwIBMBIGA1UdEwEB/wQIMAYBAf8CAQcwHQYDVR0O
-BBYEFE0mICKJS9PVpAqhb97iEoHF8TwuMB8GA1UdIwQYMBaAFE0mICKJS9PVpAqh
-b97iEoHF8TwuMA0GCSqGSIb3DQEBCwUAA4ICAQAyCrKkG8t9voJXiblqf/P0wS4R
-fbgZPnm3qKhyN2abGu2sEzsOv2LwnN+ee6FTSA5BesogpxcbtnjsQJHzQq0Qw1zv
-/2BZf82Fo4s9SBwlAjxnffUy6S8w5X2lejjQ82YqZh6NM4OKb3xuqFp1mrjX2lhI
-REeoTPpMSQpKwhI3qEAMw8jh0FcNlzKVxzqfl9NX+Ave5XLzo9v/tdhZsnPdTSpx
-srpJ9csc1fV5yJmz/MFMdOO0vSk3FQQoHt5FRnDsr7p4DooqzgB53MBfGWcsa0vv
-aGgLQ+OswWIJ76bdZWGgr4RVSJFSHMYlkSrQwSIjYVmvRRGFHQEkNI/Ps/8XciAT
-woCqISxxOQ7Qj1zB09GOInJGTB2Wrk9xseEFKZZZ9LuedT3PDTcNYtsmjGOpI99n
-Bjx8Oto0QuFmtEYE3saWmA9LSHokMnWRn6z3aOkquVVlzl1h0ydw2Df+n7mvoC5W
-t6NlUe07qxS/TFED6F+KBZvuim6c779o+sjaC+NCydAXFJy3SuCvkychVSa1ZC+N
-8f+mQAWFBVzKBxlcCxMoTFh/wqXvRdpg065lYZ1Tg3TCrvJcwhbtkj6EPnNgiLx2
-9CzP0H1907he0ZESEOnN3col49XtmS++dYFLJPlFRpTJKSFTnCZFqhMX5OfNeOI5
-wSsSnqaeG8XmDtkx2Q==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICqDCCAi2gAwIBAgIQIW4zpcvTiKRvKQe0JzzE2DAKBggqhkjOPQQDAzCBlDEL
-MAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYD
-VQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBD
-bGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0g
-RzQwHhcNMTExMDA1MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBlDELMAkGA1UEBhMC
-VVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1h
-bnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBDbGFzcyAxIFB1
-YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzQwdjAQBgcq
-hkjOPQIBBgUrgQQAIgNiAATXZrUb266zYO5G6ohjdTsqlG3zXxL24w+etgoUU0hS
-yNw6s8tIICYSTvqJhNTfkeQpfSgB2dsYQ2mhH7XThhbcx39nI9/fMTGDAzVwsUu3
-yBe7UcvclBfb6gk7dhLeqrWjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBRlwI0l9Qy6l3eQP54u4Fr1ztXh5DAKBggqhkjOPQQD
-AwNpADBmAjEApa7jRlP4mDbjIvouKEkN7jB+M/PsP3FezFWJeJmssv3cHFwzjim5
-axfIEWi13IMHAjEAnMhE2mnCNsNUGRCFAtqdR+9B52wmnQk9922Q0QVEL7C8g5No
-8gxFSTm/mQQc0xCg
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID9jCCAt6gAwIBAgIQJDJ18h0v0gkz97RqytDzmDANBgkqhkiG9w0BAQsFADCB
-lDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8w
-HQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRl
-YyBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
-IC0gRzYwHhcNMTExMDE4MDAwMDAwWhcNMzcxMjAxMjM1OTU5WjCBlDELMAkGA1UE
-BhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZT
-eW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBDbGFzcyAx
-IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzYwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHOddJZKmZgiJM6kXZBxbje/SD
-6Jlz+muxNuCad6BAwoGNAcfMjL2Pffd543pMA03Z+/2HOCgs3ZqLVAjbZ/sbjP4o
-ki++t7JIp4Gh2F6Iw8w5QEFa0dzl2hCfL9oBTf0uRnz5LicKaTfukaMbasxEvxvH
-w9QRslBglwm9LiL1QYRmn81ApqkAgMEflZKf3vNI79sdd2H8f9/ulqRy0LY+/3gn
-r8uSFWkI22MQ4uaXrG7crPaizh5HmbmJtxLmodTNWRFnw2+F2EJOKL5ZVVkElauP
-N4C/DfD8HzpkMViBeNfiNfYgPym4jxZuPkjctUwH4fIa6n4KedaovetdhitNAgMB
-AAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBQzQejIORIVk0jyljIuWvXalF9TYDANBgkqhkiG9w0BAQsFAAOCAQEAFeNzV7EX
-tl9JaUSm9l56Z6zS3nVJq/4lVcc6yUQVEG6/MWvL2QeTfxyFYwDjMhLgzMv7OWyP
-4lPiPEAz2aSMR+atWPuJr+PehilWNCxFuBL6RIluLRQlKCQBZdbqUqwFblYSCT3Q
-dPTXvQbKqDqNVkL6jXI+dPEDct+HG14OelWWLDi3mIXNTTNEyZSPWjEwN0ujOhKz
-5zbRIWhLLTjmU64cJVYIVgNnhJ3Gw84kYsdMNs+wBkS39V8C3dlU6S+QTnrIToNA
-DJqXPDe/v+z28LSFdyjBC8hnghAXOKK3Buqbvzr46SMHv3TgmDgVVXjucgBcGaP0
-0jPg/73RVDkpDw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICqDCCAi2gAwIBAgIQNBdlEkA7t1aALYDLeVWmHjAKBggqhkjOPQQDAzCBlDEL
-MAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYD
-VQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBD
-bGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0g
-RzQwHhcNMTExMDA1MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBlDELMAkGA1UEBhMC
-VVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1h
-bnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBDbGFzcyAyIFB1
-YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzQwdjAQBgcq
-hkjOPQIBBgUrgQQAIgNiAATR2UqOTA2ESlG6fO/TzPo6mrWnYxM9AeBJPvrBR8mS
-szrX/m+c95o6D/UOCgrDP8jnEhSO1dVtmCyzcTIK6yq99tdqIAtnRZzSsr9TImYJ
-XdsR8/EFM1ij4rjPfM2Cm72jQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBQ9MvM6qQyQhPmijGkGYVQvh3L+BTAKBggqhkjOPQQD
-AwNpADBmAjEAyKapr0F/tckRQhZoaUxcuCcYtpjxwH+QbYfTjEYX8D5P/OqwCMR6
-S7wIL8fip29lAjEA1lnehs5fDspU1cbQFQ78i5Ry1I4AWFPPfrFLDeVQhuuea9//
-KabYR9mglhjb8kWz
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID9jCCAt6gAwIBAgIQZIKe/DcedF38l/+XyLH/QTANBgkqhkiG9w0BAQsFADCB
-lDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8w
-HQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRl
-YyBDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
-IC0gRzYwHhcNMTExMDE4MDAwMDAwWhcNMzcxMjAxMjM1OTU5WjCBlDELMAkGA1UE
-BhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZT
-eW1hbnRlYyBUcnVzdCBOZXR3b3JrMUUwQwYDVQQDEzxTeW1hbnRlYyBDbGFzcyAy
-IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzYwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNzOkFyGOFyz9AYxe9GPo15gRn
-V2WYKaRPyVyPDzTS+NqoE2KquB5QZ3iwFkygOakVeq7t0qLA8JA3KRgmXOgNPLZs
-ST/B4NzZS7YUGQum05bh1gnjGSYc+R9lS/kaQxwAg9bQqkmi1NvmYji6UBRDbfkx
-+FYW2TgCkc/rbN27OU6Z4TBnRfHU8I3D3/7yOAchfQBeVkSz5GC9kSucq1sEcg+y
-KNlyqwUgQiWpWwNqIBDMMfAr2jUs0Pual07wgksr2F82owstr2MNHSV/oW5cYqGN
-KD6h/Bwg+AEvulWaEbAZ0shQeWsOagXXqgQ2sqPy4V93p3ec5R7c6d9qwWVdAgMB
-AAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBSHjCCVyJhK0daABkqQNETfHE2/sDANBgkqhkiG9w0BAQsFAAOCAQEAgY6ypWaW
-tyGltu9vI1pf24HFQqV4wWn99DzX+VxrcHIa/FqXTQCAiIiCisNxDY7FiZss7Y0L
-0nJU9X3UXENX6fOupQIR9nYrgVfdfdp0MP1UR/bgFm6mtApI5ud1Bw8pGTnOefS2
-bMVfmdUfS/rfbSw8DVSAcPCIC4DPxmiiuB1w2XaM/O6lyc+tHc+ZJVdaYkXLFmu9
-Sc2lo4xpeSWuuExsi0BmSxY/zwIa3eFsawdhanYVKZl/G92IgMG/tY9zxaaWI4Sm
-KIYkM2oBLldzJbZev4/mHWGoQClnHYebHX+bn5nNMdZUvmK7OaxoEkiRIKXLsd3+
-b/xa5IJVWa8xqQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
-KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
-BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
-YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1
-OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
-aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
-ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G
-CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd
-AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC
-FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi
-1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq
-jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ
-wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj
-QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/
-WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy
-NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC
-uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw
-IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6
-g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
-9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP
-BSeOE6Fuwg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
-KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
-BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
-YyBHbG9iYWxSb290IENsYXNzIDMwHhcNMDgxMDAxMTAyOTU2WhcNMzMxMDAxMjM1
-OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
-aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
-ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDMwggEiMA0G
-CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9dZPwYiJvJK7genasfb3ZJNW4t/zN
-8ELg63iIVl6bmlQdTQyK9tPPcPRStdiTBONGhnFBSivwKixVA9ZIw+A5OO3yXDw/
-RLyTPWGrTs0NvvAgJ1gORH8EGoel15YUNpDQSXuhdfsaa3Ox+M6pCSzyU9XDFES4
-hqX2iys52qMzVNn6chr3IhUciJFrf2blw2qAsCTz34ZFiP0Zf3WHHx+xGwpzJFu5
-ZeAsVMhg02YXP+HMVDNzkQI6pn97djmiH5a2OK61yJN0HZ65tOVgnS9W0eDrXltM
-EnAMbEQgqxHY9Bn20pxSN+f6tsIxO0rUFJmtxxr1XV/6B7h8DR/Wgx6zAgMBAAGj
-QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS1
-A/d2O2GCahKqGFPrAyGUv/7OyjANBgkqhkiG9w0BAQsFAAOCAQEAVj3vlNW92nOy
-WL6ukK2YJ5f+AbGwUgC4TeQbIXQbfsDuXmkqJa9c1h3a0nnJ85cp4IaH3gRZD/FZ
-1GSFS5mvJQQeyUapl96Cshtwn5z2r3Ex3XsFpSzTucpH9sry9uetuUg/vBa3wW30
-6gmv7PO15wWeph6KU1HWk4HMdJP2udqmJQV0eVp+QD6CSyYRMG7hP0HHRwA11fXT
-91Q+gT3aSWqas+8QPebrb9HIIkfLzM8BMZLZGOMivgkeGj5asuRrDFR6fUNOuIml
-e9eiPZaGzPImNC1qkp2aGtAw4l1OBLBfiyB+d8E9lYLRRpo7PHi4b6HQDWSieB4p
-TpPDpFQUWw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEYzCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQsFADCB0jELMAkGA1UEBhMCVFIx
-GDAWBgNVBAcTD0dlYnplIC0gS29jYWVsaTFCMEAGA1UEChM5VHVya2l5ZSBCaWxp
-bXNlbCB2ZSBUZWtub2xvamlrIEFyYXN0aXJtYSBLdXJ1bXUgLSBUVUJJVEFLMS0w
-KwYDVQQLEyRLYW11IFNlcnRpZmlrYXN5b24gTWVya2V6aSAtIEthbXUgU00xNjA0
-BgNVBAMTLVRVQklUQUsgS2FtdSBTTSBTU0wgS29rIFNlcnRpZmlrYXNpIC0gU3Vy
-dW0gMTAeFw0xMzExMjUwODI1NTVaFw00MzEwMjUwODI1NTVaMIHSMQswCQYDVQQG
-EwJUUjEYMBYGA1UEBxMPR2ViemUgLSBLb2NhZWxpMUIwQAYDVQQKEzlUdXJraXll
-IEJpbGltc2VsIHZlIFRla25vbG9qaWsgQXJhc3Rpcm1hIEt1cnVtdSAtIFRVQklU
-QUsxLTArBgNVBAsTJEthbXUgU2VydGlmaWthc3lvbiBNZXJrZXppIC0gS2FtdSBT
-TTE2MDQGA1UEAxMtVFVCSVRBSyBLYW11IFNNIFNTTCBLb2sgU2VydGlmaWthc2kg
-LSBTdXJ1bSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3UwM6q7
-a9OZLBI3hNmNe5eA027n/5tQlT6QlVZC1xl8JoSNkvoBHToP4mQ4t4y86Ij5iySr
-LqP1N+RAjhgleYN1Hzv/bKjFxlb4tO2KRKOrbEz8HdDc72i9z+SqzvBV96I01INr
-N3wcwv61A+xXzry0tcXtAA9TNypN9E8Mg/uGz8v+jE69h/mniyFXnHrfA2eJLJ2X
-YacQuFWQfw4tJzh03+f92k4S400VIgLI4OD8D62K18lUUMw7D8oWgITQUVbDjlZ/
-iSIzL+aFCr2lqBs23tPcLG07xxO9WSMs5uWk99gL7eqQQESolbuT1dCANLZGeA4f
-AJNG4e7p+exPFwIDAQABo0IwQDAdBgNVHQ4EFgQUZT/HiobGPN08VFw1+DrtUgxH
-V8gwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
-BQADggEBACo/4fEyjq7hmFxLXs9rHmoJ0iKpEsdeV31zVmSAhHqT5Am5EM2fKifh
-AHe+SMg1qIGf5LgsyX8OsNJLN13qudULXjS99HMpw+0mFZx+CFOKWI3QSyjfwbPf
-IPP54+M638yclNhOT8NrF7f3cuitZjO1JVOr4PhMqZ398g26rrnZqsZr+ZO7rqu4
-lzwDGrpDxpa5RXI4s6ehlj2Re37AIVNMh+3yC1SVUZPVIqUNivGTDj5UDrDYyU7c
-8jEyVupk+eq1nRZmQnLzf9OxMUP8pI4X8W0jq5Rm+K37DwhuJi1/FwcJsoz7UMCf
-lo3Ptv0AnVoUmr8CRPXBwp8iXqIPoeM=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFQTCCAymgAwIBAgICDL4wDQYJKoZIhvcNAQELBQAwUTELMAkGA1UEBhMCVFcx
-EjAQBgNVBAoTCVRBSVdBTi1DQTEQMA4GA1UECxMHUm9vdCBDQTEcMBoGA1UEAxMT
-VFdDQSBHbG9iYWwgUm9vdCBDQTAeFw0xMjA2MjcwNjI4MzNaFw0zMDEyMzExNTU5
-NTlaMFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsT
-B1Jvb3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0EwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCwBdvI64zEbooh745NnHEKH1Jw7W2CnJfF
-10xORUnLQEK1EjRsGcJ0pDFfhQKX7EMzClPSnIyOt7h52yvVavKOZsTuKwEHktSz
-0ALfUPZVr2YOy+BHYC8rMjk1Ujoog/h7FsYYuGLWRyWRzvAZEk2tY/XTP3VfKfCh
-MBwqoJimFb3u/Rk28OKRQ4/6ytYQJ0lM793B8YVwm8rqqFpD/G2Gb3PpN0Wp8DbH
-zIh1HrtsBv+baz4X7GGqcXzGHaL3SekVtTzWoWH1EfcFbx39Eb7QMAfCKbAJTibc
-46KokWofwpFFiFzlmLhxpRUZyXx1EcxwdE8tmx2RRP1WKKD+u4ZqyPpcC1jcxkt2
-yKsi2XMPpfRaAok/T54igu6idFMqPVMnaR1sjjIsZAAmY2E2TqNGtz99sy2sbZCi
-laLOz9qC5wc0GZbpuCGqKX6mOL6OKUohZnkfs8O1CWfe1tQHRvMq2uYiN2DLgbYP
-oA/pyJV/v1WRBXrPPRXAb94JlAGD1zQbzECl8LibZ9WYkTunhHiVJqRaCPgrdLQA
-BDzfuBSO6N+pjWxnkjMdwLfS7JLIvgm/LCkFbwJrnu+8vyq8W8BQj0FwcYeyTbcE
-qYSjMq+u7msXi7Kx/mzhkIyIqJdIzshNy/MGz19qCkKxHh53L46g5pIOBvwFItIm
-4TFRfTLcDwIDAQABoyMwITAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
-/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL
-1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn
-LhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF
-H6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34FOIWWxtuEXeZVFBs5fzNxGiWNo
-RI2T9GRwoD2dKAXDOXC4Ynsg/eTb6QihuJ49CcdP+yz4k3ZB3lLg4VfSnQO8d57+
-nile98FRYB/e2guyLXW3Q0iT5/Z5xoRdgFlglPx4mI88k1HtQJAH32RjJMtOcQWh
-15QaiDLxInQirqWm2BJpTGCjAu4r7NRjkgtevi92a6O2JryPA9gK8kxkRr05YuWW
-6zRjESjMlfGt7+/cgFhI6Uu46mWs6fyAtbXIRfmswZ/ZuepiiI7E8UuDEq3mi4TW
-nsLrgxifarsbJGAzcMzs9zLzXNl5fe+epP7JI8Mk7hWSsT2RTyaGvWZzJBPqpK5j
-wa19hAM8EHiGG3njxPPyBJUgriOCxLM6AGK/5jYk4Ve6xx6QddVfP5VhK8E7zeWz
-aGHQRiapIVJpLesux+t3zqY6tQMzT3bR51xUAV3LePTJDL/PEo4XLSNolOer/qmy
-KwbQBM0=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJUVzES
-MBAGA1UECgwJVEFJV0FOLUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFU
-V0NBIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwODI4MDcyNDMz
-WhcNMzAxMjMxMTU1OTU5WjBfMQswCQYDVQQGEwJUVzESMBAGA1UECgwJVEFJV0FO
-LUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm
-aWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
-AQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE
-AcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH
-K3XLfJ+utdGdIzdjp9xCoi2SBBtQwXu4PhvJVgSLL1KbralW6cH/ralYhzC2gfeX
-RfwZVzsrb+RH9JlF/h3x+JejiB03HFyP4HYlmlD4oFT/RJB2I9IyxsOrBr/8+7/z
-rX2SYgJbKdM1o5OaQ2RgXbL6Mv87BK9NQGr5x+PvI/1ry+UPizgN7gr8/g+YnzAx
-3WxSZfmLgb4i4RxYA7qRG4kHAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
-HRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqOFsmjd6LWvJPelSDGRjjCDWmujANBgkq
-hkiG9w0BAQUFAAOCAQEAPNV3PdrfibqHDAhUaiBQkr6wQT25JmSDCi/oQMCXKCeC
-MErJk/9q56YAf4lCmtYR5VPOL8zy2gXE/uJQxDqGfczafhAJO5I1KlOy/usrBdls
-XebQ79NqZp4VKIV66IIArB6nCWlWQtNoURi+VJq/REG6Sb4gumlc7rh3zc5sH62D
-lhh9DrUUOYTxKOkto557HnpyWoOzeW/vtPzQCqVYT0bf+215WfKEIlKuD8z7fDvn
-aspHYcN6+NOSBB+4IIThNlQWx0DeO4pz3N/GCUzf7Nr/1FNCocnyYh0igzyXxfkZ
-YiesZSLX0zzG5Y6yU8xJzrww/nsOM5D77dIUkR8Hrw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFcjCCA1qgAwIBAgIQH51ZWtcvwgZEpYAIaeNe9jANBgkqhkiG9w0BAQUFADA/
-MQswCQYDVQQGEwJUVzEwMC4GA1UECgwnR292ZXJubWVudCBSb290IENlcnRpZmlj
-YXRpb24gQXV0aG9yaXR5MB4XDTAyMTIwNTEzMjMzM1oXDTMyMTIwNTEzMjMzM1ow
-PzELMAkGA1UEBhMCVFcxMDAuBgNVBAoMJ0dvdmVybm1lbnQgUm9vdCBDZXJ0aWZp
-Y2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
-AJoluOzMonWoe/fOW1mKydGGEghU7Jzy50b2iPN86aXfTEc2pBsBHH8eV4qNw8XR
-IePaJD9IK/ufLqGU5ywck9G/GwGHU5nOp/UKIXZ3/6m3xnOUT0b3EEk3+qhZSV1q
-gQdW8or5BtD3cCJNtLdBuTK4sfCxw5w/cP1T3YGq2GN49thTbqGsaoQkclSGxtKy
-yhwOeYHWtXBiCAEuTk8O1RGvqa/lmr/czIdtJuTJV6L7lvnM4T9TjGxMfptTCAts
-F/tnyMKtsc2AtJfcdgEWFelq16TheEfOhtX7MfP6Mb40qij7cEwdScevLJ1tZqa2
-jWR+tSBqnTuBto9AAGdLiYa4zGX+FVPpBMHWXx1E1wovJ5pGfaENda1UhhXcSTvx
-ls4Pm6Dso3pdvtUqdULle96ltqqvKKyskKw4t9VoNSZ63Pc78/1Fm9G7Q3hub/FC
-VGqY8A2tl+lSXunVanLeavcbYBT0peS2cWeqH+riTcFCQP5nRhc4L0c/cZyu5SHK
-YS1tB6iEfC3uUSXxY5Ce/eFXiGvviiNtsea9P63RPZYLhY3Naye7twWb7LuRqQoH
-EgKXTiCQ8P8NHuJBO9NAOueNXdpm5AKwB1KYXA6OM5zCppX7VRluTI6uSw+9wThN
-Xo+EHWbNxWCWtFJaBYmOlXqYwZE8lSOyDvR5tMl8wUohAgMBAAGjajBoMB0GA1Ud
-DgQWBBTMzO/MKWCkO7GStjz6MmKPrCUVOzAMBgNVHRMEBTADAQH/MDkGBGcqBwAE
-MTAvMC0CAQAwCQYFKw4DAhoFADAHBgVnKgMAAAQUA5vwIhP/lSg209yewDL7MTqK
-UWUwDQYJKoZIhvcNAQEFBQADggIBAECASvomyc5eMN1PhnR2WPWus4MzeKR6dBcZ
-TulStbngCnRiqmjKeKBMmo4sIy7VahIkv9Ro04rQ2JyftB8M3jh+Vzj8jeJPXgyf
-qzvS/3WXy6TjZwj/5cAWtUgBfen5Cv8b5Wppv3ghqMKnI6mGq3ZW6A4M9hPdKmaK
-ZEk9GhiHkASfQlK3T8v+R0F2Ne//AHY2RTKbxkaFXeIksB7jSJaYV0eUVXoPQbFE
-JPPB/hprv4j9wabak2BegUqZIJxIZhm1AHlUD7gsL0u8qV1bYH+Mh6XgUmMqvtg7
-hUAV/h62ZT/FS9p+tXo1KaMuephgIqP0fSdOLeq0dDzpD6QzDxARvBMB1uUO07+1
-EqLhRSPAzAhuYbeJq4PjJB7mXQfnHyA+z2fI56wwbSdLaG5LKlwCCDTb+HbkZ6Mm
-nD+iMsJKxYEYMRBWqoTvLQr/uB930r+lWKBi5NdLkXWNiYCYfm3LU05er/ayl4WX
-udpVBrkk7tfGOB5jGxI7leFYrPLfhNVfmS8NVVvmONsuP3LpSIXLuykTjx44Vbnz
-ssQwmSNOXfJIoRIM3BKQCZBUkQM8R+XVyWXgt0t97EfTsws+rZ7QdAAO671RrcDe
-LMDDav7v3Aun+kbfYNucpllQdSNpc5Oy+fwC00fmcc4QAu4njIT/rEUNE1yDMuAl
-pYYsfPQS
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFODCCAyCgAwIBAgIRAJW+FqD3LkbxezmCcvqLzZYwDQYJKoZIhvcNAQEFBQAw
-NzEUMBIGA1UECgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJv
-b3QgQ0EgdjEwHhcNMDcxMDE4MTIwMDUwWhcNMzIxMDE4MTIwMDUwWjA3MRQwEgYD
-VQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBDQSB2
-MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMK+6yfwIaPzaSZVfp3F
-VRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65ItqwA3GV1
-7CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+X
-Z75Ljo1kB1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+
-/jXh7VB7qTCNGdMJjmhnXb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs
-81Mt8Bz17Ww5OXOAFshSsCPN4D7c3TxHoLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkm
-dtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+JWov3F0fUTPHSiXk+TT2YqGHe
-Oh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0hADnJoWjiUIMu
-sDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4
-pgd7gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fs
-slESl1MpWtTwEhDcTwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQ
-arMCpgKIv7NHfirZ1fpoeDVNAgMBAAGjPzA9MA8GA1UdEwEB/wQFMAMBAf8wCwYD
-VR0PBAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1j5qWDNXr+nuqF+gTEjANBgkqhkiG
-9w0BAQUFAAOCAgEAvuRcYk4k9AwI//DTDGjkk0kiP0Qnb7tt3oNmzqjMDfz1mgbl
-dxSR651Be5kqhOX//CHBXfDkH1e3damhXwIm/9fH907eT/j3HEbAek9ALCI18Bmx
-0GtnLLCo4MBANzX2hFxc469CeP6nyQ1Q6g2EdvZR74NTxnr/DlZJLo961gzmJ1Tj
-TQpgcmLNkQfWpb/ImWvtxBnmq0wROMVvMeJuScg/doAmAyYp4Db29iBT4xdwNBed
-Y2gea+zDTYa4EzAvXUYNR0PVG6pZDrlcjQZIrXSHX8f8MVRBE+LHIQ6e4B4N4cB7
-Q4WQxYpYxmUKeFfyxiMPAdkgS94P+5KFdSpcc41teyWRyu5FrgZLAMzTsVlQ2jqI
-OylDRl6XK1TOU2+NSueW+r9xDkKLfP0ooNBIytrEgUy7onOTJsjrDNYmiLbAJM+7
-vVvrdX3pCI6GMyx5dwlppYn8s3CQh3aP0yK7Qs69cwsgJirQmz1wHiRszYd2qReW
-t88NkvuOGKmYSdGe/mBEciG5Ge3C9THxOUiIkCR1VBatzvT4aRRkOfujuLpwQMcn
-HL/EVlP6Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVx
-SK236thZiNSQvxaz2emsWWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEIDCCAwigAwIBAgIJAISCLF8cYtBAMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
-VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk
-MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U
-cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxFzAVBgNVBAMMDlRydXN0Q29y
-IEVDQS0xMB4XDTE2MDIwNDEyMzIzM1oXDTI5MTIzMTE3MjgwN1owgZwxCzAJBgNV
-BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw
-IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy
-dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAwwOVHJ1c3RDb3Ig
-RUNBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPj+ARtZ+odnbb
-3w9U73NjKYKtR8aja+3+XzP4Q1HpGjORMRegdMTUpwHmspI+ap3tDvl0mEDTPwOA
-BoJA6LHip1GnHYMma6ve+heRK9jGrB6xnhkB1Zem6g23xFUfJ3zSCNV2HykVh0A5
-3ThFEXXQmqc04L/NyFIduUd+Dbi7xgz2c1cWWn5DkR9VOsZtRASqnKmcp0yJF4Ou
-owReUoCLHhIlERnXDH19MURB6tuvsBzvgdAsxZohmz3tQjtQJvLsznFhBmIhVE5/
-wZ0+fyCMgMsq2JdiyIMzkX2woloPV+g7zPIlstR8L+xNxqE6FXrntl019fZISjZF
-ZtS6mFjBAgMBAAGjYzBhMB0GA1UdDgQWBBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAf
-BgNVHSMEGDAWgBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAPBgNVHRMBAf8EBTADAQH/
-MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEABT41XBVwm8nHc2Fv
-civUwo/yQ10CzsSUuZQRg2dd4mdsdXa/uwyqNsatR5Nj3B5+1t4u/ukZMjgDfxT2
-AHMsWbEhBuH7rBiVDKP/mZb3Kyeb1STMHd3BOuCYRLDE5D53sXOpZCz2HAF8P11F
-hcCF5yWPldwX8zyfGm6wyuMdKulMY/okYWLW2n62HGz1Ah3UKt1VkOsqEUc8Ll50
-soIipX1TH0XsJ5F95yIW6MBoNtjG8U+ARDL54dHRHareqKucBK+tIA5kmE2la8BI
-WJZpTdwHjFGTot+fDz2LYLSCjaoITmJF4PkL0uDgPFveXHEnJcLmA4GLEFPjx1Wi
-tJ/X5g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEMDCCAxigAwIBAgIJANqb7HHzA7AZMA0GCSqGSIb3DQEBCwUAMIGkMQswCQYD
-VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk
-MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U
-cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRydXN0Q29y
-IFJvb3RDZXJ0IENBLTEwHhcNMTYwMjA0MTIzMjE2WhcNMjkxMjMxMTcyMzE2WjCB
-pDELMAkGA1UEBhMCUEExDzANBgNVBAgMBlBhbmFtYTEUMBIGA1UEBwwLUGFuYW1h
-IENpdHkxJDAiBgNVBAoMG1RydXN0Q29yIFN5c3RlbXMgUy4gZGUgUi5MLjEnMCUG
-A1UECwweVHJ1c3RDb3IgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR8wHQYDVQQDDBZU
-cnVzdENvciBSb290Q2VydCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAv463leLCJhJrMxnHQFgKq1mqjQCj/IDHUHuO1CAmujIS2CNUSSUQIpid
-RtLByZ5OGy4sDjjzGiVoHKZaBeYei0i/mJZ0PmnK6bV4pQa81QBeCQryJ3pS/C3V
-seq0iWEk8xoT26nPUu0MJLq5nux+AHT6k61sKZKuUbS701e/s/OojZz0JEsq1pme
-9J7+wH5COucLlVPat2gOkEz7cD+PSiyU8ybdY2mplNgQTsVHCJCZGxdNuWxu72CV
-EY4hgLW9oHPY0LJ3xEXqWib7ZnZ2+AYfYW0PVcWDtxBWcgYHpfOxGgMFZA6dWorW
-hnAbJN7+KIor0Gqw/Hqi3LJ5DotlDwIDAQABo2MwYTAdBgNVHQ4EFgQU7mtJPHo/
-DeOxCbeKyKsZn3MzUOcwHwYDVR0jBBgwFoAU7mtJPHo/DeOxCbeKyKsZn3MzUOcw
-DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
-ggEBACUY1JGPE+6PHh0RU9otRCkZoB5rMZ5NDp6tPVxBb5UrJKF5mDo4Nvu7Zp5I
-/5CQ7z3UuJu0h3U/IJvOcs+hVcFNZKIZBqEHMwwLKeXx6quj7LUKdJDHfXLy11yf
-ke+Ri7fc7Waiz45mO7yfOgLgJ90WmMCV1Aqk5IGadZQ1nJBfiDcGrVmVCrDRZ9MZ
-yonnMlo2HD6CqFqTvsbQZJG2z9m2GM/bftJlo6bEjhcxwft+dtvTheNYsnd6djts
-L1Ac59v2Z3kf9YKVmgenFK+P3CghZwnS1k1aHBkcjndcw5QkPTJrS37UeJSDvjdN
-zl/HHk484IkzlQsPpTLWPFp5LBk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIGLzCCBBegAwIBAgIIJaHfyjPLWQIwDQYJKoZIhvcNAQELBQAwgaQxCzAJBgNV
-BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw
-IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy
-dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEfMB0GA1UEAwwWVHJ1c3RDb3Ig
-Um9vdENlcnQgQ0EtMjAeFw0xNjAyMDQxMjMyMjNaFw0zNDEyMzExNzI2MzlaMIGk
-MQswCQYDVQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEg
-Q2l0eTEkMCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYD
-VQQLDB5UcnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRy
-dXN0Q29yIFJvb3RDZXJ0IENBLTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQCnIG7CKqJiJJWQdsg4foDSq8GbZQWU9MEKENUCrO2fk8eHyLAnK0IMPQo+
-QVqedd2NyuCb7GgypGmSaIwLgQ5WoD4a3SwlFIIvl9NkRvRUqdw6VC0xK5mC8tkq
-1+9xALgxpL56JAfDQiDyitSSBBtlVkxs1Pu2YVpHI7TYabS3OtB0PAx1oYxOdqHp
-2yqlO/rOsP9+aij9JxzIsekp8VduZLTQwRVtDr4uDkbIXvRR/u8OYzo7cbrPb1nK
-DOObXUm4TOJXsZiKQlecdu/vvdFoqNL0Cbt3Nb4lggjEFixEIFapRBF37120Hape
-az6LMvYHL1cEksr1/p3C6eizjkxLAjHZ5DxIgif3GIJ2SDpxsROhOdUuxTTCHWKF
-3wP+TfSvPd9cW436cOGlfifHhi5qjxLGhF5DUVCcGZt45vz27Ud+ez1m7xMTiF88
-oWP7+ayHNZ/zgp6kPwqcMWmLmaSISo5uZk3vFsQPeSghYA2FFn3XVDjxklb9tTNM
-g9zXEJ9L/cb4Qr26fHMC4P99zVvh1Kxhe1fVSntb1IVYJ12/+CtgrKAmrhQhJ8Z3
-mjOAPF5GP/fDsaOGM8boXg25NSyqRsGFAnWAoOsk+xWq5Gd/bnc/9ASKL3x74xdh
-8N0JqSDIvgmk0H5Ew7IwSjiqqewYmgeCK9u4nBit2uBGF6zPXQIDAQABo2MwYTAd
-BgNVHQ4EFgQU2f4hQG6UnrybPZx9mCAZ5YwwYrIwHwYDVR0jBBgwFoAU2f4hQG6U
-nrybPZx9mCAZ5YwwYrIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw
-DQYJKoZIhvcNAQELBQADggIBAJ5Fngw7tu/hOsh80QA9z+LqBrWyOrsGS2h60COX
-dKcs8AjYeVrXWoSK2BKaG9l9XE1wxaX5q+WjiYndAfrs3fnpkpfbsEZC89NiqpX+
-MWcUaViQCqoL7jcjx1BRtPV+nuN79+TMQjItSQzL/0kMmx40/W5ulop5A7Zv2wnL
-/V9lFDfhOPXzYRZY5LVtDQsEGz9QLX+zx3oaFoBg+Iof6Rsqxvm6ARppv9JYx1RX
-CI/hOWB3S6xZhBqI8d3LT3jX5+EzLfzuQfogsL7L9ziUwOHQhQ+77Sxzq+3+knYa
-ZH9bDTMJBzN7Bj8RpFxwPIXAz+OQqIN3+tvmxYxoZxBnpVIt8MSZj3+/0WvitUfW
-2dCFmU2Umw9Lje4AWkcdEQOsQRivh7dvDDqPys/cA8GiCcjl/YBeyGBCARsaU1q7
-N6a3vLqE6R5sGtRk2tRD/pOLS/IseRYQ1JMLiI+h2IYURpFHmygk71dSTlxCnKr3
-Sewn6EAes6aJInKc9Q0ztFijMDvd1GpUk74aTfOTlPf8hAs/hCBcNANExdqtvArB
-As8e5ZTZ845b2EzwnexhF7sUMlQMAimTHpKG9n/v55IFDlndmQguLvqcAFLTxWYp
-5KeXRKQOKIETNcX2b2TmQcTVL8w0RSXPQQCWPUouwpaYT05KnJe32x+SMsj/D1Fu
-1uwJ
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDZzCCAk+gAwIBAgIQGx+ttiD5JNM2a/fH8YygWTANBgkqhkiG9w0BAQUFADBF
-MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPVHJ1c3RpcyBMaW1pdGVkMRwwGgYDVQQL
-ExNUcnVzdGlzIEZQUyBSb290IENBMB4XDTAzMTIyMzEyMTQwNloXDTI0MDEyMTEx
-MzY1NFowRTELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1RydXN0aXMgTGltaXRlZDEc
-MBoGA1UECxMTVHJ1c3RpcyBGUFMgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAMVQe547NdDfxIzNjpvto8A2mfRC6qc+gIMPpqdZh8mQRUN+
-AOqGeSoDvT03mYlmt+WKVoaTnGhLaASMk5MCPjDSNzoiYYkchU59j9WvezX2fihH
-iTHcDnlkH5nSW7r+f2C/revnPDgpai/lkQtV/+xvWNUtyd5MZnGPDNcE2gfmHhjj
-vSkCqPoc4Vu5g6hBSLwacY3nYuUtsuvffM/bq1rKMfFMIvMFE/eC+XN5DL7XSxzA
-0RU8k0Fk0ea+IxciAIleH2ulrG6nS4zto3Lmr2NNL4XSFDWaLk6M6jKYKIahkQlB
-OrTh4/L68MkKokHdqeMDx4gVOxzUGpTXn2RZEm0CAwEAAaNTMFEwDwYDVR0TAQH/
-BAUwAwEB/zAfBgNVHSMEGDAWgBS6+nEleYtXQSUhhgtx67JkDoshZzAdBgNVHQ4E
-FgQUuvpxJXmLV0ElIYYLceuyZA6LIWcwDQYJKoZIhvcNAQEFBQADggEBAH5Y//01
-GX2cGE+esCu8jowU/yyg2kdbw++BLa8F6nRIW/M+TgfHbcWzk88iNVy2P3UnXwmW
-zaD+vkAMXBJV+JOCyinpXj9WV4s4NvdFGkwozZ5BuO1WTISkQMi4sKUraXAEasP4
-1BIy+Q7DsdwyhEQsb8tGD+pmQQ9P8Vilpg0ND2HepZ5dfWWhPBfnqFVO76DH7cZE
-f1T1o+CP8HxVIo8ptoGj4W1OLBuAZ+ytIJ8MYmHVl/9D7S3B2l0pKoU/rGXuhg8F
-jZBf3+6f9L/uHfuY5H+QK4R4EA5sSVPvFVtlRkpdr7r7OnIdzfYliB6XzCGcKQEN
-ZetX2fNXlrtIzYE=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFWjCCA0KgAwIBAgIQT9Irj/VkyDOeTzRYZiNwYDANBgkqhkiG9w0BAQsFADBH
-MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNVBAMMHFVDQSBF
-eHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwHhcNMTUwMzEzMDAwMDAwWhcNMzgxMjMx
-MDAwMDAwWjBHMQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNV
-BAMMHFVDQSBFeHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQCpCQcoEwKwmeBkqh5DFnpzsZGgdT6o+uM4AHrsiWog
-D4vFsJszA1qGxliG1cGFu0/GnEBNyr7uaZa4rYEwmnySBesFK5pI0Lh2PpbIILvS
-sPGP2KxFRv+qZ2C0d35qHzwaUnoEPQc8hQ2E0B92CvdqFN9y4zR8V05WAT558aop
-O2z6+I9tTcg1367r3CTueUWnhbYFiN6IXSV8l2RnCdm/WhUFhvMJHuxYMjMR83dk
-sHYf5BA1FxvyDrFspCqjc/wJHx4yGVMR59mzLC52LqGj3n5qiAno8geK+LLNEOfi
-c0CTuwjRP+H8C5SzJe98ptfRr5//lpr1kXuYC3fUfugH0mK1lTnj8/FtDw5lhIpj
-VMWAtuCeS31HJqcBCF3RiJ7XwzJE+oJKCmhUfzhTA8ykADNkUVkLo4KRel7sFsLz
-KuZi2irbWWIQJUoqgQtHB0MGcIfS+pMRKXpITeuUx3BNr2fVUbGAIAEBtHoIppB/
-TuDvB0GHr2qlXov7z1CymlSvw4m6WC31MJixNnI5fkkE/SmnTHnkBVfblLkWU41G
-sx2VYVdWf6/wFlthWG82UBEL2KwrlRYaDh8IzTY0ZRBiZtWAXxQgXy0MoHgKaNYs
-1+lvK9JKBZP8nm9rZ/+I8U6laUpSNwXqxhaN0sSZ0YIrO7o1dfdRUVjzyAfd5LQD
-fwIDAQABo0IwQDAdBgNVHQ4EFgQU2XQ65DA9DfcS3H5aBZ8eNJr34RQwDwYDVR0T
-AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBADaN
-l8xCFWQpN5smLNb7rhVpLGsaGvdftvkHTFnq88nIua7Mui563MD1sC3AO6+fcAUR
-ap8lTwEpcOPlDOHqWnzcSbvBHiqB9RZLcpHIojG5qtr8nR/zXUACE/xOHAbKsxSQ
-VBcZEhrxH9cMaVr2cXj0lH2RC47skFSOvG+hTKv8dGT9cZr4QQehzZHkPJrgmzI5
-c6sq1WnIeJEmMX3ixzDx/BR4dxIOE/TdFpS/S2d7cFOFyrC78zhNLJA5wA3CXWvp
-4uXViI3WLL+rG761KIcSF3Ru/H38j9CHJrAb+7lsq+KePRXBOy5nAliRn+/4Qh8s
-t2j1da3Ptfb/EX3C8CSlrdP6oDyp+l3cpaDvRKS+1ujl5BOWF3sGPjLtx7dCvHaj
-2GU4Kzg1USEODm8uNBNA4StnDG1KQTAYI1oyVZnJF+A83vbsea0rWBmirSwiGpWO
-vpaQXUJXxPkUAzUrHC1RVwinOt4/5Mi0A3PCwSaAuwtCH60NryZy2sy+s6ODWA2C
-xR9GUeOcGMyNm43sSet1UNWMKFnKdDTajAshqx7qG+XH/RU+wBeq+yNuJkbL+vmx
-cmtpzyKEC2IPrNkZAJSidjzULZrtBJ4tBmIQN1IchXIbJ+XMxjHsN+xjWZsLHXbM
-fjKaiJUINlK73nZfdklJrX+9ZSCyycErdhh2n1ax
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFRjCCAy6gAwIBAgIQXd+x2lqj7V2+WmUgZQOQ7zANBgkqhkiG9w0BAQsFADA9
-MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxGzAZBgNVBAMMElVDQSBH
-bG9iYWwgRzIgUm9vdDAeFw0xNjAzMTEwMDAwMDBaFw00MDEyMzEwMDAwMDBaMD0x
-CzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDEbMBkGA1UEAwwSVUNBIEds
-b2JhbCBHMiBSb290MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxeYr
-b3zvJgUno4Ek2m/LAfmZmqkywiKHYUGRO8vDaBsGxUypK8FnFyIdK+35KYmToni9
-kmugow2ifsqTs6bRjDXVdfkX9s9FxeV67HeToI8jrg4aA3++1NDtLnurRiNb/yzm
-VHqUwCoV8MmNsHo7JOHXaOIxPAYzRrZUEaalLyJUKlgNAQLx+hVRZ2zA+te2G3/R
-VogvGjqNO7uCEeBHANBSh6v7hn4PJGtAnTRnvI3HLYZveT6OqTwXS3+wmeOwcWDc
-C/Vkw85DvG1xudLeJ1uK6NjGruFZfc8oLTW4lVYa8bJYS7cSN8h8s+1LgOGN+jIj
-tm+3SJUIsUROhYw6AlQgL9+/V087OpAh18EmNVQg7Mc/R+zvWr9LesGtOxdQXGLY
-D0tK3Cv6brxzks3sx1DoQZbXqX5t2Okdj4q1uViSukqSKwxW/YDrCPBeKW4bHAyv
-j5OJrdu9o54hyokZ7N+1wxrrFv54NkzWbtA+FxyQF2smuvt6L78RHBgOLXMDj6Dl
-NaBa4kx1HXHhOThTeEDMg5PXCp6dW4+K5OXgSORIskfNTip1KnvyIvbJvgmRlld6
-iIis7nCs+dwp4wwcOxJORNanTrAmyPPZGpeRaOrvjUYG0lZFWJo8DA+DuAUlwznP
-O6Q0ibd5Ei9Hxeepl2n8pndntd978XplFeRhVmUCAwEAAaNCMEAwDgYDVR0PAQH/
-BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIHEjMz15DD/pQwIX4wV
-ZyF0Ad/fMA0GCSqGSIb3DQEBCwUAA4ICAQATZSL1jiutROTL/7lo5sOASD0Ee/oj
-L3rtNtqyzm325p7lX1iPyzcyochltq44PTUbPrw7tgTQvPlJ9Zv3hcU2tsu8+Mg5
-1eRfB70VVJd0ysrtT7q6ZHafgbiERUlMjW+i67HM0cOU2kTC5uLqGOiiHycFutfl
-1qnN3e92mI0ADs0b+gO3joBYDic/UvuUospeZcnWhNq5NXHzJsBPd+aBJ9J3O5oU
-b3n09tDh05S60FdRvScFDcH9yBIw7m+NESsIndTUv4BFFJqIRNow6rSn4+7vW4LV
-PtateJLbXDzz2K36uGt/xDYotgIVilQsnLAXc47QN6MUPJiVAAwpBVueSUmxX8fj
-y88nZY41F7dXyDDZQVu5FLbowg+UMaeUmMxq67XhJ/UQqAHojhJi6IjMtX9Gl8Cb
-EGY4GjZGXyJoPd/JxhMnq1MGrKI8hgZlb7F+sSlEmqO6SWkoaY/X5V+tBIZkbxqg
-DMUIYs6Ao9Dz7GjevjPHF1t/gMRMTLGmhIrDO7gJzRSBuhjjVFc2/tsvfEehOjPI
-+Vg7RE+xygKJBJYoaMVLuCaJu9YzL1DV/pqJuhgyklTGW+Cd+V7lDSKb9triyCGy
-YiGqhkCyLmTTX8jjfhFnRR8F/uOi77Oos/N9j/gMHyIfLXC0uAE0djAA5SN4p1bX
-UB+K+wb1whnw0A==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDEL
-MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
-eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
-JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAx
-MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
-Ck5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUg
-VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlm
-aWNhdGlvbiBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqflo
-I+d61SRvU8Za2EurxtW20eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinng
-o4N+LZfQYcTxmdwlkWOrfzCjtHDix6EznPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0G
-A1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNVHQ8BAf8EBAMCAQYwDwYD
-VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBBHU6+4WMB
-zzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbW
-RNZu9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
-iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
-cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
-BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
-MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
-BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
-aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
-dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
-3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
-tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
-Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
-VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
-79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
-c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
-Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
-c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
-UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
-Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
-BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
-A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
-Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
-VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
-ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
-8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
-iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
-Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
-XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
-qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
-VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
-L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
-jjxDah2nGN59PRbxYvnKkKj9
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEojCCA4qgAwIBAgIQRL4Mi1AAJLQR0zYlJWfJiTANBgkqhkiG9w0BAQUFADCB
-rjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
-Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
-dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3Qt
-Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw05OTA3MDkxNzI4NTBa
-Fw0xOTA3MDkxNzM2NThaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAV
-BgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l
-dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UE
-AxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWls
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3B
-YHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9
-hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8om+rWV6l
-L8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLm
-SGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM
-1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws
-6wIDAQABo4G5MIG2MAsGA1UdDwQEAwIBxjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
-DgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTBYBgNVHR8EUTBPME2gS6BJhkdodHRw
-Oi8vY3JsLnVzZXJ0cnVzdC5jb20vVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50
-aWNhdGlvbmFuZEVtYWlsLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
-AwQwDQYJKoZIhvcNAQEFBQADggEBALFtYV2mGn98q0rkMPxTbyUkxsrt4jFcKw7u
-7mFVbwQ+zznexRtJlOTrIEy05p5QLnLZjfWqo7NK2lYcYJeA3IKirUq9iiv/Cwm0
-xtcgBEXkzYABurorbs6q15L+5K/r9CYdFip/bDCVNy8zEqx/3cfREYxRmLLQo5HQ
-rfafnoOTHh1CuEava2bwm3/q4wMC5QJRwarVNZ1yQAOJujEdxRBoUp7fooXFXAim
-eOZTT7Hot9MUnpOmw2TjrH5xzbyf6QMbzPvprDHBr3wVdAKZw7JHpsIyYdfHb0gk
-USeh1YdV8nuPmD0Wnu51tvjQjvLzxq4oW6fw8zYX/MMF08oDSlQ=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDhDCCAwqgAwIBAgIQL4D+I4wOIg9IZxIokYesszAKBggqhkjOPQQDAzCByjEL
-MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW
-ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNyBWZXJpU2ln
-biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp
-U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5IC0gRzQwHhcNMDcxMTA1MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCByjELMAkG
-A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJp
-U2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNyBWZXJpU2lnbiwg
-SW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2ln
-biBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
-IC0gRzQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASnVnp8Utpkmw4tXNherJI9/gHm
-GUo9FANL+mAnINmDiWn6VMaaGF5VKmTeBvaNSjutEDxlPZCIBIngMGGzrl0Bp3ve
-fLK+ymVhAIau2o970ImtTR1ZmkGxvEeA3J5iw/mjgbIwga8wDwYDVR0TAQH/BAUw
-AwEB/zAOBgNVHQ8BAf8EBAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJ
-aW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYj
-aHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFLMW
-kf3upm7ktS5Jj4d4gYDs5bG1MAoGCCqGSM49BAMDA2gAMGUCMGYhDBgmYFo4e1ZC
-4Kf8NoRRkSAsdk1DPcQdhCPQrNZ8NQbOzWm9kA3bbEhCHQ6qQgIxAJw9SDkjOVga
-FRJZap7v1VmyHVIsmXHNxynfGyphe3HR3vPA5Q06Sqotp9iGKt0uEA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB
-yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
-U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
-ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL
-MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW
-ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln
-biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp
-U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1
-nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex
-t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz
-SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG
-BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+
-rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/
-NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
-BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH
-BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy
-aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv
-MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE
-p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y
-5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK
-WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ
-4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N
-hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEuTCCA6GgAwIBAgIQQBrEZCGzEyEDDrvkEhrFHTANBgkqhkiG9w0BAQsFADCB
-vTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwOCBWZXJp
-U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MTgwNgYDVQQDEy9W
-ZXJpU2lnbiBVbml2ZXJzYWwgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
-Fw0wODA0MDIwMDAwMDBaFw0zNzEyMDEyMzU5NTlaMIG9MQswCQYDVQQGEwJVUzEX
-MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0
-IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZlcmlTaWduLCBJbmMuIC0gRm9y
-IGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMTL1ZlcmlTaWduIFVuaXZlcnNh
-bCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF
-9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH
-H26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H
-LL729fdC4uW/h2KJXwBL38Xd5HVEMkE6HnFuacsLdUYI0crSK5XQz/u5QGtkjFdN
-/BMReYTtXlT2NJ8IAfMQJQYXStrxHXpma5hgZqTZ79IugvHw7wnqRMkVauIDbjPT
-rJ9VAMf2CGqUuV/c4DPxhGD5WycRtPwW8rtWaoAljQIDAQABo4GyMIGvMA8GA1Ud
-EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMG0GCCsGAQUFBwEMBGEwX6FdoFsw
-WTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI/l0xqGrI2Oa8PPgGrUSBgs
-exkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMB0GA1Ud
-DgQWBBS2d/ppSEefUxLVwuoHMnYH0ZcHGTANBgkqhkiG9w0BAQsFAAOCAQEASvj4
-sAPmLGd75JR3Y8xuTPl9Dg3cyLk1uXBPY/ok+myDjEedO2Pzmvl2MpWRsXe8rJq+
-seQxIcaBlVZaDrHC1LGmWazxY8u4TB1ZkErvkBYoH1quEPuBUDgMbMzxPcP1Y+Oz
-4yHJJDnp/RVmRvQbEdBNc6N9Rvk97ahfYtTxP/jgdFcrGJ2BtMQo2pSXpXDrrB2+
-BxHw1dvd5Yzw1TKwg+ZX4o+/vqGqvz0dtdQ46tewXDpPaj+PwGZsY6rp2aQW9IHR
-lRQOfc2VNNnSj3BzgXucfr2YYdhFh5iQxeuGMMY1v/D/w1WIg0vvBZIGcfK4mJO3
-7M2CYfE45k+XmCpajQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEGjCCAwICEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAMIHKMQsw
-CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
-cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
-LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
-aWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
-dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
-VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
-aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
-bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
-IENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN2E1Lm0+afY8wR4
-nN493GwTFtl63SRRZsDHJlkNrAYIwpTRMx/wgzUfbhvI3qpuFU5UJ+/EbRrsC+MO
-8ESlV8dAWB6jRx9x7GD2bZTIGDnt/kIYVt/kTEkQeE4BdjVjEjbdZrwBBDajVWjV
-ojYJrKshJlQGrT/KFOCsyq0GHZXi+J3x4GD/wn91K0zM2v6HmSHquv4+VNfSWXjb
-PG7PoBMAGrgnoeS+Z5bKoMWznN3JdZ7rMJpfo83ZrngZPyPpXNspva1VyBtUjGP2
-6KbqxzcSXKMpHgLZ2x87tNcPVkeBFQRKr4Mn0cVYiMHd9qqnoxjaaKptEVHhv2Vr
-n5Z20T0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAq2aN17O6x5q25lXQBfGfMY1a
-qtmqRiYPce2lrVNWYgFHKkTp/j90CxObufRNG7LRX7K20ohcs5/Ny9Sn2WCVhDr4
-wTcdYcrnsMXlkdpUpqwxga6X3s0IrLjAl4B/bnKk52kTlWUfxJM8/XmPBNQ+T+r3
-ns7NZ3xPZQL/kYVUc8f/NveGLezQXk//EZ9yBta4GvFMDSZl4kSAHsef493oCtrs
-pSCAaWihT37ha88HQfqDjrw43bAuEbFrskLMmrz5SCJ5ShkPshw+IHTZasO+8ih4
-E1Z5T21Q6huwtVexN2ZYI/PcD98Kh8TvhgXVOBRgmaNL3gaWcSzy27YfpO8/7g==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEGTCCAwECEGFwy0mMX5hFKeewptlQW3owDQYJKoZIhvcNAQEFBQAwgcoxCzAJ
-BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy
-aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s
-IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNp
-Z24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
-eSAtIEczMB4XDTk5MTAwMTAwMDAwMFoXDTM2MDcxNjIzNTk1OVowgcoxCzAJBgNV
-BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp
-Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIElu
-Yy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24g
-Q2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt
-IEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwoNwtUs22e5LeWU
-J92lvuCwTY+zYVY81nzD9M0+hsuiiOLh2KRpxbXiv8GmR1BeRjmL1Za6tW8UvxDO
-JxOeBUebMXoT2B/Z0wI3i60sR/COgQanDTAM6/c8DyAd3HJG7qUCyFvDyVZpTMUY
-wZF7C9UTAJu878NIPkZgIIUq1ZC2zYugzDLdt/1AVbJQHFauzI13TccgTacxdu9o
-koqQHgiBVrKtaaNS0MscxCM9H5n+TOgWY47GCI72MfbS+uV23bUckqNJzc0BzWjN
-qWm6o+sdDZykIKbBoMXRRkwXbdKsZj+WjOCE1Db/IlnF+RFgqF8EffIa9iVCYQ/E
-Srg+iQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA0JhU8wI1NQ0kdvekhktdmnLfe
-xbjQ5F1fdiLAJvmEOjr5jLX77GDx6M4EsMjdpwOPMPOY36TmpDHf0xwLRtxyID+u
-7gU8pDM/CzmscHhzS5kr3zDCVLCoO1Wh/hYozUK9dG6A2ydEp85EXdQbkJgNHkKU
-sQAsBNB0owIFImNjzYO1+8FtYmtpdf1dcEG59b98377BMnMiIYtYgXsVkXq642RI
-sH/7NiXaldDxJBQX3RiAa0YjOVT1jmIJBB2UkKab5iXiQkWquJCtvgiPqQtCGJTP
-cjnhsUPgKM+351psE2tJs//jGHyJizNdrDPXp/naOlXJWBD5qu9ats9LS98q
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw
-CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
-cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
-LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
-aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
-dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
-VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
-aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
-bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
-IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b
-N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t
-KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu
-kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm
-CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ
-Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu
-imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te
-2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe
-DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC
-/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p
-F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt
-TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB
-gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk
-MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY
-UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx
-NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3
-dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy
-dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB
-dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6
-38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP
-KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q
-DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4
-qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa
-JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi
-PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P
-BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs
-jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0
-eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD
-ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR
-vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt
-qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa
-IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy
-i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ
-O+7ETPTsJ3xCwnR8gooJybQDJbw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDODCCAiCgAwIBAgIGIAYFFnACMA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNVBAYT
-AlJPMREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBD
-QTAeFw0wNjA3MDQxNzIwMDRaFw0zMTA3MDQxNzIwMDRaMDsxCzAJBgNVBAYTAlJP
-MREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBDQTCC
-ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALczuX7IJUqOtdu0KBuqV5Do
-0SLTZLrTk+jUrIZhQGpgV2hUhE28alQCBf/fm5oqrl0Hj0rDKH/v+yv6efHHrfAQ
-UySQi2bJqIirr1qjAOm+ukbuW3N7LBeCgV5iLKECZbO9xSsAfsT8AzNXDe3i+s5d
-RdY4zTW2ssHQnIFKquSyAVwdj1+ZxLGt24gh65AIgoDzMKND5pCCrlUoSe1b16kQ
-OA7+j0xbm0bqQfWwCHTD0IgztnzXdN/chNFDDnU5oSVAKOp4yw4sLjmdjItuFhwv
-JoIQ4uNllAoEwF73XVv4EOLQunpL+943AAAaWyjj0pxzPjKHmKHJUS/X3qwzs08C
-AwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0O
-BBYEFOCMm9slSbPxfIbWskKHC9BroNnkMA0GCSqGSIb3DQEBBQUAA4IBAQA+0hyJ
-LjX8+HXd5n9liPRyTMks1zJO890ZeUe9jjtbkw9QSSQTaxQGcu8J06Gh40CEyecY
-MnQ8SG4Pn0vU9x7Tk4ZkVJdjclDVVc/6IJMCopvDI5NOFlV2oHB5bc0hH88vLbwZ
-44gx+FkagQnIl6Z0x2DEW8xXjrJ1/RsCCdtZb3KTafcxQdaIOL+Hsr0Wefmq5L6I
-Jd1hJyMctTEHBDa0GpC9oHRxUIltvBTjD4au8as+x6AJzKNI0eDbZOeStc+vckNw
-i/nDhDwTqn6Sm1dTk/pwwpEOMfmbZ13pljheX7NzTogVZ96edhBiIL5VaZVDADlN
-9u6wWk5JRFRYX0KD
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBe
-MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0
-ZC4xKjAoBgNVBAsMIWVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
-Fw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYTAlRXMSMw
-IQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UECwwhZVBL
-SSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEF
-AAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAH
-SyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAh
-ijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3X
-DZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1
-TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SXDrkb5wdJ
-fzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0OWQqraffA
-sgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uU
-WH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLS
-nT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pH
-dmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJip
-NiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3pyKdVDEC
-AwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMAwGA1UdEwQF
-MAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH
-ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB
-uvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl
-PwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP
-JXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrsStZf0X4OFunHB2WyBEXYKCrC/
-gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEPNXubrjlpC2JgQCA2
-j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+rGNm6
-5ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUB
-o2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS
-/jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2z
-Gp1iro2C6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTE
-W9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+D
-hNQ+IIX3Sj0rnP0qCglN6oH4EZw=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEIDCCAwigAwIBAgIQNE7VVyDV7exJ9C/ON9srbTANBgkqhkiG9w0BAQUFADCB
-qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf
-Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw
-MDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV
-BAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw
-NzE2MjM1OTU5WjCBqTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5j
-LjEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYG
-A1UECxMvKGMpIDIwMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNl
-IG9ubHkxHzAdBgNVBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsoPD7gFnUnMekz52hWXMJEEUMDSxuaPFs
-W0hoSVk3/AszGcJ3f8wQLZU0HObrTQmnHNK4yZc2AreJ1CRfBsDMRJSUjQJib+ta
-3RGNKJpchJAQeg29dGYvajig4tVUROsdB58Hum/u6f1OCyn1PoSgAfGcq/gcfomk
-6KHYcWUNo1F77rzSImANuVud37r8UVsLr5iy6S7pBOhih94ryNdOwUxkHt3Ph1i6
-Sk/KaAcdHJ1KxtUvkcx8cXIcxcBn6zL9yZJclNqFwJu/U30rCfSMnZEfl2pSy94J
-NqR32HuHUETVPm4pafs5SSYeCaWAe0At6+gnhcn+Yf1+5nyXHdWdAgMBAAGjQjBA
-MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBR7W0XP
-r87Lev0xkhpqtvNG61dIUDANBgkqhkiG9w0BAQUFAAOCAQEAeRHAS7ORtvzw6WfU
-DW5FvlXok9LOAz/t2iWwHVfLHjp2oEzsUHboZHIMpKnxuIvW1oeEuzLlQRHAd9mz
-YJ3rG9XRbkREqaYB7FViHXe4XI5ISXycO1cRrK1zN44veFyQaEfZYGDm/Ac9IiAX
-xPcW6cTYcvnIc3zfFi8VqT79aie2oetaupgf1eNNZAqdE8hhuvU5HIe6uL17In/2
-/qxAeeWsEG89jxt5dovEN7MhGITlNgDrYyCZuen+MwS7QcjBAvlEYyCegc5C09Y/
-LHbTY5xZ3Y+m4Q6gLkH3LpVHz7z9M/P2C2F+fpErgUfCJzDupxBdN49cOSvkBPB7
-jVaMaA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICiDCCAg2gAwIBAgIQNfwmXNmET8k9Jj1Xm67XVjAKBggqhkjOPQQDAzCBhDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjE4MDYGA1UECxMvKGMp
-IDIwMDcgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAi
-BgNVBAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMjAeFw0wNzExMDUwMDAw
-MDBaFw0zODAxMTgyMzU5NTlaMIGEMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhh
-d3RlLCBJbmMuMTgwNgYDVQQLEy8oYykgMjAwNyB0aGF3dGUsIEluYy4gLSBGb3Ig
-YXV0aG9yaXplZCB1c2Ugb25seTEkMCIGA1UEAxMbdGhhd3RlIFByaW1hcnkgUm9v
-dCBDQSAtIEcyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEotWcgnuVnfFSeIf+iha/
-BebfowJPDQfGAFG6DAJSLSKkQjnE/o/qycG+1E3/n3qe4rF8mq2nhglzh9HnmuN6
-papu+7qzcMBniKI11KOasf2twu8x+qi58/sIxpHR+ymVo0IwQDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUmtgAMADna3+FGO6Lts6K
-DPgR4bswCgYIKoZIzj0EAwMDaQAwZgIxAN344FdHW6fmCsO99YCKlzUNG4k8VIZ3
-KMqh9HneteY4sPBlcIx/AlTCv//YoT7ZzwIxAMSNlPzcU9LcnXgWHxUzI1NS41ox
-XZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEKjCCAxKgAwIBAgIQYAGXt0an6rS0mtZLL/eQ+zANBgkqhkiG9w0BAQsFADCB
-rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf
-Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw
-MDggdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAiBgNV
-BAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMzAeFw0wODA0MDIwMDAwMDBa
-Fw0zNzEyMDEyMzU5NTlaMIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3Rl
-LCBJbmMuMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9u
-MTgwNgYDVQQLEy8oYykgMjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXpl
-ZCB1c2Ugb25seTEkMCIGA1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsr8nLPvb2FvdeHsbnndm
-gcs+vHyu86YnmjSjaDFxODNi5PNxZnmxqWWjpYvVj2AtP0LMqmsywCPLLEHd5N/8
-YZzic7IilRFDGF/Eth9XbAoFWCLINkw6fKXRz4aviKdEAhN0cXMKQlkC+BsUa0Lf
-b1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9
-9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S
-zhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk
-OQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV
-HQ4EFgQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8wDQYJKoZIhvcNAQELBQADggEBABpA
-2JVlrAmSicY59BDlqQ5mU1143vokkbvnRFHfxhY0Cu9qRFHqKweKA3rD6z8KLFIW
-oCtDuSWQP3CpMyVtRRooOyfPqsMpQhvfO0zAMzRbQYi/aytlryjvsvXDqmbOe1bu
-t8jLZ8HJnBoYuMTDSQPxYA5QzUbF83d597YV4Djbxy8ooAw/dyZ02SUS2jHaGh7c
-KUGRIjxpp7sC8rZcJwOJ9Abqm+RyguOhCcHpABnTPtRwa7pxpqpYrvS76Wy274fM
-m7v/OeZWYdMKp8RcTGB7BXcmer/YB1IsYvdwY9k5vG8cwnncdimvzsUsZAReiDZu
-MdRAGmI0Nj81Aa6sY6A=
------END CERTIFICATE-----
diff --git a/script/code-gen-docker.sh b/script/code-gen-docker.sh
deleted file mode 100755
index e69de29bb..000000000
diff --git a/script/code-gen.sh b/script/code-gen.sh
index 529930801..3f0112f35 100755
--- a/script/code-gen.sh
+++ b/script/code-gen.sh
@@ -4,11 +4,11 @@ set -e -o pipefail
 
 PROJECT_MODULE="github.com/traefik/traefik"
 MODULE_VERSION="v3"
-KUBE_VERSION=v0.30.10
+KUBE_VERSION=v0.34.3
 CURRENT_DIR="$(pwd)"
 
 go install "k8s.io/code-generator/cmd/deepcopy-gen@${KUBE_VERSION}"
-go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.1
+go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0
 
 CODEGEN_PKG="$(go env GOPATH)/pkg/mod/k8s.io/code-generator@${KUBE_VERSION}"
 # shellcheck disable=SC1091 # Cannot check source of this file
@@ -20,6 +20,7 @@ kube::codegen::gen_helpers \
   "${CURRENT_DIR}"
 
 kube::codegen::gen_client \
+    --with-applyconfig \
     --with-watch \
     --output-dir "${CURRENT_DIR}/pkg/provider/kubernetes/crd/generated" \
     --output-pkg "${PROJECT_MODULE}/${MODULE_VERSION}/pkg/provider/kubernetes/crd/generated" \
@@ -34,3 +35,6 @@ controller-gen crd:crdVersions=v1 \
 echo "# Concatenate the CRD definitions for publication and integration tests ..."
 cat "${CURRENT_DIR}"/docs/content/reference/dynamic-configuration/traefik.io_*.yaml > "${CURRENT_DIR}"/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
 cp -f "${CURRENT_DIR}"/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml "${CURRENT_DIR}"/integration/fixtures/k8s/01-traefik-crd.yml
+
+# Remove leading '---' from the concatenated file (files with multiple resources should not start with ---)
+sed -i '1{/^---$/d;}' "${CURRENT_DIR}"/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
diff --git a/script/gcg/traefik-bugfix.toml b/script/gcg/traefik-bugfix.toml
index 36d6242a3..a893c77c6 100644
--- a/script/gcg/traefik-bugfix.toml
+++ b/script/gcg/traefik-bugfix.toml
@@ -4,14 +4,14 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example new bugfix v3.5.4
-CurrentRef = "v3.5"
-PreviousRef = "v3.5.3"
-BaseBranch = "v3.5"
-FutureCurrentRefName = "v3.5.4"
+# example new bugfix v3.6.7
+CurrentRef = "v3.6"
+PreviousRef = "v3.6.6"
+BaseBranch = "v3.6"
+FutureCurrentRefName = "v3.6.7"
 
-ThresholdPreviousRef = 10
-ThresholdCurrentRef = 10
+ThresholdPreviousRef = 10000
+ThresholdCurrentRef = 10000
 
 Debug = true
 DisplayLabel = true
diff --git a/script/gcg/traefik-final-release-part1.toml b/script/gcg/traefik-final-release-part1.toml
index 95291aea5..844b5809a 100644
--- a/script/gcg/traefik-final-release-part1.toml
+++ b/script/gcg/traefik-final-release-part1.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example final release of v3.5.0
-CurrentRef = "v3.5"
-PreviousRef = "v3.5.0-rc1"
-BaseBranch = "v3.5"
-FutureCurrentRefName = "v3.5.0"
+# example final release of v3.6.0
+CurrentRef = "v3.6"
+PreviousRef = "v3.6.0-rc1"
+BaseBranch = "v3.6"
+FutureCurrentRefName = "v3.6.0"
 
 ThresholdPreviousRef = 10
 ThresholdCurrentRef = 10
diff --git a/script/gcg/traefik-final-release-part2.toml b/script/gcg/traefik-final-release-part2.toml
index ceaa118de..925566e7f 100644
--- a/script/gcg/traefik-final-release-part2.toml
+++ b/script/gcg/traefik-final-release-part2.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example final release of v3.5.0
-CurrentRef = "v3.5.0-rc1"
-PreviousRef = "v3.4.0-rc1"
+# example final release of v3.6.0
+CurrentRef = "v3.6.0-rc1"
+PreviousRef = "v3.5.0-rc1"
 BaseBranch = "master"
-FutureCurrentRefName = "v3.5.0"
+FutureCurrentRefName = "v3.6.0"
 
 ThresholdPreviousRef = 10
 ThresholdCurrentRef = 10
diff --git a/script/gcg/traefik-rc-first.toml b/script/gcg/traefik-rc-first.toml
index a946c438d..29e3d0456 100644
--- a/script/gcg/traefik-rc-first.toml
+++ b/script/gcg/traefik-rc-first.toml
@@ -4,11 +4,11 @@ RepositoryName = "traefik"
 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example RC1 of v3.5.0-rc1
+# example RC1 of v3.6.0-rc1
 CurrentRef = "master"
-PreviousRef = "v3.4.0-rc1"
+PreviousRef = "v3.5.0-rc1"
 BaseBranch = "master"
-FutureCurrentRefName = "v3.5.0-rc1"
+FutureCurrentRefName = "v3.6.0-rc1"
 
 ThresholdPreviousRef = 10
 ThresholdCurrentRef = 10
diff --git a/script/update-cert.sh b/script/update-cert.sh
deleted file mode 100755
index 5816df6cf..000000000
--- a/script/update-cert.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-set -e
-
-CERT_IMAGE="alpine:edge"
-
-# cd to the current directory so the script can be run from anywhere.
-SCRIPT_DIR="$( cd "$( dirname "${0}" )" && pwd -P)"; export SCRIPT_DIR
-cd "${SCRIPT_DIR}"
-
-# Update the cert image.
-docker pull $CERT_IMAGE
-
-# Fetch the latest certificates.
-ID=$(docker run -d $CERT_IMAGE sh -c "apk --update upgrade && apk add ca-certificates && update-ca-certificates")
-docker logs -f "${ID}"
-docker wait "${ID}"
-
-# Update the local certificates.
-docker cp "${ID}":/etc/ssl/certs/ca-certificates.crt "${SCRIPT_DIR}"
-
-# Cleanup.
-docker rm -f "${ID}"
diff --git a/webui/.nvmrc b/webui/.nvmrc
index 26600046d..0a492611a 100644
--- a/webui/.nvmrc
+++ b/webui/.nvmrc
@@ -1 +1 @@
-v22.15.1
+24.11.0
diff --git a/webui/.yarnrc.yml b/webui/.yarnrc.yml
index 3186f3f07..94f5c254e 100644
--- a/webui/.yarnrc.yml
+++ b/webui/.yarnrc.yml
@@ -1 +1,2 @@
 nodeLinker: node-modules
+enableScripts: false
diff --git a/webui/buildx.Dockerfile b/webui/buildx.Dockerfile
index 09b65ab81..4d64776fd 100644
--- a/webui/buildx.Dockerfile
+++ b/webui/buildx.Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22.15.1-alpine3.20
+FROM node:24-alpine3.22
 
 ENV WEBUI_DIR=/src/webui
 RUN mkdir -p $WEBUI_DIR
diff --git a/webui/package.json b/webui/package.json
index 3721a8ae1..b75ac6d1b 100644
--- a/webui/package.json
+++ b/webui/package.json
@@ -43,11 +43,13 @@
   "type": "module",
   "dependencies": {
     "@eslint/js": "^9.32.0",
+    "@noble/ed25519": "^3.0.0",
+    "@noble/hashes": "^2.0.1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.4.2",
     "@testing-library/react": "^14.2.1",
     "@testing-library/user-event": "^14.5.2",
-    "@traefiklabs/faency": "11.1.4",
+    "@traefiklabs/faency": "12.0.4",
     "@types/lodash": "^4.17.16",
     "@types/node": "^22.15.18",
     "@types/react": "^18.2.0",
@@ -56,6 +58,7 @@
     "@typescript-eslint/parser": "^8.38.0",
     "@vitejs/plugin-react": "^4.7.0",
     "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/web-worker": "^4.0.2",
     "chart.js": "^4.4.1",
     "eslint": "^9.32.0",
     "eslint-config-prettier": "^10.1.8",
@@ -85,7 +88,7 @@
     "usehooks-ts": "^2.14.0",
     "vite": "^5.4.19",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4",
+    "vitest": "^4.0.3",
     "vitest-canvas-mock": "^0.3.3"
   },
   "devDependencies": {
diff --git a/webui/public/img/gopher-something-went-wrong.png b/webui/public/img/gopher-something-went-wrong.png
new file mode 100644
index 000000000..fb0d6d4c3
Binary files /dev/null and b/webui/public/img/gopher-something-went-wrong.png differ
diff --git a/webui/public/traefiklabs-hub-button-app/main-v1.js b/webui/public/traefiklabs-hub-button-app/main-v1.js
deleted file mode 100644
index e140dab34..000000000
--- a/webui/public/traefiklabs-hub-button-app/main-v1.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/* eslint-disable */
-(()=>{var e={110:(e,t,n)=>{"use strict";var r=n(309),a={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},l={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},o={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},i={};function u(e){return r.isMemo(e)?o:i[e.$$typeof]||a}i[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},i[r.Memo]=o;var s=Object.defineProperty,c=Object.getOwnPropertyNames,f=Object.getOwnPropertySymbols,d=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,h=Object.prototype;e.exports=function e(t,n,r){if("string"!==typeof n){if(h){var a=p(n);a&&a!==h&&e(t,a,r)}var o=c(n);f&&(o=o.concat(f(n)));for(var i=u(t),m=u(n),g=0;g<o.length;++g){var v=o[g];if(!l[v]&&(!r||!r[v])&&(!m||!m[v])&&(!i||!i[v])){var y=d(n,v);try{s(t,v,y)}catch(b){}}}}return t}},746:(e,t)=>{"use strict";var n="function"===typeof Symbol&&Symbol.for,r=n?Symbol.for("react.element"):60103,a=n?Symbol.for("react.portal"):60106,l=n?Symbol.for("react.fragment"):60107,o=n?Symbol.for("react.strict_mode"):60108,i=n?Symbol.for("react.profiler"):60114,u=n?Symbol.for("react.provider"):60109,s=n?Symbol.for("react.context"):60110,c=n?Symbol.for("react.async_mode"):60111,f=n?Symbol.for("react.concurrent_mode"):60111,d=n?Symbol.for("react.forward_ref"):60112,p=n?Symbol.for("react.suspense"):60113,h=n?Symbol.for("react.suspense_list"):60120,m=n?Symbol.for("react.memo"):60115,g=n?Symbol.for("react.lazy"):60116,v=n?Symbol.for("react.block"):60121,y=n?Symbol.for("react.fundamental"):60117,b=n?Symbol.for("react.responder"):60118,S=n?Symbol.for("react.scope"):60119;function k(e){if("object"===typeof e&&null!==e){var t=e.$$typeof;switch(t){case r:switch(e=e.type){case c:case f:case l:case i:case o:case p:return e;default:switch(e=e&&e.$$typeof){case s:case d:case g:case m:case u:return e;default:return t}}case a:return t}}}function w(e){return k(e)===f}t.AsyncMode=c,t.ConcurrentMode=f,t.ContextConsumer=s,t.ContextProvider=u,t.Element=r,t.ForwardRef=d,t.Fragment=l,t.Lazy=g,t.Memo=m,t.Portal=a,t.Profiler=i,t.StrictMode=o,t.Suspense=p,t.isAsyncMode=function(e){return w(e)||k(e)===c},t.isConcurrentMode=w,t.isContextConsumer=function(e){return k(e)===s},t.isContextProvider=function(e){return k(e)===u},t.isElement=function(e){return"object"===typeof e&&null!==e&&e.$$typeof===r},t.isForwardRef=function(e){return k(e)===d},t.isFragment=function(e){return k(e)===l},t.isLazy=function(e){return k(e)===g},t.isMemo=function(e){return k(e)===m},t.isPortal=function(e){return k(e)===a},t.isProfiler=function(e){return k(e)===i},t.isStrictMode=function(e){return k(e)===o},t.isSuspense=function(e){return k(e)===p},t.isValidElementType=function(e){return"string"===typeof e||"function"===typeof e||e===l||e===f||e===i||e===o||e===p||e===h||"object"===typeof e&&null!==e&&(e.$$typeof===g||e.$$typeof===m||e.$$typeof===u||e.$$typeof===s||e.$$typeof===d||e.$$typeof===y||e.$$typeof===b||e.$$typeof===S||e.$$typeof===v)},t.typeOf=k},309:(e,t,n)=>{"use strict";e.exports=n(746)},463:(e,t,n)=>{"use strict";var r=n(791),a=n(296);function l(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,i={};function u(e,t){s(e,t),s(e+"Capture",t)}function s(e,t){for(i[e]=t,e=0;e<t.length;e++)o.add(t[e])}var c=!("undefined"===typeof window||"undefined"===typeof window.document||"undefined"===typeof window.document.createElement),f=Object.prototype.hasOwnProperty,d=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,p={},h={};function m(e,t,n,r,a,l,o){this.acceptsBooleans=2===t||3===t||4===t,this.attributeName=r,this.attributeNamespace=a,this.mustUseProperty=n,this.propertyName=e,this.type=t,this.sanitizeURL=l,this.removeEmptyString=o}var g={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach((function(e){g[e]=new m(e,0,!1,e,null,!1,!1)})),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach((function(e){var t=e[0];g[t]=new m(t,1,!1,e[1],null,!1,!1)})),["contentEditable","draggable","spellCheck","value"].forEach((function(e){g[e]=new m(e,2,!1,e.toLowerCase(),null,!1,!1)})),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach((function(e){g[e]=new m(e,2,!1,e,null,!1,!1)})),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach((function(e){g[e]=new m(e,3,!1,e.toLowerCase(),null,!1,!1)})),["checked","multiple","muted","selected"].forEach((function(e){g[e]=new m(e,3,!0,e,null,!1,!1)})),["capture","download"].forEach((function(e){g[e]=new m(e,4,!1,e,null,!1,!1)})),["cols","rows","size","span"].forEach((function(e){g[e]=new m(e,6,!1,e,null,!1,!1)})),["rowSpan","start"].forEach((function(e){g[e]=new m(e,5,!1,e.toLowerCase(),null,!1,!1)}));var v=/[\-:]([a-z])/g;function y(e){return e[1].toUpperCase()}function b(e,t,n,r){var a=g.hasOwnProperty(t)?g[t]:null;(null!==a?0!==a.type:r||!(2<t.length)||"o"!==t[0]&&"O"!==t[0]||"n"!==t[1]&&"N"!==t[1])&&(function(e,t,n,r){if(null===t||"undefined"===typeof t||function(e,t,n,r){if(null!==n&&0===n.type)return!1;switch(typeof t){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))return!0;if(r)return!1;if(null!==n)switch(n.type){case 3:return!t;case 4:return!1===t;case 5:return isNaN(t);case 6:return isNaN(t)||1>t}return!1}(t,n,a,r)&&(n=null),r||null===a?function(e){return!!f.call(h,e)||!f.call(p,e)&&(d.test(e)?h[e]=!0:(p[e]=!0,!1))}(t)&&(null===n?e.removeAttribute(t):e.setAttribute(t,""+n)):a.mustUseProperty?e[a.propertyName]=null===n?3!==a.type&&"":n:(t=a.attributeName,r=a.attributeNamespace,null===n?e.removeAttribute(t):(n=3===(a=a.type)||4===a&&!0===n?"":""+n,r?e.setAttributeNS(r,t,n):e.setAttribute(t,n))))}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height".split(" ").forEach((function(e){var t=e.replace(v,y);g[t]=new m(t,1,!1,e,null,!1,!1)})),"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type".split(" ").forEach((function(e){var t=e.replace(v,y);g[t]=new m(t,1,!1,e,"http://www.w3.org/1999/xlink",!1,!1)})),["xml:base","xml:lang","xml:space"].forEach((function(e){var t=e.replace(v,y);g[t]=new m(t,1,!1,e,"http://www.w3.org/XML/1998/namespace",!1,!1)})),["tabIndex","crossOrigin"].forEach((function(e){g[e]=new m(e,1,!1,e.toLowerCase(),null,!1,!1)})),g.xlinkHref=new m("xlinkHref",1,!1,"xlink:href","http://www.w3.org/1999/xlink",!0,!1),["src","href","action","formAction"].forEach((function(e){g[e]=new m(e,1,!1,e.toLowerCase(),null,!0,!0)}));var S=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED,k=Symbol.for("react.element"),w=Symbol.for("react.portal"),C=Symbol.for("react.fragment"),E=Symbol.for("react.strict_mode"),x=Symbol.for("react.profiler"),_=Symbol.for("react.provider"),P=Symbol.for("react.context"),T=Symbol.for("react.forward_ref"),O=Symbol.for("react.suspense"),N=Symbol.for("react.suspense_list"),R=Symbol.for("react.memo"),z=Symbol.for("react.lazy");Symbol.for("react.scope"),Symbol.for("react.debug_trace_mode");var L=Symbol.for("react.offscreen");Symbol.for("react.legacy_hidden"),Symbol.for("react.cache"),Symbol.for("react.tracing_marker");var A=Symbol.iterator;function I(e){return null===e||"object"!==typeof e?null:"function"===typeof(e=A&&e[A]||e["@@iterator"])?e:null}var D,F=Object.assign;function M(e){if(void 0===D)try{throw Error()}catch(n){var t=n.stack.trim().match(/\n( *(at )?)/);D=t&&t[1]||""}return"\n"+D+e}var U=!1;function $(e,t){if(!e||U)return"";U=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(t)if(t=function(){throw Error()},Object.defineProperty(t.prototype,"props",{set:function(){throw Error()}}),"object"===typeof Reflect&&Reflect.construct){try{Reflect.construct(t,[])}catch(s){var r=s}Reflect.construct(e,[],t)}else{try{t.call()}catch(s){r=s}e.call(t.prototype)}else{try{throw Error()}catch(s){r=s}e()}}catch(s){if(s&&r&&"string"===typeof s.stack){for(var a=s.stack.split("\n"),l=r.stack.split("\n"),o=a.length-1,i=l.length-1;1<=o&&0<=i&&a[o]!==l[i];)i--;for(;1<=o&&0<=i;o--,i--)if(a[o]!==l[i]){if(1!==o||1!==i)do{if(o--,0>--i||a[o]!==l[i]){var u="\n"+a[o].replace(" at new "," at ");return e.displayName&&u.includes("<anonymous>")&&(u=u.replace("<anonymous>",e.displayName)),u}}while(1<=o&&0<=i);break}}}finally{U=!1,Error.prepareStackTrace=n}return(e=e?e.displayName||e.name:"")?M(e):""}function j(e){switch(e.tag){case 5:return M(e.type);case 16:return M("Lazy");case 13:return M("Suspense");case 19:return M("SuspenseList");case 0:case 2:case 15:return e=$(e.type,!1);case 11:return e=$(e.type.render,!1);case 1:return e=$(e.type,!0);default:return""}}function H(e){if(null==e)return null;if("function"===typeof e)return e.displayName||e.name||null;if("string"===typeof e)return e;switch(e){case C:return"Fragment";case w:return"Portal";case x:return"Profiler";case E:return"StrictMode";case O:return"Suspense";case N:return"SuspenseList"}if("object"===typeof e)switch(e.$$typeof){case P:return(e.displayName||"Context")+".Consumer";case _:return(e._context.displayName||"Context")+".Provider";case T:var t=e.render;return(e=e.displayName)||(e=""!==(e=t.displayName||t.name||"")?"ForwardRef("+e+")":"ForwardRef"),e;case R:return null!==(t=e.displayName||null)?t:H(e.type)||"Memo";case z:t=e._payload,e=e._init;try{return H(e(t))}catch(n){}}return null}function W(e){var t=e.type;switch(e.tag){case 24:return"Cache";case 9:return(t.displayName||"Context")+".Consumer";case 10:return(t._context.displayName||"Context")+".Provider";case 18:return"DehydratedFragment";case 11:return e=(e=t.render).displayName||e.name||"",t.displayName||(""!==e?"ForwardRef("+e+")":"ForwardRef");case 7:return"Fragment";case 5:return t;case 4:return"Portal";case 3:return"Root";case 6:return"Text";case 16:return H(t);case 8:return t===E?"StrictMode":"Mode";case 22:return"Offscreen";case 12:return"Profiler";case 21:return"Scope";case 13:return"Suspense";case 19:return"SuspenseList";case 25:return"TracingMarker";case 1:case 0:case 17:case 2:case 14:case 15:if("function"===typeof t)return t.displayName||t.name||null;if("string"===typeof t)return t}return null}function B(e){switch(typeof e){case"boolean":case"number":case"string":case"undefined":case"object":return e;default:return""}}function V(e){var t=e.type;return(e=e.nodeName)&&"input"===e.toLowerCase()&&("checkbox"===t||"radio"===t)}function K(e){e._valueTracker||(e._valueTracker=function(e){var t=V(e)?"checked":"value",n=Object.getOwnPropertyDescriptor(e.constructor.prototype,t),r=""+e[t];if(!e.hasOwnProperty(t)&&"undefined"!==typeof n&&"function"===typeof n.get&&"function"===typeof n.set){var a=n.get,l=n.set;return Object.defineProperty(e,t,{configurable:!0,get:function(){return a.call(this)},set:function(e){r=""+e,l.call(this,e)}}),Object.defineProperty(e,t,{enumerable:n.enumerable}),{getValue:function(){return r},setValue:function(e){r=""+e},stopTracking:function(){e._valueTracker=null,delete e[t]}}}}(e))}function Q(e){if(!e)return!1;var t=e._valueTracker;if(!t)return!0;var n=t.getValue(),r="";return e&&(r=V(e)?e.checked?"true":"false":e.value),(e=r)!==n&&(t.setValue(e),!0)}function q(e){if("undefined"===typeof(e=e||("undefined"!==typeof document?document:void 0)))return null;try{return e.activeElement||e.body}catch(t){return e.body}}function Y(e,t){var n=t.checked;return F({},t,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:null!=n?n:e._wrapperState.initialChecked})}function G(e,t){var n=null==t.defaultValue?"":t.defaultValue,r=null!=t.checked?t.checked:t.defaultChecked;n=B(null!=t.value?t.value:n),e._wrapperState={initialChecked:r,initialValue:n,controlled:"checkbox"===t.type||"radio"===t.type?null!=t.checked:null!=t.value}}function X(e,t){null!=(t=t.checked)&&b(e,"checked",t,!1)}function Z(e,t){X(e,t);var n=B(t.value),r=t.type;if(null!=n)"number"===r?(0===n&&""===e.value||e.value!=n)&&(e.value=""+n):e.value!==""+n&&(e.value=""+n);else if("submit"===r||"reset"===r)return void e.removeAttribute("value");t.hasOwnProperty("value")?ee(e,t.type,n):t.hasOwnProperty("defaultValue")&&ee(e,t.type,B(t.defaultValue)),null==t.checked&&null!=t.defaultChecked&&(e.defaultChecked=!!t.defaultChecked)}function J(e,t,n){if(t.hasOwnProperty("value")||t.hasOwnProperty("defaultValue")){var r=t.type;if(!("submit"!==r&&"reset"!==r||void 0!==t.value&&null!==t.value))return;t=""+e._wrapperState.initialValue,n||t===e.value||(e.value=t),e.defaultValue=t}""!==(n=e.name)&&(e.name=""),e.defaultChecked=!!e._wrapperState.initialChecked,""!==n&&(e.name=n)}function ee(e,t,n){"number"===t&&q(e.ownerDocument)===e||(null==n?e.defaultValue=""+e._wrapperState.initialValue:e.defaultValue!==""+n&&(e.defaultValue=""+n))}var te=Array.isArray;function ne(e,t,n,r){if(e=e.options,t){t={};for(var a=0;a<n.length;a++)t["$"+n[a]]=!0;for(n=0;n<e.length;n++)a=t.hasOwnProperty("$"+e[n].value),e[n].selected!==a&&(e[n].selected=a),a&&r&&(e[n].defaultSelected=!0)}else{for(n=""+B(n),t=null,a=0;a<e.length;a++){if(e[a].value===n)return e[a].selected=!0,void(r&&(e[a].defaultSelected=!0));null!==t||e[a].disabled||(t=e[a])}null!==t&&(t.selected=!0)}}function re(e,t){if(null!=t.dangerouslySetInnerHTML)throw Error(l(91));return F({},t,{value:void 0,defaultValue:void 0,children:""+e._wrapperState.initialValue})}function ae(e,t){var n=t.value;if(null==n){if(n=t.children,t=t.defaultValue,null!=n){if(null!=t)throw Error(l(92));if(te(n)){if(1<n.length)throw Error(l(93));n=n[0]}t=n}null==t&&(t=""),n=t}e._wrapperState={initialValue:B(n)}}function le(e,t){var n=B(t.value),r=B(t.defaultValue);null!=n&&((n=""+n)!==e.value&&(e.value=n),null==t.defaultValue&&e.defaultValue!==n&&(e.defaultValue=n)),null!=r&&(e.defaultValue=""+r)}function oe(e){var t=e.textContent;t===e._wrapperState.initialValue&&""!==t&&null!==t&&(e.value=t)}function ie(e){switch(e){case"svg":return"http://www.w3.org/2000/svg";case"math":return"http://www.w3.org/1998/Math/MathML";default:return"http://www.w3.org/1999/xhtml"}}function ue(e,t){return null==e||"http://www.w3.org/1999/xhtml"===e?ie(t):"http://www.w3.org/2000/svg"===e&&"foreignObject"===t?"http://www.w3.org/1999/xhtml":e}var se,ce,fe=(ce=function(e,t){if("http://www.w3.org/2000/svg"!==e.namespaceURI||"innerHTML"in e)e.innerHTML=t;else{for((se=se||document.createElement("div")).innerHTML="<svg>"+t.valueOf().toString()+"</svg>",t=se.firstChild;e.firstChild;)e.removeChild(e.firstChild);for(;t.firstChild;)e.appendChild(t.firstChild)}},"undefined"!==typeof MSApp&&MSApp.execUnsafeLocalFunction?function(e,t,n,r){MSApp.execUnsafeLocalFunction((function(){return ce(e,t)}))}:ce);function de(e,t){if(t){var n=e.firstChild;if(n&&n===e.lastChild&&3===n.nodeType)return void(n.nodeValue=t)}e.textContent=t}var pe={animationIterationCount:!0,aspectRatio:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,zoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},he=["Webkit","ms","Moz","O"];function me(e,t,n){return null==t||"boolean"===typeof t||""===t?"":n||"number"!==typeof t||0===t||pe.hasOwnProperty(e)&&pe[e]?(""+t).trim():t+"px"}function ge(e,t){for(var n in e=e.style,t)if(t.hasOwnProperty(n)){var r=0===n.indexOf("--"),a=me(n,t[n],r);"float"===n&&(n="cssFloat"),r?e.setProperty(n,a):e[n]=a}}Object.keys(pe).forEach((function(e){he.forEach((function(t){t=t+e.charAt(0).toUpperCase()+e.substring(1),pe[t]=pe[e]}))}));var ve=F({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});function ye(e,t){if(t){if(ve[e]&&(null!=t.children||null!=t.dangerouslySetInnerHTML))throw Error(l(137,e));if(null!=t.dangerouslySetInnerHTML){if(null!=t.children)throw Error(l(60));if("object"!==typeof t.dangerouslySetInnerHTML||!("__html"in t.dangerouslySetInnerHTML))throw Error(l(61))}if(null!=t.style&&"object"!==typeof t.style)throw Error(l(62))}}function be(e,t){if(-1===e.indexOf("-"))return"string"===typeof t.is;switch(e){case"annotation-xml":case"color-profile":case"font-face":case"font-face-src":case"font-face-uri":case"font-face-format":case"font-face-name":case"missing-glyph":return!1;default:return!0}}var Se=null;function ke(e){return(e=e.target||e.srcElement||window).correspondingUseElement&&(e=e.correspondingUseElement),3===e.nodeType?e.parentNode:e}var we=null,Ce=null,Ee=null;function xe(e){if(e=ba(e)){if("function"!==typeof we)throw Error(l(280));var t=e.stateNode;t&&(t=ka(t),we(e.stateNode,e.type,t))}}function _e(e){Ce?Ee?Ee.push(e):Ee=[e]:Ce=e}function Pe(){if(Ce){var e=Ce,t=Ee;if(Ee=Ce=null,xe(e),t)for(e=0;e<t.length;e++)xe(t[e])}}function Te(e,t){return e(t)}function Oe(){}var Ne=!1;function Re(e,t,n){if(Ne)return e(t,n);Ne=!0;try{return Te(e,t,n)}finally{Ne=!1,(null!==Ce||null!==Ee)&&(Oe(),Pe())}}function ze(e,t){var n=e.stateNode;if(null===n)return null;var r=ka(n);if(null===r)return null;n=r[t];e:switch(t){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":case"onMouseEnter":(r=!r.disabled)||(r=!("button"===(e=e.type)||"input"===e||"select"===e||"textarea"===e)),e=!r;break e;default:e=!1}if(e)return null;if(n&&"function"!==typeof n)throw Error(l(231,t,typeof n));return n}var Le=!1;if(c)try{var Ae={};Object.defineProperty(Ae,"passive",{get:function(){Le=!0}}),window.addEventListener("test",Ae,Ae),window.removeEventListener("test",Ae,Ae)}catch(ce){Le=!1}function Ie(e,t,n,r,a,l,o,i,u){var s=Array.prototype.slice.call(arguments,3);try{t.apply(n,s)}catch(c){this.onError(c)}}var De=!1,Fe=null,Me=!1,Ue=null,$e={onError:function(e){De=!0,Fe=e}};function je(e,t,n,r,a,l,o,i,u){De=!1,Fe=null,Ie.apply($e,arguments)}function He(e){var t=e,n=e;if(e.alternate)for(;t.return;)t=t.return;else{e=t;do{0!==(4098&(t=e).flags)&&(n=t.return),e=t.return}while(e)}return 3===t.tag?n:null}function We(e){if(13===e.tag){var t=e.memoizedState;if(null===t&&(null!==(e=e.alternate)&&(t=e.memoizedState)),null!==t)return t.dehydrated}return null}function Be(e){if(He(e)!==e)throw Error(l(188))}function Ve(e){return null!==(e=function(e){var t=e.alternate;if(!t){if(null===(t=He(e)))throw Error(l(188));return t!==e?null:e}for(var n=e,r=t;;){var a=n.return;if(null===a)break;var o=a.alternate;if(null===o){if(null!==(r=a.return)){n=r;continue}break}if(a.child===o.child){for(o=a.child;o;){if(o===n)return Be(a),e;if(o===r)return Be(a),t;o=o.sibling}throw Error(l(188))}if(n.return!==r.return)n=a,r=o;else{for(var i=!1,u=a.child;u;){if(u===n){i=!0,n=a,r=o;break}if(u===r){i=!0,r=a,n=o;break}u=u.sibling}if(!i){for(u=o.child;u;){if(u===n){i=!0,n=o,r=a;break}if(u===r){i=!0,r=o,n=a;break}u=u.sibling}if(!i)throw Error(l(189))}}if(n.alternate!==r)throw Error(l(190))}if(3!==n.tag)throw Error(l(188));return n.stateNode.current===n?e:t}(e))?Ke(e):null}function Ke(e){if(5===e.tag||6===e.tag)return e;for(e=e.child;null!==e;){var t=Ke(e);if(null!==t)return t;e=e.sibling}return null}var Qe=a.unstable_scheduleCallback,qe=a.unstable_cancelCallback,Ye=a.unstable_shouldYield,Ge=a.unstable_requestPaint,Xe=a.unstable_now,Ze=a.unstable_getCurrentPriorityLevel,Je=a.unstable_ImmediatePriority,et=a.unstable_UserBlockingPriority,tt=a.unstable_NormalPriority,nt=a.unstable_LowPriority,rt=a.unstable_IdlePriority,at=null,lt=null;var ot=Math.clz32?Math.clz32:function(e){return e>>>=0,0===e?32:31-(it(e)/ut|0)|0},it=Math.log,ut=Math.LN2;var st=64,ct=4194304;function ft(e){switch(e&-e){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return 4194240&e;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return 130023424&e;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 1073741824;default:return e}}function dt(e,t){var n=e.pendingLanes;if(0===n)return 0;var r=0,a=e.suspendedLanes,l=e.pingedLanes,o=268435455&n;if(0!==o){var i=o&~a;0!==i?r=ft(i):0!==(l&=o)&&(r=ft(l))}else 0!==(o=n&~a)?r=ft(o):0!==l&&(r=ft(l));if(0===r)return 0;if(0!==t&&t!==r&&0===(t&a)&&((a=r&-r)>=(l=t&-t)||16===a&&0!==(4194240&l)))return t;if(0!==(4&r)&&(r|=16&n),0!==(t=e.entangledLanes))for(e=e.entanglements,t&=r;0<t;)a=1<<(n=31-ot(t)),r|=e[n],t&=~a;return r}function pt(e,t){switch(e){case 1:case 2:case 4:return t+250;case 8:case 16:case 32:case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return t+5e3;default:return-1}}function ht(e){return 0!==(e=-1073741825&e.pendingLanes)?e:1073741824&e?1073741824:0}function mt(){var e=st;return 0===(4194240&(st<<=1))&&(st=64),e}function gt(e){for(var t=[],n=0;31>n;n++)t.push(e);return t}function vt(e,t,n){e.pendingLanes|=t,536870912!==t&&(e.suspendedLanes=0,e.pingedLanes=0),(e=e.eventTimes)[t=31-ot(t)]=n}function yt(e,t){var n=e.entangledLanes|=t;for(e=e.entanglements;n;){var r=31-ot(n),a=1<<r;a&t|e[r]&t&&(e[r]|=t),n&=~a}}var bt=0;function St(e){return 1<(e&=-e)?4<e?0!==(268435455&e)?16:536870912:4:1}var kt,wt,Ct,Et,xt,_t=!1,Pt=[],Tt=null,Ot=null,Nt=null,Rt=new Map,zt=new Map,Lt=[],At="mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset submit".split(" ");function It(e,t){switch(e){case"focusin":case"focusout":Tt=null;break;case"dragenter":case"dragleave":Ot=null;break;case"mouseover":case"mouseout":Nt=null;break;case"pointerover":case"pointerout":Rt.delete(t.pointerId);break;case"gotpointercapture":case"lostpointercapture":zt.delete(t.pointerId)}}function Dt(e,t,n,r,a,l){return null===e||e.nativeEvent!==l?(e={blockedOn:t,domEventName:n,eventSystemFlags:r,nativeEvent:l,targetContainers:[a]},null!==t&&(null!==(t=ba(t))&&wt(t)),e):(e.eventSystemFlags|=r,t=e.targetContainers,null!==a&&-1===t.indexOf(a)&&t.push(a),e)}function Ft(e){var t=ya(e.target);if(null!==t){var n=He(t);if(null!==n)if(13===(t=n.tag)){if(null!==(t=We(n)))return e.blockedOn=t,void xt(e.priority,(function(){Ct(n)}))}else if(3===t&&n.stateNode.current.memoizedState.isDehydrated)return void(e.blockedOn=3===n.tag?n.stateNode.containerInfo:null)}e.blockedOn=null}function Mt(e){if(null!==e.blockedOn)return!1;for(var t=e.targetContainers;0<t.length;){var n=Yt(e.domEventName,e.eventSystemFlags,t[0],e.nativeEvent);if(null!==n)return null!==(t=ba(n))&&wt(t),e.blockedOn=n,!1;var r=new(n=e.nativeEvent).constructor(n.type,n);Se=r,n.target.dispatchEvent(r),Se=null,t.shift()}return!0}function Ut(e,t,n){Mt(e)&&n.delete(t)}function $t(){_t=!1,null!==Tt&&Mt(Tt)&&(Tt=null),null!==Ot&&Mt(Ot)&&(Ot=null),null!==Nt&&Mt(Nt)&&(Nt=null),Rt.forEach(Ut),zt.forEach(Ut)}function jt(e,t){e.blockedOn===t&&(e.blockedOn=null,_t||(_t=!0,a.unstable_scheduleCallback(a.unstable_NormalPriority,$t)))}function Ht(e){function t(t){return jt(t,e)}if(0<Pt.length){jt(Pt[0],e);for(var n=1;n<Pt.length;n++){var r=Pt[n];r.blockedOn===e&&(r.blockedOn=null)}}for(null!==Tt&&jt(Tt,e),null!==Ot&&jt(Ot,e),null!==Nt&&jt(Nt,e),Rt.forEach(t),zt.forEach(t),n=0;n<Lt.length;n++)(r=Lt[n]).blockedOn===e&&(r.blockedOn=null);for(;0<Lt.length&&null===(n=Lt[0]).blockedOn;)Ft(n),null===n.blockedOn&&Lt.shift()}var Wt=S.ReactCurrentBatchConfig,Bt=!0;function Vt(e,t,n,r){var a=bt,l=Wt.transition;Wt.transition=null;try{bt=1,Qt(e,t,n,r)}finally{bt=a,Wt.transition=l}}function Kt(e,t,n,r){var a=bt,l=Wt.transition;Wt.transition=null;try{bt=4,Qt(e,t,n,r)}finally{bt=a,Wt.transition=l}}function Qt(e,t,n,r){if(Bt){var a=Yt(e,t,n,r);if(null===a)Br(e,t,r,qt,n),It(e,r);else if(function(e,t,n,r,a){switch(t){case"focusin":return Tt=Dt(Tt,e,t,n,r,a),!0;case"dragenter":return Ot=Dt(Ot,e,t,n,r,a),!0;case"mouseover":return Nt=Dt(Nt,e,t,n,r,a),!0;case"pointerover":var l=a.pointerId;return Rt.set(l,Dt(Rt.get(l)||null,e,t,n,r,a)),!0;case"gotpointercapture":return l=a.pointerId,zt.set(l,Dt(zt.get(l)||null,e,t,n,r,a)),!0}return!1}(a,e,t,n,r))r.stopPropagation();else if(It(e,r),4&t&&-1<At.indexOf(e)){for(;null!==a;){var l=ba(a);if(null!==l&&kt(l),null===(l=Yt(e,t,n,r))&&Br(e,t,r,qt,n),l===a)break;a=l}null!==a&&r.stopPropagation()}else Br(e,t,r,null,n)}}var qt=null;function Yt(e,t,n,r){if(qt=null,null!==(e=ya(e=ke(r))))if(null===(t=He(e)))e=null;else if(13===(n=t.tag)){if(null!==(e=We(t)))return e;e=null}else if(3===n){if(t.stateNode.current.memoizedState.isDehydrated)return 3===t.tag?t.stateNode.containerInfo:null;e=null}else t!==e&&(e=null);return qt=e,null}function Gt(e){switch(e){case"cancel":case"click":case"close":case"contextmenu":case"copy":case"cut":case"auxclick":case"dblclick":case"dragend":case"dragstart":case"drop":case"focusin":case"focusout":case"input":case"invalid":case"keydown":case"keypress":case"keyup":case"mousedown":case"mouseup":case"paste":case"pause":case"play":case"pointercancel":case"pointerdown":case"pointerup":case"ratechange":case"reset":case"resize":case"seeked":case"submit":case"touchcancel":case"touchend":case"touchstart":case"volumechange":case"change":case"selectionchange":case"textInput":case"compositionstart":case"compositionend":case"compositionupdate":case"beforeblur":case"afterblur":case"beforeinput":case"blur":case"fullscreenchange":case"focus":case"hashchange":case"popstate":case"select":case"selectstart":return 1;case"drag":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"mousemove":case"mouseout":case"mouseover":case"pointermove":case"pointerout":case"pointerover":case"scroll":case"toggle":case"touchmove":case"wheel":case"mouseenter":case"mouseleave":case"pointerenter":case"pointerleave":return 4;case"message":switch(Ze()){case Je:return 1;case et:return 4;case tt:case nt:return 16;case rt:return 536870912;default:return 16}default:return 16}}var Xt=null,Zt=null,Jt=null;function en(){if(Jt)return Jt;var e,t,n=Zt,r=n.length,a="value"in Xt?Xt.value:Xt.textContent,l=a.length;for(e=0;e<r&&n[e]===a[e];e++);var o=r-e;for(t=1;t<=o&&n[r-t]===a[l-t];t++);return Jt=a.slice(e,1<t?1-t:void 0)}function tn(e){var t=e.keyCode;return"charCode"in e?0===(e=e.charCode)&&13===t&&(e=13):e=t,10===e&&(e=13),32<=e||13===e?e:0}function nn(){return!0}function rn(){return!1}function an(e){function t(t,n,r,a,l){for(var o in this._reactName=t,this._targetInst=r,this.type=n,this.nativeEvent=a,this.target=l,this.currentTarget=null,e)e.hasOwnProperty(o)&&(t=e[o],this[o]=t?t(a):a[o]);return this.isDefaultPrevented=(null!=a.defaultPrevented?a.defaultPrevented:!1===a.returnValue)?nn:rn,this.isPropagationStopped=rn,this}return F(t.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():"unknown"!==typeof e.returnValue&&(e.returnValue=!1),this.isDefaultPrevented=nn)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():"unknown"!==typeof e.cancelBubble&&(e.cancelBubble=!0),this.isPropagationStopped=nn)},persist:function(){},isPersistent:nn}),t}var ln,on,un,sn={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(e){return e.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},cn=an(sn),fn=F({},sn,{view:0,detail:0}),dn=an(fn),pn=F({},fn,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:xn,button:0,buttons:0,relatedTarget:function(e){return void 0===e.relatedTarget?e.fromElement===e.srcElement?e.toElement:e.fromElement:e.relatedTarget},movementX:function(e){return"movementX"in e?e.movementX:(e!==un&&(un&&"mousemove"===e.type?(ln=e.screenX-un.screenX,on=e.screenY-un.screenY):on=ln=0,un=e),ln)},movementY:function(e){return"movementY"in e?e.movementY:on}}),hn=an(pn),mn=an(F({},pn,{dataTransfer:0})),gn=an(F({},fn,{relatedTarget:0})),vn=an(F({},sn,{animationName:0,elapsedTime:0,pseudoElement:0})),yn=F({},sn,{clipboardData:function(e){return"clipboardData"in e?e.clipboardData:window.clipboardData}}),bn=an(yn),Sn=an(F({},sn,{data:0})),kn={Esc:"Escape",Spacebar:" ",Left:"ArrowLeft",Up:"ArrowUp",Right:"ArrowRight",Down:"ArrowDown",Del:"Delete",Win:"OS",Menu:"ContextMenu",Apps:"ContextMenu",Scroll:"ScrollLock",MozPrintableKey:"Unidentified"},wn={8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",45:"Insert",46:"Delete",112:"F1",113:"F2",114:"F3",115:"F4",116:"F5",117:"F6",118:"F7",119:"F8",120:"F9",121:"F10",122:"F11",123:"F12",144:"NumLock",145:"ScrollLock",224:"Meta"},Cn={Alt:"altKey",Control:"ctrlKey",Meta:"metaKey",Shift:"shiftKey"};function En(e){var t=this.nativeEvent;return t.getModifierState?t.getModifierState(e):!!(e=Cn[e])&&!!t[e]}function xn(){return En}var _n=F({},fn,{key:function(e){if(e.key){var t=kn[e.key]||e.key;if("Unidentified"!==t)return t}return"keypress"===e.type?13===(e=tn(e))?"Enter":String.fromCharCode(e):"keydown"===e.type||"keyup"===e.type?wn[e.keyCode]||"Unidentified":""},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:xn,charCode:function(e){return"keypress"===e.type?tn(e):0},keyCode:function(e){return"keydown"===e.type||"keyup"===e.type?e.keyCode:0},which:function(e){return"keypress"===e.type?tn(e):"keydown"===e.type||"keyup"===e.type?e.keyCode:0}}),Pn=an(_n),Tn=an(F({},pn,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0})),On=an(F({},fn,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:xn})),Nn=an(F({},sn,{propertyName:0,elapsedTime:0,pseudoElement:0})),Rn=F({},pn,{deltaX:function(e){return"deltaX"in e?e.deltaX:"wheelDeltaX"in e?-e.wheelDeltaX:0},deltaY:function(e){return"deltaY"in e?e.deltaY:"wheelDeltaY"in e?-e.wheelDeltaY:"wheelDelta"in e?-e.wheelDelta:0},deltaZ:0,deltaMode:0}),zn=an(Rn),Ln=[9,13,27,32],An=c&&"CompositionEvent"in window,In=null;c&&"documentMode"in document&&(In=document.documentMode);var Dn=c&&"TextEvent"in window&&!In,Fn=c&&(!An||In&&8<In&&11>=In),Mn=String.fromCharCode(32),Un=!1;function $n(e,t){switch(e){case"keyup":return-1!==Ln.indexOf(t.keyCode);case"keydown":return 229!==t.keyCode;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function jn(e){return"object"===typeof(e=e.detail)&&"data"in e?e.data:null}var Hn=!1;var Wn={color:!0,date:!0,datetime:!0,"datetime-local":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function Bn(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return"input"===t?!!Wn[e.type]:"textarea"===t}function Vn(e,t,n,r){_e(r),0<(t=Kr(t,"onChange")).length&&(n=new cn("onChange","change",null,n,r),e.push({event:n,listeners:t}))}var Kn=null,Qn=null;function qn(e){Mr(e,0)}function Yn(e){if(Q(Sa(e)))return e}function Gn(e,t){if("change"===e)return t}var Xn=!1;if(c){var Zn;if(c){var Jn="oninput"in document;if(!Jn){var er=document.createElement("div");er.setAttribute("oninput","return;"),Jn="function"===typeof er.oninput}Zn=Jn}else Zn=!1;Xn=Zn&&(!document.documentMode||9<document.documentMode)}function tr(){Kn&&(Kn.detachEvent("onpropertychange",nr),Qn=Kn=null)}function nr(e){if("value"===e.propertyName&&Yn(Qn)){var t=[];Vn(t,Qn,e,ke(e)),Re(qn,t)}}function rr(e,t,n){"focusin"===e?(tr(),Qn=n,(Kn=t).attachEvent("onpropertychange",nr)):"focusout"===e&&tr()}function ar(e){if("selectionchange"===e||"keyup"===e||"keydown"===e)return Yn(Qn)}function lr(e,t){if("click"===e)return Yn(t)}function or(e,t){if("input"===e||"change"===e)return Yn(t)}var ir="function"===typeof Object.is?Object.is:function(e,t){return e===t&&(0!==e||1/e===1/t)||e!==e&&t!==t};function ur(e,t){if(ir(e,t))return!0;if("object"!==typeof e||null===e||"object"!==typeof t||null===t)return!1;var n=Object.keys(e),r=Object.keys(t);if(n.length!==r.length)return!1;for(r=0;r<n.length;r++){var a=n[r];if(!f.call(t,a)||!ir(e[a],t[a]))return!1}return!0}function sr(e){for(;e&&e.firstChild;)e=e.firstChild;return e}function cr(e,t){var n,r=sr(e);for(e=0;r;){if(3===r.nodeType){if(n=e+r.textContent.length,e<=t&&n>=t)return{node:r,offset:t-e};e=n}e:{for(;r;){if(r.nextSibling){r=r.nextSibling;break e}r=r.parentNode}r=void 0}r=sr(r)}}function fr(e,t){return!(!e||!t)&&(e===t||(!e||3!==e.nodeType)&&(t&&3===t.nodeType?fr(e,t.parentNode):"contains"in e?e.contains(t):!!e.compareDocumentPosition&&!!(16&e.compareDocumentPosition(t))))}function dr(){for(var e=window,t=q();t instanceof e.HTMLIFrameElement;){try{var n="string"===typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=q((e=t.contentWindow).document)}return t}function pr(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return t&&("input"===t&&("text"===e.type||"search"===e.type||"tel"===e.type||"url"===e.type||"password"===e.type)||"textarea"===t||"true"===e.contentEditable)}function hr(e){var t=dr(),n=e.focusedElem,r=e.selectionRange;if(t!==n&&n&&n.ownerDocument&&fr(n.ownerDocument.documentElement,n)){if(null!==r&&pr(n))if(t=r.start,void 0===(e=r.end)&&(e=t),"selectionStart"in n)n.selectionStart=t,n.selectionEnd=Math.min(e,n.value.length);else if((e=(t=n.ownerDocument||document)&&t.defaultView||window).getSelection){e=e.getSelection();var a=n.textContent.length,l=Math.min(r.start,a);r=void 0===r.end?l:Math.min(r.end,a),!e.extend&&l>r&&(a=r,r=l,l=a),a=cr(n,l);var o=cr(n,r);a&&o&&(1!==e.rangeCount||e.anchorNode!==a.node||e.anchorOffset!==a.offset||e.focusNode!==o.node||e.focusOffset!==o.offset)&&((t=t.createRange()).setStart(a.node,a.offset),e.removeAllRanges(),l>r?(e.addRange(t),e.extend(o.node,o.offset)):(t.setEnd(o.node,o.offset),e.addRange(t)))}for(t=[],e=n;e=e.parentNode;)1===e.nodeType&&t.push({element:e,left:e.scrollLeft,top:e.scrollTop});for("function"===typeof n.focus&&n.focus(),n=0;n<t.length;n++)(e=t[n]).element.scrollLeft=e.left,e.element.scrollTop=e.top}}var mr=c&&"documentMode"in document&&11>=document.documentMode,gr=null,vr=null,yr=null,br=!1;function Sr(e,t,n){var r=n.window===n?n.document:9===n.nodeType?n:n.ownerDocument;br||null==gr||gr!==q(r)||("selectionStart"in(r=gr)&&pr(r)?r={start:r.selectionStart,end:r.selectionEnd}:r={anchorNode:(r=(r.ownerDocument&&r.ownerDocument.defaultView||window).getSelection()).anchorNode,anchorOffset:r.anchorOffset,focusNode:r.focusNode,focusOffset:r.focusOffset},yr&&ur(yr,r)||(yr=r,0<(r=Kr(vr,"onSelect")).length&&(t=new cn("onSelect","select",null,t,n),e.push({event:t,listeners:r}),t.target=gr)))}function kr(e,t){var n={};return n[e.toLowerCase()]=t.toLowerCase(),n["Webkit"+e]="webkit"+t,n["Moz"+e]="moz"+t,n}var wr={animationend:kr("Animation","AnimationEnd"),animationiteration:kr("Animation","AnimationIteration"),animationstart:kr("Animation","AnimationStart"),transitionend:kr("Transition","TransitionEnd")},Cr={},Er={};function xr(e){if(Cr[e])return Cr[e];if(!wr[e])return e;var t,n=wr[e];for(t in n)if(n.hasOwnProperty(t)&&t in Er)return Cr[e]=n[t];return e}c&&(Er=document.createElement("div").style,"AnimationEvent"in window||(delete wr.animationend.animation,delete wr.animationiteration.animation,delete wr.animationstart.animation),"TransitionEvent"in window||delete wr.transitionend.transition);var _r=xr("animationend"),Pr=xr("animationiteration"),Tr=xr("animationstart"),Or=xr("transitionend"),Nr=new Map,Rr="abort auxClick cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel".split(" ");function zr(e,t){Nr.set(e,t),u(t,[e])}for(var Lr=0;Lr<Rr.length;Lr++){var Ar=Rr[Lr];zr(Ar.toLowerCase(),"on"+(Ar[0].toUpperCase()+Ar.slice(1)))}zr(_r,"onAnimationEnd"),zr(Pr,"onAnimationIteration"),zr(Tr,"onAnimationStart"),zr("dblclick","onDoubleClick"),zr("focusin","onFocus"),zr("focusout","onBlur"),zr(Or,"onTransitionEnd"),s("onMouseEnter",["mouseout","mouseover"]),s("onMouseLeave",["mouseout","mouseover"]),s("onPointerEnter",["pointerout","pointerover"]),s("onPointerLeave",["pointerout","pointerover"]),u("onChange","change click focusin focusout input keydown keyup selectionchange".split(" ")),u("onSelect","focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange".split(" ")),u("onBeforeInput",["compositionend","keypress","textInput","paste"]),u("onCompositionEnd","compositionend focusout keydown keypress keyup mousedown".split(" ")),u("onCompositionStart","compositionstart focusout keydown keypress keyup mousedown".split(" ")),u("onCompositionUpdate","compositionupdate focusout keydown keypress keyup mousedown".split(" "));var Ir="abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting".split(" "),Dr=new Set("cancel close invalid load scroll toggle".split(" ").concat(Ir));function Fr(e,t,n){var r=e.type||"unknown-event";e.currentTarget=n,function(e,t,n,r,a,o,i,u,s){if(je.apply(this,arguments),De){if(!De)throw Error(l(198));var c=Fe;De=!1,Fe=null,Me||(Me=!0,Ue=c)}}(r,t,void 0,e),e.currentTarget=null}function Mr(e,t){t=0!==(4&t);for(var n=0;n<e.length;n++){var r=e[n],a=r.event;r=r.listeners;e:{var l=void 0;if(t)for(var o=r.length-1;0<=o;o--){var i=r[o],u=i.instance,s=i.currentTarget;if(i=i.listener,u!==l&&a.isPropagationStopped())break e;Fr(a,i,s),l=u}else for(o=0;o<r.length;o++){if(u=(i=r[o]).instance,s=i.currentTarget,i=i.listener,u!==l&&a.isPropagationStopped())break e;Fr(a,i,s),l=u}}}if(Me)throw e=Ue,Me=!1,Ue=null,e}function Ur(e,t){var n=t[ma];void 0===n&&(n=t[ma]=new Set);var r=e+"__bubble";n.has(r)||(Wr(t,e,2,!1),n.add(r))}function $r(e,t,n){var r=0;t&&(r|=4),Wr(n,e,r,t)}var jr="_reactListening"+Math.random().toString(36).slice(2);function Hr(e){if(!e[jr]){e[jr]=!0,o.forEach((function(t){"selectionchange"!==t&&(Dr.has(t)||$r(t,!1,e),$r(t,!0,e))}));var t=9===e.nodeType?e:e.ownerDocument;null===t||t[jr]||(t[jr]=!0,$r("selectionchange",!1,t))}}function Wr(e,t,n,r){switch(Gt(t)){case 1:var a=Vt;break;case 4:a=Kt;break;default:a=Qt}n=a.bind(null,t,n,e),a=void 0,!Le||"touchstart"!==t&&"touchmove"!==t&&"wheel"!==t||(a=!0),r?void 0!==a?e.addEventListener(t,n,{capture:!0,passive:a}):e.addEventListener(t,n,!0):void 0!==a?e.addEventListener(t,n,{passive:a}):e.addEventListener(t,n,!1)}function Br(e,t,n,r,a){var l=r;if(0===(1&t)&&0===(2&t)&&null!==r)e:for(;;){if(null===r)return;var o=r.tag;if(3===o||4===o){var i=r.stateNode.containerInfo;if(i===a||8===i.nodeType&&i.parentNode===a)break;if(4===o)for(o=r.return;null!==o;){var u=o.tag;if((3===u||4===u)&&((u=o.stateNode.containerInfo)===a||8===u.nodeType&&u.parentNode===a))return;o=o.return}for(;null!==i;){if(null===(o=ya(i)))return;if(5===(u=o.tag)||6===u){r=l=o;continue e}i=i.parentNode}}r=r.return}Re((function(){var r=l,a=ke(n),o=[];e:{var i=Nr.get(e);if(void 0!==i){var u=cn,s=e;switch(e){case"keypress":if(0===tn(n))break e;case"keydown":case"keyup":u=Pn;break;case"focusin":s="focus",u=gn;break;case"focusout":s="blur",u=gn;break;case"beforeblur":case"afterblur":u=gn;break;case"click":if(2===n.button)break e;case"auxclick":case"dblclick":case"mousedown":case"mousemove":case"mouseup":case"mouseout":case"mouseover":case"contextmenu":u=hn;break;case"drag":case"dragend":case"dragenter":case"dragexit":case"dragleave":case"dragover":case"dragstart":case"drop":u=mn;break;case"touchcancel":case"touchend":case"touchmove":case"touchstart":u=On;break;case _r:case Pr:case Tr:u=vn;break;case Or:u=Nn;break;case"scroll":u=dn;break;case"wheel":u=zn;break;case"copy":case"cut":case"paste":u=bn;break;case"gotpointercapture":case"lostpointercapture":case"pointercancel":case"pointerdown":case"pointermove":case"pointerout":case"pointerover":case"pointerup":u=Tn}var c=0!==(4&t),f=!c&&"scroll"===e,d=c?null!==i?i+"Capture":null:i;c=[];for(var p,h=r;null!==h;){var m=(p=h).stateNode;if(5===p.tag&&null!==m&&(p=m,null!==d&&(null!=(m=ze(h,d))&&c.push(Vr(h,m,p)))),f)break;h=h.return}0<c.length&&(i=new u(i,s,null,n,a),o.push({event:i,listeners:c}))}}if(0===(7&t)){if(u="mouseout"===e||"pointerout"===e,(!(i="mouseover"===e||"pointerover"===e)||n===Se||!(s=n.relatedTarget||n.fromElement)||!ya(s)&&!s[ha])&&(u||i)&&(i=a.window===a?a:(i=a.ownerDocument)?i.defaultView||i.parentWindow:window,u?(u=r,null!==(s=(s=n.relatedTarget||n.toElement)?ya(s):null)&&(s!==(f=He(s))||5!==s.tag&&6!==s.tag)&&(s=null)):(u=null,s=r),u!==s)){if(c=hn,m="onMouseLeave",d="onMouseEnter",h="mouse","pointerout"!==e&&"pointerover"!==e||(c=Tn,m="onPointerLeave",d="onPointerEnter",h="pointer"),f=null==u?i:Sa(u),p=null==s?i:Sa(s),(i=new c(m,h+"leave",u,n,a)).target=f,i.relatedTarget=p,m=null,ya(a)===r&&((c=new c(d,h+"enter",s,n,a)).target=p,c.relatedTarget=f,m=c),f=m,u&&s)e:{for(d=s,h=0,p=c=u;p;p=Qr(p))h++;for(p=0,m=d;m;m=Qr(m))p++;for(;0<h-p;)c=Qr(c),h--;for(;0<p-h;)d=Qr(d),p--;for(;h--;){if(c===d||null!==d&&c===d.alternate)break e;c=Qr(c),d=Qr(d)}c=null}else c=null;null!==u&&qr(o,i,u,c,!1),null!==s&&null!==f&&qr(o,f,s,c,!0)}if("select"===(u=(i=r?Sa(r):window).nodeName&&i.nodeName.toLowerCase())||"input"===u&&"file"===i.type)var g=Gn;else if(Bn(i))if(Xn)g=or;else{g=ar;var v=rr}else(u=i.nodeName)&&"input"===u.toLowerCase()&&("checkbox"===i.type||"radio"===i.type)&&(g=lr);switch(g&&(g=g(e,r))?Vn(o,g,n,a):(v&&v(e,i,r),"focusout"===e&&(v=i._wrapperState)&&v.controlled&&"number"===i.type&&ee(i,"number",i.value)),v=r?Sa(r):window,e){case"focusin":(Bn(v)||"true"===v.contentEditable)&&(gr=v,vr=r,yr=null);break;case"focusout":yr=vr=gr=null;break;case"mousedown":br=!0;break;case"contextmenu":case"mouseup":case"dragend":br=!1,Sr(o,n,a);break;case"selectionchange":if(mr)break;case"keydown":case"keyup":Sr(o,n,a)}var y;if(An)e:{switch(e){case"compositionstart":var b="onCompositionStart";break e;case"compositionend":b="onCompositionEnd";break e;case"compositionupdate":b="onCompositionUpdate";break e}b=void 0}else Hn?$n(e,n)&&(b="onCompositionEnd"):"keydown"===e&&229===n.keyCode&&(b="onCompositionStart");b&&(Fn&&"ko"!==n.locale&&(Hn||"onCompositionStart"!==b?"onCompositionEnd"===b&&Hn&&(y=en()):(Zt="value"in(Xt=a)?Xt.value:Xt.textContent,Hn=!0)),0<(v=Kr(r,b)).length&&(b=new Sn(b,e,null,n,a),o.push({event:b,listeners:v}),y?b.data=y:null!==(y=jn(n))&&(b.data=y))),(y=Dn?function(e,t){switch(e){case"compositionend":return jn(t);case"keypress":return 32!==t.which?null:(Un=!0,Mn);case"textInput":return(e=t.data)===Mn&&Un?null:e;default:return null}}(e,n):function(e,t){if(Hn)return"compositionend"===e||!An&&$n(e,t)?(e=en(),Jt=Zt=Xt=null,Hn=!1,e):null;switch(e){case"paste":default:return null;case"keypress":if(!(t.ctrlKey||t.altKey||t.metaKey)||t.ctrlKey&&t.altKey){if(t.char&&1<t.char.length)return t.char;if(t.which)return String.fromCharCode(t.which)}return null;case"compositionend":return Fn&&"ko"!==t.locale?null:t.data}}(e,n))&&(0<(r=Kr(r,"onBeforeInput")).length&&(a=new Sn("onBeforeInput","beforeinput",null,n,a),o.push({event:a,listeners:r}),a.data=y))}Mr(o,t)}))}function Vr(e,t,n){return{instance:e,listener:t,currentTarget:n}}function Kr(e,t){for(var n=t+"Capture",r=[];null!==e;){var a=e,l=a.stateNode;5===a.tag&&null!==l&&(a=l,null!=(l=ze(e,n))&&r.unshift(Vr(e,l,a)),null!=(l=ze(e,t))&&r.push(Vr(e,l,a))),e=e.return}return r}function Qr(e){if(null===e)return null;do{e=e.return}while(e&&5!==e.tag);return e||null}function qr(e,t,n,r,a){for(var l=t._reactName,o=[];null!==n&&n!==r;){var i=n,u=i.alternate,s=i.stateNode;if(null!==u&&u===r)break;5===i.tag&&null!==s&&(i=s,a?null!=(u=ze(n,l))&&o.unshift(Vr(n,u,i)):a||null!=(u=ze(n,l))&&o.push(Vr(n,u,i))),n=n.return}0!==o.length&&e.push({event:t,listeners:o})}var Yr=/\r\n?/g,Gr=/\u0000|\uFFFD/g;function Xr(e){return("string"===typeof e?e:""+e).replace(Yr,"\n").replace(Gr,"")}function Zr(e,t,n){if(t=Xr(t),Xr(e)!==t&&n)throw Error(l(425))}function Jr(){}var ea=null,ta=null;function na(e,t){return"textarea"===e||"noscript"===e||"string"===typeof t.children||"number"===typeof t.children||"object"===typeof t.dangerouslySetInnerHTML&&null!==t.dangerouslySetInnerHTML&&null!=t.dangerouslySetInnerHTML.__html}var ra="function"===typeof setTimeout?setTimeout:void 0,aa="function"===typeof clearTimeout?clearTimeout:void 0,la="function"===typeof Promise?Promise:void 0,oa="function"===typeof queueMicrotask?queueMicrotask:"undefined"!==typeof la?function(e){return la.resolve(null).then(e).catch(ia)}:ra;function ia(e){setTimeout((function(){throw e}))}function ua(e,t){var n=t,r=0;do{var a=n.nextSibling;if(e.removeChild(n),a&&8===a.nodeType)if("/$"===(n=a.data)){if(0===r)return e.removeChild(a),void Ht(t);r--}else"$"!==n&&"$?"!==n&&"$!"!==n||r++;n=a}while(n);Ht(t)}function sa(e){for(;null!=e;e=e.nextSibling){var t=e.nodeType;if(1===t||3===t)break;if(8===t){if("$"===(t=e.data)||"$!"===t||"$?"===t)break;if("/$"===t)return null}}return e}function ca(e){e=e.previousSibling;for(var t=0;e;){if(8===e.nodeType){var n=e.data;if("$"===n||"$!"===n||"$?"===n){if(0===t)return e;t--}else"/$"===n&&t++}e=e.previousSibling}return null}var fa=Math.random().toString(36).slice(2),da="__reactFiber$"+fa,pa="__reactProps$"+fa,ha="__reactContainer$"+fa,ma="__reactEvents$"+fa,ga="__reactListeners$"+fa,va="__reactHandles$"+fa;function ya(e){var t=e[da];if(t)return t;for(var n=e.parentNode;n;){if(t=n[ha]||n[da]){if(n=t.alternate,null!==t.child||null!==n&&null!==n.child)for(e=ca(e);null!==e;){if(n=e[da])return n;e=ca(e)}return t}n=(e=n).parentNode}return null}function ba(e){return!(e=e[da]||e[ha])||5!==e.tag&&6!==e.tag&&13!==e.tag&&3!==e.tag?null:e}function Sa(e){if(5===e.tag||6===e.tag)return e.stateNode;throw Error(l(33))}function ka(e){return e[pa]||null}var wa=[],Ca=-1;function Ea(e){return{current:e}}function xa(e){0>Ca||(e.current=wa[Ca],wa[Ca]=null,Ca--)}function _a(e,t){Ca++,wa[Ca]=e.current,e.current=t}var Pa={},Ta=Ea(Pa),Oa=Ea(!1),Na=Pa;function Ra(e,t){var n=e.type.contextTypes;if(!n)return Pa;var r=e.stateNode;if(r&&r.__reactInternalMemoizedUnmaskedChildContext===t)return r.__reactInternalMemoizedMaskedChildContext;var a,l={};for(a in n)l[a]=t[a];return r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=t,e.__reactInternalMemoizedMaskedChildContext=l),l}function za(e){return null!==(e=e.childContextTypes)&&void 0!==e}function La(){xa(Oa),xa(Ta)}function Aa(e,t,n){if(Ta.current!==Pa)throw Error(l(168));_a(Ta,t),_a(Oa,n)}function Ia(e,t,n){var r=e.stateNode;if(t=t.childContextTypes,"function"!==typeof r.getChildContext)return n;for(var a in r=r.getChildContext())if(!(a in t))throw Error(l(108,W(e)||"Unknown",a));return F({},n,r)}function Da(e){return e=(e=e.stateNode)&&e.__reactInternalMemoizedMergedChildContext||Pa,Na=Ta.current,_a(Ta,e),_a(Oa,Oa.current),!0}function Fa(e,t,n){var r=e.stateNode;if(!r)throw Error(l(169));n?(e=Ia(e,t,Na),r.__reactInternalMemoizedMergedChildContext=e,xa(Oa),xa(Ta),_a(Ta,e)):xa(Oa),_a(Oa,n)}var Ma=null,Ua=!1,$a=!1;function ja(e){null===Ma?Ma=[e]:Ma.push(e)}function Ha(){if(!$a&&null!==Ma){$a=!0;var e=0,t=bt;try{var n=Ma;for(bt=1;e<n.length;e++){var r=n[e];do{r=r(!0)}while(null!==r)}Ma=null,Ua=!1}catch(a){throw null!==Ma&&(Ma=Ma.slice(e+1)),Qe(Je,Ha),a}finally{bt=t,$a=!1}}return null}var Wa=[],Ba=0,Va=null,Ka=0,Qa=[],qa=0,Ya=null,Ga=1,Xa="";function Za(e,t){Wa[Ba++]=Ka,Wa[Ba++]=Va,Va=e,Ka=t}function Ja(e,t,n){Qa[qa++]=Ga,Qa[qa++]=Xa,Qa[qa++]=Ya,Ya=e;var r=Ga;e=Xa;var a=32-ot(r)-1;r&=~(1<<a),n+=1;var l=32-ot(t)+a;if(30<l){var o=a-a%5;l=(r&(1<<o)-1).toString(32),r>>=o,a-=o,Ga=1<<32-ot(t)+a|n<<a|r,Xa=l+e}else Ga=1<<l|n<<a|r,Xa=e}function el(e){null!==e.return&&(Za(e,1),Ja(e,1,0))}function tl(e){for(;e===Va;)Va=Wa[--Ba],Wa[Ba]=null,Ka=Wa[--Ba],Wa[Ba]=null;for(;e===Ya;)Ya=Qa[--qa],Qa[qa]=null,Xa=Qa[--qa],Qa[qa]=null,Ga=Qa[--qa],Qa[qa]=null}var nl=null,rl=null,al=!1,ll=null;function ol(e,t){var n=zs(5,null,null,0);n.elementType="DELETED",n.stateNode=t,n.return=e,null===(t=e.deletions)?(e.deletions=[n],e.flags|=16):t.push(n)}function il(e,t){switch(e.tag){case 5:var n=e.type;return null!==(t=1!==t.nodeType||n.toLowerCase()!==t.nodeName.toLowerCase()?null:t)&&(e.stateNode=t,nl=e,rl=sa(t.firstChild),!0);case 6:return null!==(t=""===e.pendingProps||3!==t.nodeType?null:t)&&(e.stateNode=t,nl=e,rl=null,!0);case 13:return null!==(t=8!==t.nodeType?null:t)&&(n=null!==Ya?{id:Ga,overflow:Xa}:null,e.memoizedState={dehydrated:t,treeContext:n,retryLane:1073741824},(n=zs(18,null,null,0)).stateNode=t,n.return=e,e.child=n,nl=e,rl=null,!0);default:return!1}}function ul(e){return 0!==(1&e.mode)&&0===(128&e.flags)}function sl(e){if(al){var t=rl;if(t){var n=t;if(!il(e,t)){if(ul(e))throw Error(l(418));t=sa(n.nextSibling);var r=nl;t&&il(e,t)?ol(r,n):(e.flags=-4097&e.flags|2,al=!1,nl=e)}}else{if(ul(e))throw Error(l(418));e.flags=-4097&e.flags|2,al=!1,nl=e}}}function cl(e){for(e=e.return;null!==e&&5!==e.tag&&3!==e.tag&&13!==e.tag;)e=e.return;nl=e}function fl(e){if(e!==nl)return!1;if(!al)return cl(e),al=!0,!1;var t;if((t=3!==e.tag)&&!(t=5!==e.tag)&&(t="head"!==(t=e.type)&&"body"!==t&&!na(e.type,e.memoizedProps)),t&&(t=rl)){if(ul(e))throw dl(),Error(l(418));for(;t;)ol(e,t),t=sa(t.nextSibling)}if(cl(e),13===e.tag){if(!(e=null!==(e=e.memoizedState)?e.dehydrated:null))throw Error(l(317));e:{for(e=e.nextSibling,t=0;e;){if(8===e.nodeType){var n=e.data;if("/$"===n){if(0===t){rl=sa(e.nextSibling);break e}t--}else"$"!==n&&"$!"!==n&&"$?"!==n||t++}e=e.nextSibling}rl=null}}else rl=nl?sa(e.stateNode.nextSibling):null;return!0}function dl(){for(var e=rl;e;)e=sa(e.nextSibling)}function pl(){rl=nl=null,al=!1}function hl(e){null===ll?ll=[e]:ll.push(e)}var ml=S.ReactCurrentBatchConfig;function gl(e,t){if(e&&e.defaultProps){for(var n in t=F({},t),e=e.defaultProps)void 0===t[n]&&(t[n]=e[n]);return t}return t}var vl=Ea(null),yl=null,bl=null,Sl=null;function kl(){Sl=bl=yl=null}function wl(e){var t=vl.current;xa(vl),e._currentValue=t}function Cl(e,t,n){for(;null!==e;){var r=e.alternate;if((e.childLanes&t)!==t?(e.childLanes|=t,null!==r&&(r.childLanes|=t)):null!==r&&(r.childLanes&t)!==t&&(r.childLanes|=t),e===n)break;e=e.return}}function El(e,t){yl=e,Sl=bl=null,null!==(e=e.dependencies)&&null!==e.firstContext&&(0!==(e.lanes&t)&&(Si=!0),e.firstContext=null)}function xl(e){var t=e._currentValue;if(Sl!==e)if(e={context:e,memoizedValue:t,next:null},null===bl){if(null===yl)throw Error(l(308));bl=e,yl.dependencies={lanes:0,firstContext:e}}else bl=bl.next=e;return t}var _l=null;function Pl(e){null===_l?_l=[e]:_l.push(e)}function Tl(e,t,n,r){var a=t.interleaved;return null===a?(n.next=n,Pl(t)):(n.next=a.next,a.next=n),t.interleaved=n,Ol(e,r)}function Ol(e,t){e.lanes|=t;var n=e.alternate;for(null!==n&&(n.lanes|=t),n=e,e=e.return;null!==e;)e.childLanes|=t,null!==(n=e.alternate)&&(n.childLanes|=t),n=e,e=e.return;return 3===n.tag?n.stateNode:null}var Nl=!1;function Rl(e){e.updateQueue={baseState:e.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,interleaved:null,lanes:0},effects:null}}function zl(e,t){e=e.updateQueue,t.updateQueue===e&&(t.updateQueue={baseState:e.baseState,firstBaseUpdate:e.firstBaseUpdate,lastBaseUpdate:e.lastBaseUpdate,shared:e.shared,effects:e.effects})}function Ll(e,t){return{eventTime:e,lane:t,tag:0,payload:null,callback:null,next:null}}function Al(e,t,n){var r=e.updateQueue;if(null===r)return null;if(r=r.shared,0!==(2&Ou)){var a=r.pending;return null===a?t.next=t:(t.next=a.next,a.next=t),r.pending=t,Ol(e,n)}return null===(a=r.interleaved)?(t.next=t,Pl(r)):(t.next=a.next,a.next=t),r.interleaved=t,Ol(e,n)}function Il(e,t,n){if(null!==(t=t.updateQueue)&&(t=t.shared,0!==(4194240&n))){var r=t.lanes;n|=r&=e.pendingLanes,t.lanes=n,yt(e,n)}}function Dl(e,t){var n=e.updateQueue,r=e.alternate;if(null!==r&&n===(r=r.updateQueue)){var a=null,l=null;if(null!==(n=n.firstBaseUpdate)){do{var o={eventTime:n.eventTime,lane:n.lane,tag:n.tag,payload:n.payload,callback:n.callback,next:null};null===l?a=l=o:l=l.next=o,n=n.next}while(null!==n);null===l?a=l=t:l=l.next=t}else a=l=t;return n={baseState:r.baseState,firstBaseUpdate:a,lastBaseUpdate:l,shared:r.shared,effects:r.effects},void(e.updateQueue=n)}null===(e=n.lastBaseUpdate)?n.firstBaseUpdate=t:e.next=t,n.lastBaseUpdate=t}function Fl(e,t,n,r){var a=e.updateQueue;Nl=!1;var l=a.firstBaseUpdate,o=a.lastBaseUpdate,i=a.shared.pending;if(null!==i){a.shared.pending=null;var u=i,s=u.next;u.next=null,null===o?l=s:o.next=s,o=u;var c=e.alternate;null!==c&&((i=(c=c.updateQueue).lastBaseUpdate)!==o&&(null===i?c.firstBaseUpdate=s:i.next=s,c.lastBaseUpdate=u))}if(null!==l){var f=a.baseState;for(o=0,c=s=u=null,i=l;;){var d=i.lane,p=i.eventTime;if((r&d)===d){null!==c&&(c=c.next={eventTime:p,lane:0,tag:i.tag,payload:i.payload,callback:i.callback,next:null});e:{var h=e,m=i;switch(d=t,p=n,m.tag){case 1:if("function"===typeof(h=m.payload)){f=h.call(p,f,d);break e}f=h;break e;case 3:h.flags=-65537&h.flags|128;case 0:if(null===(d="function"===typeof(h=m.payload)?h.call(p,f,d):h)||void 0===d)break e;f=F({},f,d);break e;case 2:Nl=!0}}null!==i.callback&&0!==i.lane&&(e.flags|=64,null===(d=a.effects)?a.effects=[i]:d.push(i))}else p={eventTime:p,lane:d,tag:i.tag,payload:i.payload,callback:i.callback,next:null},null===c?(s=c=p,u=f):c=c.next=p,o|=d;if(null===(i=i.next)){if(null===(i=a.shared.pending))break;i=(d=i).next,d.next=null,a.lastBaseUpdate=d,a.shared.pending=null}}if(null===c&&(u=f),a.baseState=u,a.firstBaseUpdate=s,a.lastBaseUpdate=c,null!==(t=a.shared.interleaved)){a=t;do{o|=a.lane,a=a.next}while(a!==t)}else null===l&&(a.shared.lanes=0);Fu|=o,e.lanes=o,e.memoizedState=f}}function Ml(e,t,n){if(e=t.effects,t.effects=null,null!==e)for(t=0;t<e.length;t++){var r=e[t],a=r.callback;if(null!==a){if(r.callback=null,r=n,"function"!==typeof a)throw Error(l(191,a));a.call(r)}}}var Ul=(new r.Component).refs;function $l(e,t,n,r){n=null===(n=n(r,t=e.memoizedState))||void 0===n?t:F({},t,n),e.memoizedState=n,0===e.lanes&&(e.updateQueue.baseState=n)}var jl={isMounted:function(e){return!!(e=e._reactInternals)&&He(e)===e},enqueueSetState:function(e,t,n){e=e._reactInternals;var r=ts(),a=ns(e),l=Ll(r,a);l.payload=t,void 0!==n&&null!==n&&(l.callback=n),null!==(t=Al(e,l,a))&&(rs(t,e,a,r),Il(t,e,a))},enqueueReplaceState:function(e,t,n){e=e._reactInternals;var r=ts(),a=ns(e),l=Ll(r,a);l.tag=1,l.payload=t,void 0!==n&&null!==n&&(l.callback=n),null!==(t=Al(e,l,a))&&(rs(t,e,a,r),Il(t,e,a))},enqueueForceUpdate:function(e,t){e=e._reactInternals;var n=ts(),r=ns(e),a=Ll(n,r);a.tag=2,void 0!==t&&null!==t&&(a.callback=t),null!==(t=Al(e,a,r))&&(rs(t,e,r,n),Il(t,e,r))}};function Hl(e,t,n,r,a,l,o){return"function"===typeof(e=e.stateNode).shouldComponentUpdate?e.shouldComponentUpdate(r,l,o):!t.prototype||!t.prototype.isPureReactComponent||(!ur(n,r)||!ur(a,l))}function Wl(e,t,n){var r=!1,a=Pa,l=t.contextType;return"object"===typeof l&&null!==l?l=xl(l):(a=za(t)?Na:Ta.current,l=(r=null!==(r=t.contextTypes)&&void 0!==r)?Ra(e,a):Pa),t=new t(n,l),e.memoizedState=null!==t.state&&void 0!==t.state?t.state:null,t.updater=jl,e.stateNode=t,t._reactInternals=e,r&&((e=e.stateNode).__reactInternalMemoizedUnmaskedChildContext=a,e.__reactInternalMemoizedMaskedChildContext=l),t}function Bl(e,t,n,r){e=t.state,"function"===typeof t.componentWillReceiveProps&&t.componentWillReceiveProps(n,r),"function"===typeof t.UNSAFE_componentWillReceiveProps&&t.UNSAFE_componentWillReceiveProps(n,r),t.state!==e&&jl.enqueueReplaceState(t,t.state,null)}function Vl(e,t,n,r){var a=e.stateNode;a.props=n,a.state=e.memoizedState,a.refs=Ul,Rl(e);var l=t.contextType;"object"===typeof l&&null!==l?a.context=xl(l):(l=za(t)?Na:Ta.current,a.context=Ra(e,l)),a.state=e.memoizedState,"function"===typeof(l=t.getDerivedStateFromProps)&&($l(e,t,l,n),a.state=e.memoizedState),"function"===typeof t.getDerivedStateFromProps||"function"===typeof a.getSnapshotBeforeUpdate||"function"!==typeof a.UNSAFE_componentWillMount&&"function"!==typeof a.componentWillMount||(t=a.state,"function"===typeof a.componentWillMount&&a.componentWillMount(),"function"===typeof a.UNSAFE_componentWillMount&&a.UNSAFE_componentWillMount(),t!==a.state&&jl.enqueueReplaceState(a,a.state,null),Fl(e,n,a,r),a.state=e.memoizedState),"function"===typeof a.componentDidMount&&(e.flags|=4194308)}function Kl(e,t,n){if(null!==(e=n.ref)&&"function"!==typeof e&&"object"!==typeof e){if(n._owner){if(n=n._owner){if(1!==n.tag)throw Error(l(309));var r=n.stateNode}if(!r)throw Error(l(147,e));var a=r,o=""+e;return null!==t&&null!==t.ref&&"function"===typeof t.ref&&t.ref._stringRef===o?t.ref:(t=function(e){var t=a.refs;t===Ul&&(t=a.refs={}),null===e?delete t[o]:t[o]=e},t._stringRef=o,t)}if("string"!==typeof e)throw Error(l(284));if(!n._owner)throw Error(l(290,e))}return e}function Ql(e,t){throw e=Object.prototype.toString.call(t),Error(l(31,"[object Object]"===e?"object with keys {"+Object.keys(t).join(", ")+"}":e))}function ql(e){return(0,e._init)(e._payload)}function Yl(e){function t(t,n){if(e){var r=t.deletions;null===r?(t.deletions=[n],t.flags|=16):r.push(n)}}function n(n,r){if(!e)return null;for(;null!==r;)t(n,r),r=r.sibling;return null}function r(e,t){for(e=new Map;null!==t;)null!==t.key?e.set(t.key,t):e.set(t.index,t),t=t.sibling;return e}function a(e,t){return(e=As(e,t)).index=0,e.sibling=null,e}function o(t,n,r){return t.index=r,e?null!==(r=t.alternate)?(r=r.index)<n?(t.flags|=2,n):r:(t.flags|=2,n):(t.flags|=1048576,n)}function i(t){return e&&null===t.alternate&&(t.flags|=2),t}function u(e,t,n,r){return null===t||6!==t.tag?((t=Ms(n,e.mode,r)).return=e,t):((t=a(t,n)).return=e,t)}function s(e,t,n,r){var l=n.type;return l===C?f(e,t,n.props.children,r,n.key):null!==t&&(t.elementType===l||"object"===typeof l&&null!==l&&l.$$typeof===z&&ql(l)===t.type)?((r=a(t,n.props)).ref=Kl(e,t,n),r.return=e,r):((r=Is(n.type,n.key,n.props,null,e.mode,r)).ref=Kl(e,t,n),r.return=e,r)}function c(e,t,n,r){return null===t||4!==t.tag||t.stateNode.containerInfo!==n.containerInfo||t.stateNode.implementation!==n.implementation?((t=Us(n,e.mode,r)).return=e,t):((t=a(t,n.children||[])).return=e,t)}function f(e,t,n,r,l){return null===t||7!==t.tag?((t=Ds(n,e.mode,r,l)).return=e,t):((t=a(t,n)).return=e,t)}function d(e,t,n){if("string"===typeof t&&""!==t||"number"===typeof t)return(t=Ms(""+t,e.mode,n)).return=e,t;if("object"===typeof t&&null!==t){switch(t.$$typeof){case k:return(n=Is(t.type,t.key,t.props,null,e.mode,n)).ref=Kl(e,null,t),n.return=e,n;case w:return(t=Us(t,e.mode,n)).return=e,t;case z:return d(e,(0,t._init)(t._payload),n)}if(te(t)||I(t))return(t=Ds(t,e.mode,n,null)).return=e,t;Ql(e,t)}return null}function p(e,t,n,r){var a=null!==t?t.key:null;if("string"===typeof n&&""!==n||"number"===typeof n)return null!==a?null:u(e,t,""+n,r);if("object"===typeof n&&null!==n){switch(n.$$typeof){case k:return n.key===a?s(e,t,n,r):null;case w:return n.key===a?c(e,t,n,r):null;case z:return p(e,t,(a=n._init)(n._payload),r)}if(te(n)||I(n))return null!==a?null:f(e,t,n,r,null);Ql(e,n)}return null}function h(e,t,n,r,a){if("string"===typeof r&&""!==r||"number"===typeof r)return u(t,e=e.get(n)||null,""+r,a);if("object"===typeof r&&null!==r){switch(r.$$typeof){case k:return s(t,e=e.get(null===r.key?n:r.key)||null,r,a);case w:return c(t,e=e.get(null===r.key?n:r.key)||null,r,a);case z:return h(e,t,n,(0,r._init)(r._payload),a)}if(te(r)||I(r))return f(t,e=e.get(n)||null,r,a,null);Ql(t,r)}return null}function m(a,l,i,u){for(var s=null,c=null,f=l,m=l=0,g=null;null!==f&&m<i.length;m++){f.index>m?(g=f,f=null):g=f.sibling;var v=p(a,f,i[m],u);if(null===v){null===f&&(f=g);break}e&&f&&null===v.alternate&&t(a,f),l=o(v,l,m),null===c?s=v:c.sibling=v,c=v,f=g}if(m===i.length)return n(a,f),al&&Za(a,m),s;if(null===f){for(;m<i.length;m++)null!==(f=d(a,i[m],u))&&(l=o(f,l,m),null===c?s=f:c.sibling=f,c=f);return al&&Za(a,m),s}for(f=r(a,f);m<i.length;m++)null!==(g=h(f,a,m,i[m],u))&&(e&&null!==g.alternate&&f.delete(null===g.key?m:g.key),l=o(g,l,m),null===c?s=g:c.sibling=g,c=g);return e&&f.forEach((function(e){return t(a,e)})),al&&Za(a,m),s}function g(a,i,u,s){var c=I(u);if("function"!==typeof c)throw Error(l(150));if(null==(u=c.call(u)))throw Error(l(151));for(var f=c=null,m=i,g=i=0,v=null,y=u.next();null!==m&&!y.done;g++,y=u.next()){m.index>g?(v=m,m=null):v=m.sibling;var b=p(a,m,y.value,s);if(null===b){null===m&&(m=v);break}e&&m&&null===b.alternate&&t(a,m),i=o(b,i,g),null===f?c=b:f.sibling=b,f=b,m=v}if(y.done)return n(a,m),al&&Za(a,g),c;if(null===m){for(;!y.done;g++,y=u.next())null!==(y=d(a,y.value,s))&&(i=o(y,i,g),null===f?c=y:f.sibling=y,f=y);return al&&Za(a,g),c}for(m=r(a,m);!y.done;g++,y=u.next())null!==(y=h(m,a,g,y.value,s))&&(e&&null!==y.alternate&&m.delete(null===y.key?g:y.key),i=o(y,i,g),null===f?c=y:f.sibling=y,f=y);return e&&m.forEach((function(e){return t(a,e)})),al&&Za(a,g),c}return function e(r,l,o,u){if("object"===typeof o&&null!==o&&o.type===C&&null===o.key&&(o=o.props.children),"object"===typeof o&&null!==o){switch(o.$$typeof){case k:e:{for(var s=o.key,c=l;null!==c;){if(c.key===s){if((s=o.type)===C){if(7===c.tag){n(r,c.sibling),(l=a(c,o.props.children)).return=r,r=l;break e}}else if(c.elementType===s||"object"===typeof s&&null!==s&&s.$$typeof===z&&ql(s)===c.type){n(r,c.sibling),(l=a(c,o.props)).ref=Kl(r,c,o),l.return=r,r=l;break e}n(r,c);break}t(r,c),c=c.sibling}o.type===C?((l=Ds(o.props.children,r.mode,u,o.key)).return=r,r=l):((u=Is(o.type,o.key,o.props,null,r.mode,u)).ref=Kl(r,l,o),u.return=r,r=u)}return i(r);case w:e:{for(c=o.key;null!==l;){if(l.key===c){if(4===l.tag&&l.stateNode.containerInfo===o.containerInfo&&l.stateNode.implementation===o.implementation){n(r,l.sibling),(l=a(l,o.children||[])).return=r,r=l;break e}n(r,l);break}t(r,l),l=l.sibling}(l=Us(o,r.mode,u)).return=r,r=l}return i(r);case z:return e(r,l,(c=o._init)(o._payload),u)}if(te(o))return m(r,l,o,u);if(I(o))return g(r,l,o,u);Ql(r,o)}return"string"===typeof o&&""!==o||"number"===typeof o?(o=""+o,null!==l&&6===l.tag?(n(r,l.sibling),(l=a(l,o)).return=r,r=l):(n(r,l),(l=Ms(o,r.mode,u)).return=r,r=l),i(r)):n(r,l)}}var Gl=Yl(!0),Xl=Yl(!1),Zl={},Jl=Ea(Zl),eo=Ea(Zl),to=Ea(Zl);function no(e){if(e===Zl)throw Error(l(174));return e}function ro(e,t){switch(_a(to,t),_a(eo,e),_a(Jl,Zl),e=t.nodeType){case 9:case 11:t=(t=t.documentElement)?t.namespaceURI:ue(null,"");break;default:t=ue(t=(e=8===e?t.parentNode:t).namespaceURI||null,e=e.tagName)}xa(Jl),_a(Jl,t)}function ao(){xa(Jl),xa(eo),xa(to)}function lo(e){no(to.current);var t=no(Jl.current),n=ue(t,e.type);t!==n&&(_a(eo,e),_a(Jl,n))}function oo(e){eo.current===e&&(xa(Jl),xa(eo))}var io=Ea(0);function uo(e){for(var t=e;null!==t;){if(13===t.tag){var n=t.memoizedState;if(null!==n&&(null===(n=n.dehydrated)||"$?"===n.data||"$!"===n.data))return t}else if(19===t.tag&&void 0!==t.memoizedProps.revealOrder){if(0!==(128&t.flags))return t}else if(null!==t.child){t.child.return=t,t=t.child;continue}if(t===e)break;for(;null===t.sibling;){if(null===t.return||t.return===e)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}return null}var so=[];function co(){for(var e=0;e<so.length;e++)so[e]._workInProgressVersionPrimary=null;so.length=0}var fo=S.ReactCurrentDispatcher,po=S.ReactCurrentBatchConfig,ho=0,mo=null,go=null,vo=null,yo=!1,bo=!1,So=0,ko=0;function wo(){throw Error(l(321))}function Co(e,t){if(null===t)return!1;for(var n=0;n<t.length&&n<e.length;n++)if(!ir(e[n],t[n]))return!1;return!0}function Eo(e,t,n,r,a,o){if(ho=o,mo=t,t.memoizedState=null,t.updateQueue=null,t.lanes=0,fo.current=null===e||null===e.memoizedState?ii:ui,e=n(r,a),bo){o=0;do{if(bo=!1,So=0,25<=o)throw Error(l(301));o+=1,vo=go=null,t.updateQueue=null,fo.current=si,e=n(r,a)}while(bo)}if(fo.current=oi,t=null!==go&&null!==go.next,ho=0,vo=go=mo=null,yo=!1,t)throw Error(l(300));return e}function xo(){var e=0!==So;return So=0,e}function _o(){var e={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};return null===vo?mo.memoizedState=vo=e:vo=vo.next=e,vo}function Po(){if(null===go){var e=mo.alternate;e=null!==e?e.memoizedState:null}else e=go.next;var t=null===vo?mo.memoizedState:vo.next;if(null!==t)vo=t,go=e;else{if(null===e)throw Error(l(310));e={memoizedState:(go=e).memoizedState,baseState:go.baseState,baseQueue:go.baseQueue,queue:go.queue,next:null},null===vo?mo.memoizedState=vo=e:vo=vo.next=e}return vo}function To(e,t){return"function"===typeof t?t(e):t}function Oo(e){var t=Po(),n=t.queue;if(null===n)throw Error(l(311));n.lastRenderedReducer=e;var r=go,a=r.baseQueue,o=n.pending;if(null!==o){if(null!==a){var i=a.next;a.next=o.next,o.next=i}r.baseQueue=a=o,n.pending=null}if(null!==a){o=a.next,r=r.baseState;var u=i=null,s=null,c=o;do{var f=c.lane;if((ho&f)===f)null!==s&&(s=s.next={lane:0,action:c.action,hasEagerState:c.hasEagerState,eagerState:c.eagerState,next:null}),r=c.hasEagerState?c.eagerState:e(r,c.action);else{var d={lane:f,action:c.action,hasEagerState:c.hasEagerState,eagerState:c.eagerState,next:null};null===s?(u=s=d,i=r):s=s.next=d,mo.lanes|=f,Fu|=f}c=c.next}while(null!==c&&c!==o);null===s?i=r:s.next=u,ir(r,t.memoizedState)||(Si=!0),t.memoizedState=r,t.baseState=i,t.baseQueue=s,n.lastRenderedState=r}if(null!==(e=n.interleaved)){a=e;do{o=a.lane,mo.lanes|=o,Fu|=o,a=a.next}while(a!==e)}else null===a&&(n.lanes=0);return[t.memoizedState,n.dispatch]}function No(e){var t=Po(),n=t.queue;if(null===n)throw Error(l(311));n.lastRenderedReducer=e;var r=n.dispatch,a=n.pending,o=t.memoizedState;if(null!==a){n.pending=null;var i=a=a.next;do{o=e(o,i.action),i=i.next}while(i!==a);ir(o,t.memoizedState)||(Si=!0),t.memoizedState=o,null===t.baseQueue&&(t.baseState=o),n.lastRenderedState=o}return[o,r]}function Ro(){}function zo(e,t){var n=mo,r=Po(),a=t(),o=!ir(r.memoizedState,a);if(o&&(r.memoizedState=a,Si=!0),r=r.queue,Bo(Io.bind(null,n,r,e),[e]),r.getSnapshot!==t||o||null!==vo&&1&vo.memoizedState.tag){if(n.flags|=2048,Uo(9,Ao.bind(null,n,r,a,t),void 0,null),null===Nu)throw Error(l(349));0!==(30&ho)||Lo(n,t,a)}return a}function Lo(e,t,n){e.flags|=16384,e={getSnapshot:t,value:n},null===(t=mo.updateQueue)?(t={lastEffect:null,stores:null},mo.updateQueue=t,t.stores=[e]):null===(n=t.stores)?t.stores=[e]:n.push(e)}function Ao(e,t,n,r){t.value=n,t.getSnapshot=r,Do(t)&&Fo(e)}function Io(e,t,n){return n((function(){Do(t)&&Fo(e)}))}function Do(e){var t=e.getSnapshot;e=e.value;try{var n=t();return!ir(e,n)}catch(r){return!0}}function Fo(e){var t=Ol(e,1);null!==t&&rs(t,e,1,-1)}function Mo(e){var t=_o();return"function"===typeof e&&(e=e()),t.memoizedState=t.baseState=e,e={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:To,lastRenderedState:e},t.queue=e,e=e.dispatch=ni.bind(null,mo,e),[t.memoizedState,e]}function Uo(e,t,n,r){return e={tag:e,create:t,destroy:n,deps:r,next:null},null===(t=mo.updateQueue)?(t={lastEffect:null,stores:null},mo.updateQueue=t,t.lastEffect=e.next=e):null===(n=t.lastEffect)?t.lastEffect=e.next=e:(r=n.next,n.next=e,e.next=r,t.lastEffect=e),e}function $o(){return Po().memoizedState}function jo(e,t,n,r){var a=_o();mo.flags|=e,a.memoizedState=Uo(1|t,n,void 0,void 0===r?null:r)}function Ho(e,t,n,r){var a=Po();r=void 0===r?null:r;var l=void 0;if(null!==go){var o=go.memoizedState;if(l=o.destroy,null!==r&&Co(r,o.deps))return void(a.memoizedState=Uo(t,n,l,r))}mo.flags|=e,a.memoizedState=Uo(1|t,n,l,r)}function Wo(e,t){return jo(8390656,8,e,t)}function Bo(e,t){return Ho(2048,8,e,t)}function Vo(e,t){return Ho(4,2,e,t)}function Ko(e,t){return Ho(4,4,e,t)}function Qo(e,t){return"function"===typeof t?(e=e(),t(e),function(){t(null)}):null!==t&&void 0!==t?(e=e(),t.current=e,function(){t.current=null}):void 0}function qo(e,t,n){return n=null!==n&&void 0!==n?n.concat([e]):null,Ho(4,4,Qo.bind(null,t,e),n)}function Yo(){}function Go(e,t){var n=Po();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Co(t,r[1])?r[0]:(n.memoizedState=[e,t],e)}function Xo(e,t){var n=Po();t=void 0===t?null:t;var r=n.memoizedState;return null!==r&&null!==t&&Co(t,r[1])?r[0]:(e=e(),n.memoizedState=[e,t],e)}function Zo(e,t,n){return 0===(21&ho)?(e.baseState&&(e.baseState=!1,Si=!0),e.memoizedState=n):(ir(n,t)||(n=mt(),mo.lanes|=n,Fu|=n,e.baseState=!0),t)}function Jo(e,t){var n=bt;bt=0!==n&&4>n?n:4,e(!0);var r=po.transition;po.transition={};try{e(!1),t()}finally{bt=n,po.transition=r}}function ei(){return Po().memoizedState}function ti(e,t,n){var r=ns(e);if(n={lane:r,action:n,hasEagerState:!1,eagerState:null,next:null},ri(e))ai(t,n);else if(null!==(n=Tl(e,t,n,r))){rs(n,e,r,ts()),li(n,t,r)}}function ni(e,t,n){var r=ns(e),a={lane:r,action:n,hasEagerState:!1,eagerState:null,next:null};if(ri(e))ai(t,a);else{var l=e.alternate;if(0===e.lanes&&(null===l||0===l.lanes)&&null!==(l=t.lastRenderedReducer))try{var o=t.lastRenderedState,i=l(o,n);if(a.hasEagerState=!0,a.eagerState=i,ir(i,o)){var u=t.interleaved;return null===u?(a.next=a,Pl(t)):(a.next=u.next,u.next=a),void(t.interleaved=a)}}catch(s){}null!==(n=Tl(e,t,a,r))&&(rs(n,e,r,a=ts()),li(n,t,r))}}function ri(e){var t=e.alternate;return e===mo||null!==t&&t===mo}function ai(e,t){bo=yo=!0;var n=e.pending;null===n?t.next=t:(t.next=n.next,n.next=t),e.pending=t}function li(e,t,n){if(0!==(4194240&n)){var r=t.lanes;n|=r&=e.pendingLanes,t.lanes=n,yt(e,n)}}var oi={readContext:xl,useCallback:wo,useContext:wo,useEffect:wo,useImperativeHandle:wo,useInsertionEffect:wo,useLayoutEffect:wo,useMemo:wo,useReducer:wo,useRef:wo,useState:wo,useDebugValue:wo,useDeferredValue:wo,useTransition:wo,useMutableSource:wo,useSyncExternalStore:wo,useId:wo,unstable_isNewReconciler:!1},ii={readContext:xl,useCallback:function(e,t){return _o().memoizedState=[e,void 0===t?null:t],e},useContext:xl,useEffect:Wo,useImperativeHandle:function(e,t,n){return n=null!==n&&void 0!==n?n.concat([e]):null,jo(4194308,4,Qo.bind(null,t,e),n)},useLayoutEffect:function(e,t){return jo(4194308,4,e,t)},useInsertionEffect:function(e,t){return jo(4,2,e,t)},useMemo:function(e,t){var n=_o();return t=void 0===t?null:t,e=e(),n.memoizedState=[e,t],e},useReducer:function(e,t,n){var r=_o();return t=void 0!==n?n(t):t,r.memoizedState=r.baseState=t,e={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:e,lastRenderedState:t},r.queue=e,e=e.dispatch=ti.bind(null,mo,e),[r.memoizedState,e]},useRef:function(e){return e={current:e},_o().memoizedState=e},useState:Mo,useDebugValue:Yo,useDeferredValue:function(e){return _o().memoizedState=e},useTransition:function(){var e=Mo(!1),t=e[0];return e=Jo.bind(null,e[1]),_o().memoizedState=e,[t,e]},useMutableSource:function(){},useSyncExternalStore:function(e,t,n){var r=mo,a=_o();if(al){if(void 0===n)throw Error(l(407));n=n()}else{if(n=t(),null===Nu)throw Error(l(349));0!==(30&ho)||Lo(r,t,n)}a.memoizedState=n;var o={value:n,getSnapshot:t};return a.queue=o,Wo(Io.bind(null,r,o,e),[e]),r.flags|=2048,Uo(9,Ao.bind(null,r,o,n,t),void 0,null),n},useId:function(){var e=_o(),t=Nu.identifierPrefix;if(al){var n=Xa;t=":"+t+"R"+(n=(Ga&~(1<<32-ot(Ga)-1)).toString(32)+n),0<(n=So++)&&(t+="H"+n.toString(32)),t+=":"}else t=":"+t+"r"+(n=ko++).toString(32)+":";return e.memoizedState=t},unstable_isNewReconciler:!1},ui={readContext:xl,useCallback:Go,useContext:xl,useEffect:Bo,useImperativeHandle:qo,useInsertionEffect:Vo,useLayoutEffect:Ko,useMemo:Xo,useReducer:Oo,useRef:$o,useState:function(){return Oo(To)},useDebugValue:Yo,useDeferredValue:function(e){return Zo(Po(),go.memoizedState,e)},useTransition:function(){return[Oo(To)[0],Po().memoizedState]},useMutableSource:Ro,useSyncExternalStore:zo,useId:ei,unstable_isNewReconciler:!1},si={readContext:xl,useCallback:Go,useContext:xl,useEffect:Bo,useImperativeHandle:qo,useInsertionEffect:Vo,useLayoutEffect:Ko,useMemo:Xo,useReducer:No,useRef:$o,useState:function(){return No(To)},useDebugValue:Yo,useDeferredValue:function(e){var t=Po();return null===go?t.memoizedState=e:Zo(t,go.memoizedState,e)},useTransition:function(){return[No(To)[0],Po().memoizedState]},useMutableSource:Ro,useSyncExternalStore:zo,useId:ei,unstable_isNewReconciler:!1};function ci(e,t){try{var n="",r=t;do{n+=j(r),r=r.return}while(r);var a=n}catch(l){a="\nError generating stack: "+l.message+"\n"+l.stack}return{value:e,source:t,stack:a,digest:null}}function fi(e,t,n){return{value:e,source:null,stack:null!=n?n:null,digest:null!=t?t:null}}function di(e,t){try{console.error(t.value)}catch(n){setTimeout((function(){throw n}))}}var pi="function"===typeof WeakMap?WeakMap:Map;function hi(e,t,n){(n=Ll(-1,n)).tag=3,n.payload={element:null};var r=t.value;return n.callback=function(){Vu||(Vu=!0,Ku=r),di(0,t)},n}function mi(e,t,n){(n=Ll(-1,n)).tag=3;var r=e.type.getDerivedStateFromError;if("function"===typeof r){var a=t.value;n.payload=function(){return r(a)},n.callback=function(){di(0,t)}}var l=e.stateNode;return null!==l&&"function"===typeof l.componentDidCatch&&(n.callback=function(){di(0,t),"function"!==typeof r&&(null===Qu?Qu=new Set([this]):Qu.add(this));var e=t.stack;this.componentDidCatch(t.value,{componentStack:null!==e?e:""})}),n}function gi(e,t,n){var r=e.pingCache;if(null===r){r=e.pingCache=new pi;var a=new Set;r.set(t,a)}else void 0===(a=r.get(t))&&(a=new Set,r.set(t,a));a.has(n)||(a.add(n),e=_s.bind(null,e,t,n),t.then(e,e))}function vi(e){do{var t;if((t=13===e.tag)&&(t=null===(t=e.memoizedState)||null!==t.dehydrated),t)return e;e=e.return}while(null!==e);return null}function yi(e,t,n,r,a){return 0===(1&e.mode)?(e===t?e.flags|=65536:(e.flags|=128,n.flags|=131072,n.flags&=-52805,1===n.tag&&(null===n.alternate?n.tag=17:((t=Ll(-1,1)).tag=2,Al(n,t,1))),n.lanes|=1),e):(e.flags|=65536,e.lanes=a,e)}var bi=S.ReactCurrentOwner,Si=!1;function ki(e,t,n,r){t.child=null===e?Xl(t,null,n,r):Gl(t,e.child,n,r)}function wi(e,t,n,r,a){n=n.render;var l=t.ref;return El(t,a),r=Eo(e,t,n,r,l,a),n=xo(),null===e||Si?(al&&n&&el(t),t.flags|=1,ki(e,t,r,a),t.child):(t.updateQueue=e.updateQueue,t.flags&=-2053,e.lanes&=~a,Vi(e,t,a))}function Ci(e,t,n,r,a){if(null===e){var l=n.type;return"function"!==typeof l||Ls(l)||void 0!==l.defaultProps||null!==n.compare||void 0!==n.defaultProps?((e=Is(n.type,null,r,t,t.mode,a)).ref=t.ref,e.return=t,t.child=e):(t.tag=15,t.type=l,Ei(e,t,l,r,a))}if(l=e.child,0===(e.lanes&a)){var o=l.memoizedProps;if((n=null!==(n=n.compare)?n:ur)(o,r)&&e.ref===t.ref)return Vi(e,t,a)}return t.flags|=1,(e=As(l,r)).ref=t.ref,e.return=t,t.child=e}function Ei(e,t,n,r,a){if(null!==e){var l=e.memoizedProps;if(ur(l,r)&&e.ref===t.ref){if(Si=!1,t.pendingProps=r=l,0===(e.lanes&a))return t.lanes=e.lanes,Vi(e,t,a);0!==(131072&e.flags)&&(Si=!0)}}return Pi(e,t,n,r,a)}function xi(e,t,n){var r=t.pendingProps,a=r.children,l=null!==e?e.memoizedState:null;if("hidden"===r.mode)if(0===(1&t.mode))t.memoizedState={baseLanes:0,cachePool:null,transitions:null},_a(Au,Lu),Lu|=n;else{if(0===(1073741824&n))return e=null!==l?l.baseLanes|n:n,t.lanes=t.childLanes=1073741824,t.memoizedState={baseLanes:e,cachePool:null,transitions:null},t.updateQueue=null,_a(Au,Lu),Lu|=e,null;t.memoizedState={baseLanes:0,cachePool:null,transitions:null},r=null!==l?l.baseLanes:n,_a(Au,Lu),Lu|=r}else null!==l?(r=l.baseLanes|n,t.memoizedState=null):r=n,_a(Au,Lu),Lu|=r;return ki(e,t,a,n),t.child}function _i(e,t){var n=t.ref;(null===e&&null!==n||null!==e&&e.ref!==n)&&(t.flags|=512,t.flags|=2097152)}function Pi(e,t,n,r,a){var l=za(n)?Na:Ta.current;return l=Ra(t,l),El(t,a),n=Eo(e,t,n,r,l,a),r=xo(),null===e||Si?(al&&r&&el(t),t.flags|=1,ki(e,t,n,a),t.child):(t.updateQueue=e.updateQueue,t.flags&=-2053,e.lanes&=~a,Vi(e,t,a))}function Ti(e,t,n,r,a){if(za(n)){var l=!0;Da(t)}else l=!1;if(El(t,a),null===t.stateNode)Bi(e,t),Wl(t,n,r),Vl(t,n,r,a),r=!0;else if(null===e){var o=t.stateNode,i=t.memoizedProps;o.props=i;var u=o.context,s=n.contextType;"object"===typeof s&&null!==s?s=xl(s):s=Ra(t,s=za(n)?Na:Ta.current);var c=n.getDerivedStateFromProps,f="function"===typeof c||"function"===typeof o.getSnapshotBeforeUpdate;f||"function"!==typeof o.UNSAFE_componentWillReceiveProps&&"function"!==typeof o.componentWillReceiveProps||(i!==r||u!==s)&&Bl(t,o,r,s),Nl=!1;var d=t.memoizedState;o.state=d,Fl(t,r,o,a),u=t.memoizedState,i!==r||d!==u||Oa.current||Nl?("function"===typeof c&&($l(t,n,c,r),u=t.memoizedState),(i=Nl||Hl(t,n,i,r,d,u,s))?(f||"function"!==typeof o.UNSAFE_componentWillMount&&"function"!==typeof o.componentWillMount||("function"===typeof o.componentWillMount&&o.componentWillMount(),"function"===typeof o.UNSAFE_componentWillMount&&o.UNSAFE_componentWillMount()),"function"===typeof o.componentDidMount&&(t.flags|=4194308)):("function"===typeof o.componentDidMount&&(t.flags|=4194308),t.memoizedProps=r,t.memoizedState=u),o.props=r,o.state=u,o.context=s,r=i):("function"===typeof o.componentDidMount&&(t.flags|=4194308),r=!1)}else{o=t.stateNode,zl(e,t),i=t.memoizedProps,s=t.type===t.elementType?i:gl(t.type,i),o.props=s,f=t.pendingProps,d=o.context,"object"===typeof(u=n.contextType)&&null!==u?u=xl(u):u=Ra(t,u=za(n)?Na:Ta.current);var p=n.getDerivedStateFromProps;(c="function"===typeof p||"function"===typeof o.getSnapshotBeforeUpdate)||"function"!==typeof o.UNSAFE_componentWillReceiveProps&&"function"!==typeof o.componentWillReceiveProps||(i!==f||d!==u)&&Bl(t,o,r,u),Nl=!1,d=t.memoizedState,o.state=d,Fl(t,r,o,a);var h=t.memoizedState;i!==f||d!==h||Oa.current||Nl?("function"===typeof p&&($l(t,n,p,r),h=t.memoizedState),(s=Nl||Hl(t,n,s,r,d,h,u)||!1)?(c||"function"!==typeof o.UNSAFE_componentWillUpdate&&"function"!==typeof o.componentWillUpdate||("function"===typeof o.componentWillUpdate&&o.componentWillUpdate(r,h,u),"function"===typeof o.UNSAFE_componentWillUpdate&&o.UNSAFE_componentWillUpdate(r,h,u)),"function"===typeof o.componentDidUpdate&&(t.flags|=4),"function"===typeof o.getSnapshotBeforeUpdate&&(t.flags|=1024)):("function"!==typeof o.componentDidUpdate||i===e.memoizedProps&&d===e.memoizedState||(t.flags|=4),"function"!==typeof o.getSnapshotBeforeUpdate||i===e.memoizedProps&&d===e.memoizedState||(t.flags|=1024),t.memoizedProps=r,t.memoizedState=h),o.props=r,o.state=h,o.context=u,r=s):("function"!==typeof o.componentDidUpdate||i===e.memoizedProps&&d===e.memoizedState||(t.flags|=4),"function"!==typeof o.getSnapshotBeforeUpdate||i===e.memoizedProps&&d===e.memoizedState||(t.flags|=1024),r=!1)}return Oi(e,t,n,r,l,a)}function Oi(e,t,n,r,a,l){_i(e,t);var o=0!==(128&t.flags);if(!r&&!o)return a&&Fa(t,n,!1),Vi(e,t,l);r=t.stateNode,bi.current=t;var i=o&&"function"!==typeof n.getDerivedStateFromError?null:r.render();return t.flags|=1,null!==e&&o?(t.child=Gl(t,e.child,null,l),t.child=Gl(t,null,i,l)):ki(e,t,i,l),t.memoizedState=r.state,a&&Fa(t,n,!0),t.child}function Ni(e){var t=e.stateNode;t.pendingContext?Aa(0,t.pendingContext,t.pendingContext!==t.context):t.context&&Aa(0,t.context,!1),ro(e,t.containerInfo)}function Ri(e,t,n,r,a){return pl(),hl(a),t.flags|=256,ki(e,t,n,r),t.child}var zi,Li,Ai,Ii,Di={dehydrated:null,treeContext:null,retryLane:0};function Fi(e){return{baseLanes:e,cachePool:null,transitions:null}}function Mi(e,t,n){var r,a=t.pendingProps,o=io.current,i=!1,u=0!==(128&t.flags);if((r=u)||(r=(null===e||null!==e.memoizedState)&&0!==(2&o)),r?(i=!0,t.flags&=-129):null!==e&&null===e.memoizedState||(o|=1),_a(io,1&o),null===e)return sl(t),null!==(e=t.memoizedState)&&null!==(e=e.dehydrated)?(0===(1&t.mode)?t.lanes=1:"$!"===e.data?t.lanes=8:t.lanes=1073741824,null):(u=a.children,e=a.fallback,i?(a=t.mode,i=t.child,u={mode:"hidden",children:u},0===(1&a)&&null!==i?(i.childLanes=0,i.pendingProps=u):i=Fs(u,a,0,null),e=Ds(e,a,n,null),i.return=t,e.return=t,i.sibling=e,t.child=i,t.child.memoizedState=Fi(n),t.memoizedState=Di,e):Ui(t,u));if(null!==(o=e.memoizedState)&&null!==(r=o.dehydrated))return function(e,t,n,r,a,o,i){if(n)return 256&t.flags?(t.flags&=-257,$i(e,t,i,r=fi(Error(l(422))))):null!==t.memoizedState?(t.child=e.child,t.flags|=128,null):(o=r.fallback,a=t.mode,r=Fs({mode:"visible",children:r.children},a,0,null),(o=Ds(o,a,i,null)).flags|=2,r.return=t,o.return=t,r.sibling=o,t.child=r,0!==(1&t.mode)&&Gl(t,e.child,null,i),t.child.memoizedState=Fi(i),t.memoizedState=Di,o);if(0===(1&t.mode))return $i(e,t,i,null);if("$!"===a.data){if(r=a.nextSibling&&a.nextSibling.dataset)var u=r.dgst;return r=u,$i(e,t,i,r=fi(o=Error(l(419)),r,void 0))}if(u=0!==(i&e.childLanes),Si||u){if(null!==(r=Nu)){switch(i&-i){case 4:a=2;break;case 16:a=8;break;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:a=32;break;case 536870912:a=268435456;break;default:a=0}0!==(a=0!==(a&(r.suspendedLanes|i))?0:a)&&a!==o.retryLane&&(o.retryLane=a,Ol(e,a),rs(r,e,a,-1))}return gs(),$i(e,t,i,r=fi(Error(l(421))))}return"$?"===a.data?(t.flags|=128,t.child=e.child,t=Ts.bind(null,e),a._reactRetry=t,null):(e=o.treeContext,rl=sa(a.nextSibling),nl=t,al=!0,ll=null,null!==e&&(Qa[qa++]=Ga,Qa[qa++]=Xa,Qa[qa++]=Ya,Ga=e.id,Xa=e.overflow,Ya=t),t=Ui(t,r.children),t.flags|=4096,t)}(e,t,u,a,r,o,n);if(i){i=a.fallback,u=t.mode,r=(o=e.child).sibling;var s={mode:"hidden",children:a.children};return 0===(1&u)&&t.child!==o?((a=t.child).childLanes=0,a.pendingProps=s,t.deletions=null):(a=As(o,s)).subtreeFlags=14680064&o.subtreeFlags,null!==r?i=As(r,i):(i=Ds(i,u,n,null)).flags|=2,i.return=t,a.return=t,a.sibling=i,t.child=a,a=i,i=t.child,u=null===(u=e.child.memoizedState)?Fi(n):{baseLanes:u.baseLanes|n,cachePool:null,transitions:u.transitions},i.memoizedState=u,i.childLanes=e.childLanes&~n,t.memoizedState=Di,a}return e=(i=e.child).sibling,a=As(i,{mode:"visible",children:a.children}),0===(1&t.mode)&&(a.lanes=n),a.return=t,a.sibling=null,null!==e&&(null===(n=t.deletions)?(t.deletions=[e],t.flags|=16):n.push(e)),t.child=a,t.memoizedState=null,a}function Ui(e,t){return(t=Fs({mode:"visible",children:t},e.mode,0,null)).return=e,e.child=t}function $i(e,t,n,r){return null!==r&&hl(r),Gl(t,e.child,null,n),(e=Ui(t,t.pendingProps.children)).flags|=2,t.memoizedState=null,e}function ji(e,t,n){e.lanes|=t;var r=e.alternate;null!==r&&(r.lanes|=t),Cl(e.return,t,n)}function Hi(e,t,n,r,a){var l=e.memoizedState;null===l?e.memoizedState={isBackwards:t,rendering:null,renderingStartTime:0,last:r,tail:n,tailMode:a}:(l.isBackwards=t,l.rendering=null,l.renderingStartTime=0,l.last=r,l.tail=n,l.tailMode=a)}function Wi(e,t,n){var r=t.pendingProps,a=r.revealOrder,l=r.tail;if(ki(e,t,r.children,n),0!==(2&(r=io.current)))r=1&r|2,t.flags|=128;else{if(null!==e&&0!==(128&e.flags))e:for(e=t.child;null!==e;){if(13===e.tag)null!==e.memoizedState&&ji(e,n,t);else if(19===e.tag)ji(e,n,t);else if(null!==e.child){e.child.return=e,e=e.child;continue}if(e===t)break e;for(;null===e.sibling;){if(null===e.return||e.return===t)break e;e=e.return}e.sibling.return=e.return,e=e.sibling}r&=1}if(_a(io,r),0===(1&t.mode))t.memoizedState=null;else switch(a){case"forwards":for(n=t.child,a=null;null!==n;)null!==(e=n.alternate)&&null===uo(e)&&(a=n),n=n.sibling;null===(n=a)?(a=t.child,t.child=null):(a=n.sibling,n.sibling=null),Hi(t,!1,a,n,l);break;case"backwards":for(n=null,a=t.child,t.child=null;null!==a;){if(null!==(e=a.alternate)&&null===uo(e)){t.child=a;break}e=a.sibling,a.sibling=n,n=a,a=e}Hi(t,!0,n,null,l);break;case"together":Hi(t,!1,null,null,void 0);break;default:t.memoizedState=null}return t.child}function Bi(e,t){0===(1&t.mode)&&null!==e&&(e.alternate=null,t.alternate=null,t.flags|=2)}function Vi(e,t,n){if(null!==e&&(t.dependencies=e.dependencies),Fu|=t.lanes,0===(n&t.childLanes))return null;if(null!==e&&t.child!==e.child)throw Error(l(153));if(null!==t.child){for(n=As(e=t.child,e.pendingProps),t.child=n,n.return=t;null!==e.sibling;)e=e.sibling,(n=n.sibling=As(e,e.pendingProps)).return=t;n.sibling=null}return t.child}function Ki(e,t){if(!al)switch(e.tailMode){case"hidden":t=e.tail;for(var n=null;null!==t;)null!==t.alternate&&(n=t),t=t.sibling;null===n?e.tail=null:n.sibling=null;break;case"collapsed":n=e.tail;for(var r=null;null!==n;)null!==n.alternate&&(r=n),n=n.sibling;null===r?t||null===e.tail?e.tail=null:e.tail.sibling=null:r.sibling=null}}function Qi(e){var t=null!==e.alternate&&e.alternate.child===e.child,n=0,r=0;if(t)for(var a=e.child;null!==a;)n|=a.lanes|a.childLanes,r|=14680064&a.subtreeFlags,r|=14680064&a.flags,a.return=e,a=a.sibling;else for(a=e.child;null!==a;)n|=a.lanes|a.childLanes,r|=a.subtreeFlags,r|=a.flags,a.return=e,a=a.sibling;return e.subtreeFlags|=r,e.childLanes=n,t}function qi(e,t,n){var r=t.pendingProps;switch(tl(t),t.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return Qi(t),null;case 1:case 17:return za(t.type)&&La(),Qi(t),null;case 3:return r=t.stateNode,ao(),xa(Oa),xa(Ta),co(),r.pendingContext&&(r.context=r.pendingContext,r.pendingContext=null),null!==e&&null!==e.child||(fl(t)?t.flags|=4:null===e||e.memoizedState.isDehydrated&&0===(256&t.flags)||(t.flags|=1024,null!==ll&&(is(ll),ll=null))),Li(e,t),Qi(t),null;case 5:oo(t);var a=no(to.current);if(n=t.type,null!==e&&null!=t.stateNode)Ai(e,t,n,r,a),e.ref!==t.ref&&(t.flags|=512,t.flags|=2097152);else{if(!r){if(null===t.stateNode)throw Error(l(166));return Qi(t),null}if(e=no(Jl.current),fl(t)){r=t.stateNode,n=t.type;var o=t.memoizedProps;switch(r[da]=t,r[pa]=o,e=0!==(1&t.mode),n){case"dialog":Ur("cancel",r),Ur("close",r);break;case"iframe":case"object":case"embed":Ur("load",r);break;case"video":case"audio":for(a=0;a<Ir.length;a++)Ur(Ir[a],r);break;case"source":Ur("error",r);break;case"img":case"image":case"link":Ur("error",r),Ur("load",r);break;case"details":Ur("toggle",r);break;case"input":G(r,o),Ur("invalid",r);break;case"select":r._wrapperState={wasMultiple:!!o.multiple},Ur("invalid",r);break;case"textarea":ae(r,o),Ur("invalid",r)}for(var u in ye(n,o),a=null,o)if(o.hasOwnProperty(u)){var s=o[u];"children"===u?"string"===typeof s?r.textContent!==s&&(!0!==o.suppressHydrationWarning&&Zr(r.textContent,s,e),a=["children",s]):"number"===typeof s&&r.textContent!==""+s&&(!0!==o.suppressHydrationWarning&&Zr(r.textContent,s,e),a=["children",""+s]):i.hasOwnProperty(u)&&null!=s&&"onScroll"===u&&Ur("scroll",r)}switch(n){case"input":K(r),J(r,o,!0);break;case"textarea":K(r),oe(r);break;case"select":case"option":break;default:"function"===typeof o.onClick&&(r.onclick=Jr)}r=a,t.updateQueue=r,null!==r&&(t.flags|=4)}else{u=9===a.nodeType?a:a.ownerDocument,"http://www.w3.org/1999/xhtml"===e&&(e=ie(n)),"http://www.w3.org/1999/xhtml"===e?"script"===n?((e=u.createElement("div")).innerHTML="<script><\/script>",e=e.removeChild(e.firstChild)):"string"===typeof r.is?e=u.createElement(n,{is:r.is}):(e=u.createElement(n),"select"===n&&(u=e,r.multiple?u.multiple=!0:r.size&&(u.size=r.size))):e=u.createElementNS(e,n),e[da]=t,e[pa]=r,zi(e,t,!1,!1),t.stateNode=e;e:{switch(u=be(n,r),n){case"dialog":Ur("cancel",e),Ur("close",e),a=r;break;case"iframe":case"object":case"embed":Ur("load",e),a=r;break;case"video":case"audio":for(a=0;a<Ir.length;a++)Ur(Ir[a],e);a=r;break;case"source":Ur("error",e),a=r;break;case"img":case"image":case"link":Ur("error",e),Ur("load",e),a=r;break;case"details":Ur("toggle",e),a=r;break;case"input":G(e,r),a=Y(e,r),Ur("invalid",e);break;case"option":default:a=r;break;case"select":e._wrapperState={wasMultiple:!!r.multiple},a=F({},r,{value:void 0}),Ur("invalid",e);break;case"textarea":ae(e,r),a=re(e,r),Ur("invalid",e)}for(o in ye(n,a),s=a)if(s.hasOwnProperty(o)){var c=s[o];"style"===o?ge(e,c):"dangerouslySetInnerHTML"===o?null!=(c=c?c.__html:void 0)&&fe(e,c):"children"===o?"string"===typeof c?("textarea"!==n||""!==c)&&de(e,c):"number"===typeof c&&de(e,""+c):"suppressContentEditableWarning"!==o&&"suppressHydrationWarning"!==o&&"autoFocus"!==o&&(i.hasOwnProperty(o)?null!=c&&"onScroll"===o&&Ur("scroll",e):null!=c&&b(e,o,c,u))}switch(n){case"input":K(e),J(e,r,!1);break;case"textarea":K(e),oe(e);break;case"option":null!=r.value&&e.setAttribute("value",""+B(r.value));break;case"select":e.multiple=!!r.multiple,null!=(o=r.value)?ne(e,!!r.multiple,o,!1):null!=r.defaultValue&&ne(e,!!r.multiple,r.defaultValue,!0);break;default:"function"===typeof a.onClick&&(e.onclick=Jr)}switch(n){case"button":case"input":case"select":case"textarea":r=!!r.autoFocus;break e;case"img":r=!0;break e;default:r=!1}}r&&(t.flags|=4)}null!==t.ref&&(t.flags|=512,t.flags|=2097152)}return Qi(t),null;case 6:if(e&&null!=t.stateNode)Ii(e,t,e.memoizedProps,r);else{if("string"!==typeof r&&null===t.stateNode)throw Error(l(166));if(n=no(to.current),no(Jl.current),fl(t)){if(r=t.stateNode,n=t.memoizedProps,r[da]=t,(o=r.nodeValue!==n)&&null!==(e=nl))switch(e.tag){case 3:Zr(r.nodeValue,n,0!==(1&e.mode));break;case 5:!0!==e.memoizedProps.suppressHydrationWarning&&Zr(r.nodeValue,n,0!==(1&e.mode))}o&&(t.flags|=4)}else(r=(9===n.nodeType?n:n.ownerDocument).createTextNode(r))[da]=t,t.stateNode=r}return Qi(t),null;case 13:if(xa(io),r=t.memoizedState,null===e||null!==e.memoizedState&&null!==e.memoizedState.dehydrated){if(al&&null!==rl&&0!==(1&t.mode)&&0===(128&t.flags))dl(),pl(),t.flags|=98560,o=!1;else if(o=fl(t),null!==r&&null!==r.dehydrated){if(null===e){if(!o)throw Error(l(318));if(!(o=null!==(o=t.memoizedState)?o.dehydrated:null))throw Error(l(317));o[da]=t}else pl(),0===(128&t.flags)&&(t.memoizedState=null),t.flags|=4;Qi(t),o=!1}else null!==ll&&(is(ll),ll=null),o=!0;if(!o)return 65536&t.flags?t:null}return 0!==(128&t.flags)?(t.lanes=n,t):((r=null!==r)!==(null!==e&&null!==e.memoizedState)&&r&&(t.child.flags|=8192,0!==(1&t.mode)&&(null===e||0!==(1&io.current)?0===Iu&&(Iu=3):gs())),null!==t.updateQueue&&(t.flags|=4),Qi(t),null);case 4:return ao(),Li(e,t),null===e&&Hr(t.stateNode.containerInfo),Qi(t),null;case 10:return wl(t.type._context),Qi(t),null;case 19:if(xa(io),null===(o=t.memoizedState))return Qi(t),null;if(r=0!==(128&t.flags),null===(u=o.rendering))if(r)Ki(o,!1);else{if(0!==Iu||null!==e&&0!==(128&e.flags))for(e=t.child;null!==e;){if(null!==(u=uo(e))){for(t.flags|=128,Ki(o,!1),null!==(r=u.updateQueue)&&(t.updateQueue=r,t.flags|=4),t.subtreeFlags=0,r=n,n=t.child;null!==n;)e=r,(o=n).flags&=14680066,null===(u=o.alternate)?(o.childLanes=0,o.lanes=e,o.child=null,o.subtreeFlags=0,o.memoizedProps=null,o.memoizedState=null,o.updateQueue=null,o.dependencies=null,o.stateNode=null):(o.childLanes=u.childLanes,o.lanes=u.lanes,o.child=u.child,o.subtreeFlags=0,o.deletions=null,o.memoizedProps=u.memoizedProps,o.memoizedState=u.memoizedState,o.updateQueue=u.updateQueue,o.type=u.type,e=u.dependencies,o.dependencies=null===e?null:{lanes:e.lanes,firstContext:e.firstContext}),n=n.sibling;return _a(io,1&io.current|2),t.child}e=e.sibling}null!==o.tail&&Xe()>Wu&&(t.flags|=128,r=!0,Ki(o,!1),t.lanes=4194304)}else{if(!r)if(null!==(e=uo(u))){if(t.flags|=128,r=!0,null!==(n=e.updateQueue)&&(t.updateQueue=n,t.flags|=4),Ki(o,!0),null===o.tail&&"hidden"===o.tailMode&&!u.alternate&&!al)return Qi(t),null}else 2*Xe()-o.renderingStartTime>Wu&&1073741824!==n&&(t.flags|=128,r=!0,Ki(o,!1),t.lanes=4194304);o.isBackwards?(u.sibling=t.child,t.child=u):(null!==(n=o.last)?n.sibling=u:t.child=u,o.last=u)}return null!==o.tail?(t=o.tail,o.rendering=t,o.tail=t.sibling,o.renderingStartTime=Xe(),t.sibling=null,n=io.current,_a(io,r?1&n|2:1&n),t):(Qi(t),null);case 22:case 23:return ds(),r=null!==t.memoizedState,null!==e&&null!==e.memoizedState!==r&&(t.flags|=8192),r&&0!==(1&t.mode)?0!==(1073741824&Lu)&&(Qi(t),6&t.subtreeFlags&&(t.flags|=8192)):Qi(t),null;case 24:case 25:return null}throw Error(l(156,t.tag))}function Yi(e,t){switch(tl(t),t.tag){case 1:return za(t.type)&&La(),65536&(e=t.flags)?(t.flags=-65537&e|128,t):null;case 3:return ao(),xa(Oa),xa(Ta),co(),0!==(65536&(e=t.flags))&&0===(128&e)?(t.flags=-65537&e|128,t):null;case 5:return oo(t),null;case 13:if(xa(io),null!==(e=t.memoizedState)&&null!==e.dehydrated){if(null===t.alternate)throw Error(l(340));pl()}return 65536&(e=t.flags)?(t.flags=-65537&e|128,t):null;case 19:return xa(io),null;case 4:return ao(),null;case 10:return wl(t.type._context),null;case 22:case 23:return ds(),null;default:return null}}zi=function(e,t){for(var n=t.child;null!==n;){if(5===n.tag||6===n.tag)e.appendChild(n.stateNode);else if(4!==n.tag&&null!==n.child){n.child.return=n,n=n.child;continue}if(n===t)break;for(;null===n.sibling;){if(null===n.return||n.return===t)return;n=n.return}n.sibling.return=n.return,n=n.sibling}},Li=function(){},Ai=function(e,t,n,r){var a=e.memoizedProps;if(a!==r){e=t.stateNode,no(Jl.current);var l,o=null;switch(n){case"input":a=Y(e,a),r=Y(e,r),o=[];break;case"select":a=F({},a,{value:void 0}),r=F({},r,{value:void 0}),o=[];break;case"textarea":a=re(e,a),r=re(e,r),o=[];break;default:"function"!==typeof a.onClick&&"function"===typeof r.onClick&&(e.onclick=Jr)}for(c in ye(n,r),n=null,a)if(!r.hasOwnProperty(c)&&a.hasOwnProperty(c)&&null!=a[c])if("style"===c){var u=a[c];for(l in u)u.hasOwnProperty(l)&&(n||(n={}),n[l]="")}else"dangerouslySetInnerHTML"!==c&&"children"!==c&&"suppressContentEditableWarning"!==c&&"suppressHydrationWarning"!==c&&"autoFocus"!==c&&(i.hasOwnProperty(c)?o||(o=[]):(o=o||[]).push(c,null));for(c in r){var s=r[c];if(u=null!=a?a[c]:void 0,r.hasOwnProperty(c)&&s!==u&&(null!=s||null!=u))if("style"===c)if(u){for(l in u)!u.hasOwnProperty(l)||s&&s.hasOwnProperty(l)||(n||(n={}),n[l]="");for(l in s)s.hasOwnProperty(l)&&u[l]!==s[l]&&(n||(n={}),n[l]=s[l])}else n||(o||(o=[]),o.push(c,n)),n=s;else"dangerouslySetInnerHTML"===c?(s=s?s.__html:void 0,u=u?u.__html:void 0,null!=s&&u!==s&&(o=o||[]).push(c,s)):"children"===c?"string"!==typeof s&&"number"!==typeof s||(o=o||[]).push(c,""+s):"suppressContentEditableWarning"!==c&&"suppressHydrationWarning"!==c&&(i.hasOwnProperty(c)?(null!=s&&"onScroll"===c&&Ur("scroll",e),o||u===s||(o=[])):(o=o||[]).push(c,s))}n&&(o=o||[]).push("style",n);var c=o;(t.updateQueue=c)&&(t.flags|=4)}},Ii=function(e,t,n,r){n!==r&&(t.flags|=4)};var Gi=!1,Xi=!1,Zi="function"===typeof WeakSet?WeakSet:Set,Ji=null;function eu(e,t){var n=e.ref;if(null!==n)if("function"===typeof n)try{n(null)}catch(r){xs(e,t,r)}else n.current=null}function tu(e,t,n){try{n()}catch(r){xs(e,t,r)}}var nu=!1;function ru(e,t,n){var r=t.updateQueue;if(null!==(r=null!==r?r.lastEffect:null)){var a=r=r.next;do{if((a.tag&e)===e){var l=a.destroy;a.destroy=void 0,void 0!==l&&tu(t,n,l)}a=a.next}while(a!==r)}}function au(e,t){if(null!==(t=null!==(t=t.updateQueue)?t.lastEffect:null)){var n=t=t.next;do{if((n.tag&e)===e){var r=n.create;n.destroy=r()}n=n.next}while(n!==t)}}function lu(e){var t=e.ref;if(null!==t){var n=e.stateNode;e.tag,e=n,"function"===typeof t?t(e):t.current=e}}function ou(e){var t=e.alternate;null!==t&&(e.alternate=null,ou(t)),e.child=null,e.deletions=null,e.sibling=null,5===e.tag&&(null!==(t=e.stateNode)&&(delete t[da],delete t[pa],delete t[ma],delete t[ga],delete t[va])),e.stateNode=null,e.return=null,e.dependencies=null,e.memoizedProps=null,e.memoizedState=null,e.pendingProps=null,e.stateNode=null,e.updateQueue=null}function iu(e){return 5===e.tag||3===e.tag||4===e.tag}function uu(e){e:for(;;){for(;null===e.sibling;){if(null===e.return||iu(e.return))return null;e=e.return}for(e.sibling.return=e.return,e=e.sibling;5!==e.tag&&6!==e.tag&&18!==e.tag;){if(2&e.flags)continue e;if(null===e.child||4===e.tag)continue e;e.child.return=e,e=e.child}if(!(2&e.flags))return e.stateNode}}function su(e,t,n){var r=e.tag;if(5===r||6===r)e=e.stateNode,t?8===n.nodeType?n.parentNode.insertBefore(e,t):n.insertBefore(e,t):(8===n.nodeType?(t=n.parentNode).insertBefore(e,n):(t=n).appendChild(e),null!==(n=n._reactRootContainer)&&void 0!==n||null!==t.onclick||(t.onclick=Jr));else if(4!==r&&null!==(e=e.child))for(su(e,t,n),e=e.sibling;null!==e;)su(e,t,n),e=e.sibling}function cu(e,t,n){var r=e.tag;if(5===r||6===r)e=e.stateNode,t?n.insertBefore(e,t):n.appendChild(e);else if(4!==r&&null!==(e=e.child))for(cu(e,t,n),e=e.sibling;null!==e;)cu(e,t,n),e=e.sibling}var fu=null,du=!1;function pu(e,t,n){for(n=n.child;null!==n;)hu(e,t,n),n=n.sibling}function hu(e,t,n){if(lt&&"function"===typeof lt.onCommitFiberUnmount)try{lt.onCommitFiberUnmount(at,n)}catch(i){}switch(n.tag){case 5:Xi||eu(n,t);case 6:var r=fu,a=du;fu=null,pu(e,t,n),du=a,null!==(fu=r)&&(du?(e=fu,n=n.stateNode,8===e.nodeType?e.parentNode.removeChild(n):e.removeChild(n)):fu.removeChild(n.stateNode));break;case 18:null!==fu&&(du?(e=fu,n=n.stateNode,8===e.nodeType?ua(e.parentNode,n):1===e.nodeType&&ua(e,n),Ht(e)):ua(fu,n.stateNode));break;case 4:r=fu,a=du,fu=n.stateNode.containerInfo,du=!0,pu(e,t,n),fu=r,du=a;break;case 0:case 11:case 14:case 15:if(!Xi&&(null!==(r=n.updateQueue)&&null!==(r=r.lastEffect))){a=r=r.next;do{var l=a,o=l.destroy;l=l.tag,void 0!==o&&(0!==(2&l)||0!==(4&l))&&tu(n,t,o),a=a.next}while(a!==r)}pu(e,t,n);break;case 1:if(!Xi&&(eu(n,t),"function"===typeof(r=n.stateNode).componentWillUnmount))try{r.props=n.memoizedProps,r.state=n.memoizedState,r.componentWillUnmount()}catch(i){xs(n,t,i)}pu(e,t,n);break;case 21:pu(e,t,n);break;case 22:1&n.mode?(Xi=(r=Xi)||null!==n.memoizedState,pu(e,t,n),Xi=r):pu(e,t,n);break;default:pu(e,t,n)}}function mu(e){var t=e.updateQueue;if(null!==t){e.updateQueue=null;var n=e.stateNode;null===n&&(n=e.stateNode=new Zi),t.forEach((function(t){var r=Os.bind(null,e,t);n.has(t)||(n.add(t),t.then(r,r))}))}}function gu(e,t){var n=t.deletions;if(null!==n)for(var r=0;r<n.length;r++){var a=n[r];try{var o=e,i=t,u=i;e:for(;null!==u;){switch(u.tag){case 5:fu=u.stateNode,du=!1;break e;case 3:case 4:fu=u.stateNode.containerInfo,du=!0;break e}u=u.return}if(null===fu)throw Error(l(160));hu(o,i,a),fu=null,du=!1;var s=a.alternate;null!==s&&(s.return=null),a.return=null}catch(c){xs(a,t,c)}}if(12854&t.subtreeFlags)for(t=t.child;null!==t;)vu(t,e),t=t.sibling}function vu(e,t){var n=e.alternate,r=e.flags;switch(e.tag){case 0:case 11:case 14:case 15:if(gu(t,e),yu(e),4&r){try{ru(3,e,e.return),au(3,e)}catch(g){xs(e,e.return,g)}try{ru(5,e,e.return)}catch(g){xs(e,e.return,g)}}break;case 1:gu(t,e),yu(e),512&r&&null!==n&&eu(n,n.return);break;case 5:if(gu(t,e),yu(e),512&r&&null!==n&&eu(n,n.return),32&e.flags){var a=e.stateNode;try{de(a,"")}catch(g){xs(e,e.return,g)}}if(4&r&&null!=(a=e.stateNode)){var o=e.memoizedProps,i=null!==n?n.memoizedProps:o,u=e.type,s=e.updateQueue;if(e.updateQueue=null,null!==s)try{"input"===u&&"radio"===o.type&&null!=o.name&&X(a,o),be(u,i);var c=be(u,o);for(i=0;i<s.length;i+=2){var f=s[i],d=s[i+1];"style"===f?ge(a,d):"dangerouslySetInnerHTML"===f?fe(a,d):"children"===f?de(a,d):b(a,f,d,c)}switch(u){case"input":Z(a,o);break;case"textarea":le(a,o);break;case"select":var p=a._wrapperState.wasMultiple;a._wrapperState.wasMultiple=!!o.multiple;var h=o.value;null!=h?ne(a,!!o.multiple,h,!1):p!==!!o.multiple&&(null!=o.defaultValue?ne(a,!!o.multiple,o.defaultValue,!0):ne(a,!!o.multiple,o.multiple?[]:"",!1))}a[pa]=o}catch(g){xs(e,e.return,g)}}break;case 6:if(gu(t,e),yu(e),4&r){if(null===e.stateNode)throw Error(l(162));a=e.stateNode,o=e.memoizedProps;try{a.nodeValue=o}catch(g){xs(e,e.return,g)}}break;case 3:if(gu(t,e),yu(e),4&r&&null!==n&&n.memoizedState.isDehydrated)try{Ht(t.containerInfo)}catch(g){xs(e,e.return,g)}break;case 4:default:gu(t,e),yu(e);break;case 13:gu(t,e),yu(e),8192&(a=e.child).flags&&(o=null!==a.memoizedState,a.stateNode.isHidden=o,!o||null!==a.alternate&&null!==a.alternate.memoizedState||(Hu=Xe())),4&r&&mu(e);break;case 22:if(f=null!==n&&null!==n.memoizedState,1&e.mode?(Xi=(c=Xi)||f,gu(t,e),Xi=c):gu(t,e),yu(e),8192&r){if(c=null!==e.memoizedState,(e.stateNode.isHidden=c)&&!f&&0!==(1&e.mode))for(Ji=e,f=e.child;null!==f;){for(d=Ji=f;null!==Ji;){switch(h=(p=Ji).child,p.tag){case 0:case 11:case 14:case 15:ru(4,p,p.return);break;case 1:eu(p,p.return);var m=p.stateNode;if("function"===typeof m.componentWillUnmount){r=p,n=p.return;try{t=r,m.props=t.memoizedProps,m.state=t.memoizedState,m.componentWillUnmount()}catch(g){xs(r,n,g)}}break;case 5:eu(p,p.return);break;case 22:if(null!==p.memoizedState){wu(d);continue}}null!==h?(h.return=p,Ji=h):wu(d)}f=f.sibling}e:for(f=null,d=e;;){if(5===d.tag){if(null===f){f=d;try{a=d.stateNode,c?"function"===typeof(o=a.style).setProperty?o.setProperty("display","none","important"):o.display="none":(u=d.stateNode,i=void 0!==(s=d.memoizedProps.style)&&null!==s&&s.hasOwnProperty("display")?s.display:null,u.style.display=me("display",i))}catch(g){xs(e,e.return,g)}}}else if(6===d.tag){if(null===f)try{d.stateNode.nodeValue=c?"":d.memoizedProps}catch(g){xs(e,e.return,g)}}else if((22!==d.tag&&23!==d.tag||null===d.memoizedState||d===e)&&null!==d.child){d.child.return=d,d=d.child;continue}if(d===e)break e;for(;null===d.sibling;){if(null===d.return||d.return===e)break e;f===d&&(f=null),d=d.return}f===d&&(f=null),d.sibling.return=d.return,d=d.sibling}}break;case 19:gu(t,e),yu(e),4&r&&mu(e);case 21:}}function yu(e){var t=e.flags;if(2&t){try{e:{for(var n=e.return;null!==n;){if(iu(n)){var r=n;break e}n=n.return}throw Error(l(160))}switch(r.tag){case 5:var a=r.stateNode;32&r.flags&&(de(a,""),r.flags&=-33),cu(e,uu(e),a);break;case 3:case 4:var o=r.stateNode.containerInfo;su(e,uu(e),o);break;default:throw Error(l(161))}}catch(i){xs(e,e.return,i)}e.flags&=-3}4096&t&&(e.flags&=-4097)}function bu(e,t,n){Ji=e,Su(e,t,n)}function Su(e,t,n){for(var r=0!==(1&e.mode);null!==Ji;){var a=Ji,l=a.child;if(22===a.tag&&r){var o=null!==a.memoizedState||Gi;if(!o){var i=a.alternate,u=null!==i&&null!==i.memoizedState||Xi;i=Gi;var s=Xi;if(Gi=o,(Xi=u)&&!s)for(Ji=a;null!==Ji;)u=(o=Ji).child,22===o.tag&&null!==o.memoizedState?Cu(a):null!==u?(u.return=o,Ji=u):Cu(a);for(;null!==l;)Ji=l,Su(l,t,n),l=l.sibling;Ji=a,Gi=i,Xi=s}ku(e)}else 0!==(8772&a.subtreeFlags)&&null!==l?(l.return=a,Ji=l):ku(e)}}function ku(e){for(;null!==Ji;){var t=Ji;if(0!==(8772&t.flags)){var n=t.alternate;try{if(0!==(8772&t.flags))switch(t.tag){case 0:case 11:case 15:Xi||au(5,t);break;case 1:var r=t.stateNode;if(4&t.flags&&!Xi)if(null===n)r.componentDidMount();else{var a=t.elementType===t.type?n.memoizedProps:gl(t.type,n.memoizedProps);r.componentDidUpdate(a,n.memoizedState,r.__reactInternalSnapshotBeforeUpdate)}var o=t.updateQueue;null!==o&&Ml(t,o,r);break;case 3:var i=t.updateQueue;if(null!==i){if(n=null,null!==t.child)switch(t.child.tag){case 5:case 1:n=t.child.stateNode}Ml(t,i,n)}break;case 5:var u=t.stateNode;if(null===n&&4&t.flags){n=u;var s=t.memoizedProps;switch(t.type){case"button":case"input":case"select":case"textarea":s.autoFocus&&n.focus();break;case"img":s.src&&(n.src=s.src)}}break;case 6:case 4:case 12:case 19:case 17:case 21:case 22:case 23:case 25:break;case 13:if(null===t.memoizedState){var c=t.alternate;if(null!==c){var f=c.memoizedState;if(null!==f){var d=f.dehydrated;null!==d&&Ht(d)}}}break;default:throw Error(l(163))}Xi||512&t.flags&&lu(t)}catch(p){xs(t,t.return,p)}}if(t===e){Ji=null;break}if(null!==(n=t.sibling)){n.return=t.return,Ji=n;break}Ji=t.return}}function wu(e){for(;null!==Ji;){var t=Ji;if(t===e){Ji=null;break}var n=t.sibling;if(null!==n){n.return=t.return,Ji=n;break}Ji=t.return}}function Cu(e){for(;null!==Ji;){var t=Ji;try{switch(t.tag){case 0:case 11:case 15:var n=t.return;try{au(4,t)}catch(u){xs(t,n,u)}break;case 1:var r=t.stateNode;if("function"===typeof r.componentDidMount){var a=t.return;try{r.componentDidMount()}catch(u){xs(t,a,u)}}var l=t.return;try{lu(t)}catch(u){xs(t,l,u)}break;case 5:var o=t.return;try{lu(t)}catch(u){xs(t,o,u)}}}catch(u){xs(t,t.return,u)}if(t===e){Ji=null;break}var i=t.sibling;if(null!==i){i.return=t.return,Ji=i;break}Ji=t.return}}var Eu,xu=Math.ceil,_u=S.ReactCurrentDispatcher,Pu=S.ReactCurrentOwner,Tu=S.ReactCurrentBatchConfig,Ou=0,Nu=null,Ru=null,zu=0,Lu=0,Au=Ea(0),Iu=0,Du=null,Fu=0,Mu=0,Uu=0,$u=null,ju=null,Hu=0,Wu=1/0,Bu=null,Vu=!1,Ku=null,Qu=null,qu=!1,Yu=null,Gu=0,Xu=0,Zu=null,Ju=-1,es=0;function ts(){return 0!==(6&Ou)?Xe():-1!==Ju?Ju:Ju=Xe()}function ns(e){return 0===(1&e.mode)?1:0!==(2&Ou)&&0!==zu?zu&-zu:null!==ml.transition?(0===es&&(es=mt()),es):0!==(e=bt)?e:e=void 0===(e=window.event)?16:Gt(e.type)}function rs(e,t,n,r){if(50<Xu)throw Xu=0,Zu=null,Error(l(185));vt(e,n,r),0!==(2&Ou)&&e===Nu||(e===Nu&&(0===(2&Ou)&&(Mu|=n),4===Iu&&us(e,zu)),as(e,r),1===n&&0===Ou&&0===(1&t.mode)&&(Wu=Xe()+500,Ua&&Ha()))}function as(e,t){var n=e.callbackNode;!function(e,t){for(var n=e.suspendedLanes,r=e.pingedLanes,a=e.expirationTimes,l=e.pendingLanes;0<l;){var o=31-ot(l),i=1<<o,u=a[o];-1===u?0!==(i&n)&&0===(i&r)||(a[o]=pt(i,t)):u<=t&&(e.expiredLanes|=i),l&=~i}}(e,t);var r=dt(e,e===Nu?zu:0);if(0===r)null!==n&&qe(n),e.callbackNode=null,e.callbackPriority=0;else if(t=r&-r,e.callbackPriority!==t){if(null!=n&&qe(n),1===t)0===e.tag?function(e){Ua=!0,ja(e)}(ss.bind(null,e)):ja(ss.bind(null,e)),oa((function(){0===(6&Ou)&&Ha()})),n=null;else{switch(St(r)){case 1:n=Je;break;case 4:n=et;break;case 16:default:n=tt;break;case 536870912:n=rt}n=Ns(n,ls.bind(null,e))}e.callbackPriority=t,e.callbackNode=n}}function ls(e,t){if(Ju=-1,es=0,0!==(6&Ou))throw Error(l(327));var n=e.callbackNode;if(Cs()&&e.callbackNode!==n)return null;var r=dt(e,e===Nu?zu:0);if(0===r)return null;if(0!==(30&r)||0!==(r&e.expiredLanes)||t)t=vs(e,r);else{t=r;var a=Ou;Ou|=2;var o=ms();for(Nu===e&&zu===t||(Bu=null,Wu=Xe()+500,ps(e,t));;)try{bs();break}catch(u){hs(e,u)}kl(),_u.current=o,Ou=a,null!==Ru?t=0:(Nu=null,zu=0,t=Iu)}if(0!==t){if(2===t&&(0!==(a=ht(e))&&(r=a,t=os(e,a))),1===t)throw n=Du,ps(e,0),us(e,r),as(e,Xe()),n;if(6===t)us(e,r);else{if(a=e.current.alternate,0===(30&r)&&!function(e){for(var t=e;;){if(16384&t.flags){var n=t.updateQueue;if(null!==n&&null!==(n=n.stores))for(var r=0;r<n.length;r++){var a=n[r],l=a.getSnapshot;a=a.value;try{if(!ir(l(),a))return!1}catch(i){return!1}}}if(n=t.child,16384&t.subtreeFlags&&null!==n)n.return=t,t=n;else{if(t===e)break;for(;null===t.sibling;){if(null===t.return||t.return===e)return!0;t=t.return}t.sibling.return=t.return,t=t.sibling}}return!0}(a)&&(2===(t=vs(e,r))&&(0!==(o=ht(e))&&(r=o,t=os(e,o))),1===t))throw n=Du,ps(e,0),us(e,r),as(e,Xe()),n;switch(e.finishedWork=a,e.finishedLanes=r,t){case 0:case 1:throw Error(l(345));case 2:case 5:ws(e,ju,Bu);break;case 3:if(us(e,r),(130023424&r)===r&&10<(t=Hu+500-Xe())){if(0!==dt(e,0))break;if(((a=e.suspendedLanes)&r)!==r){ts(),e.pingedLanes|=e.suspendedLanes&a;break}e.timeoutHandle=ra(ws.bind(null,e,ju,Bu),t);break}ws(e,ju,Bu);break;case 4:if(us(e,r),(4194240&r)===r)break;for(t=e.eventTimes,a=-1;0<r;){var i=31-ot(r);o=1<<i,(i=t[i])>a&&(a=i),r&=~o}if(r=a,10<(r=(120>(r=Xe()-r)?120:480>r?480:1080>r?1080:1920>r?1920:3e3>r?3e3:4320>r?4320:1960*xu(r/1960))-r)){e.timeoutHandle=ra(ws.bind(null,e,ju,Bu),r);break}ws(e,ju,Bu);break;default:throw Error(l(329))}}}return as(e,Xe()),e.callbackNode===n?ls.bind(null,e):null}function os(e,t){var n=$u;return e.current.memoizedState.isDehydrated&&(ps(e,t).flags|=256),2!==(e=vs(e,t))&&(t=ju,ju=n,null!==t&&is(t)),e}function is(e){null===ju?ju=e:ju.push.apply(ju,e)}function us(e,t){for(t&=~Uu,t&=~Mu,e.suspendedLanes|=t,e.pingedLanes&=~t,e=e.expirationTimes;0<t;){var n=31-ot(t),r=1<<n;e[n]=-1,t&=~r}}function ss(e){if(0!==(6&Ou))throw Error(l(327));Cs();var t=dt(e,0);if(0===(1&t))return as(e,Xe()),null;var n=vs(e,t);if(0!==e.tag&&2===n){var r=ht(e);0!==r&&(t=r,n=os(e,r))}if(1===n)throw n=Du,ps(e,0),us(e,t),as(e,Xe()),n;if(6===n)throw Error(l(345));return e.finishedWork=e.current.alternate,e.finishedLanes=t,ws(e,ju,Bu),as(e,Xe()),null}function cs(e,t){var n=Ou;Ou|=1;try{return e(t)}finally{0===(Ou=n)&&(Wu=Xe()+500,Ua&&Ha())}}function fs(e){null!==Yu&&0===Yu.tag&&0===(6&Ou)&&Cs();var t=Ou;Ou|=1;var n=Tu.transition,r=bt;try{if(Tu.transition=null,bt=1,e)return e()}finally{bt=r,Tu.transition=n,0===(6&(Ou=t))&&Ha()}}function ds(){Lu=Au.current,xa(Au)}function ps(e,t){e.finishedWork=null,e.finishedLanes=0;var n=e.timeoutHandle;if(-1!==n&&(e.timeoutHandle=-1,aa(n)),null!==Ru)for(n=Ru.return;null!==n;){var r=n;switch(tl(r),r.tag){case 1:null!==(r=r.type.childContextTypes)&&void 0!==r&&La();break;case 3:ao(),xa(Oa),xa(Ta),co();break;case 5:oo(r);break;case 4:ao();break;case 13:case 19:xa(io);break;case 10:wl(r.type._context);break;case 22:case 23:ds()}n=n.return}if(Nu=e,Ru=e=As(e.current,null),zu=Lu=t,Iu=0,Du=null,Uu=Mu=Fu=0,ju=$u=null,null!==_l){for(t=0;t<_l.length;t++)if(null!==(r=(n=_l[t]).interleaved)){n.interleaved=null;var a=r.next,l=n.pending;if(null!==l){var o=l.next;l.next=a,r.next=o}n.pending=r}_l=null}return e}function hs(e,t){for(;;){var n=Ru;try{if(kl(),fo.current=oi,yo){for(var r=mo.memoizedState;null!==r;){var a=r.queue;null!==a&&(a.pending=null),r=r.next}yo=!1}if(ho=0,vo=go=mo=null,bo=!1,So=0,Pu.current=null,null===n||null===n.return){Iu=1,Du=t,Ru=null;break}e:{var o=e,i=n.return,u=n,s=t;if(t=zu,u.flags|=32768,null!==s&&"object"===typeof s&&"function"===typeof s.then){var c=s,f=u,d=f.tag;if(0===(1&f.mode)&&(0===d||11===d||15===d)){var p=f.alternate;p?(f.updateQueue=p.updateQueue,f.memoizedState=p.memoizedState,f.lanes=p.lanes):(f.updateQueue=null,f.memoizedState=null)}var h=vi(i);if(null!==h){h.flags&=-257,yi(h,i,u,0,t),1&h.mode&&gi(o,c,t),s=c;var m=(t=h).updateQueue;if(null===m){var g=new Set;g.add(s),t.updateQueue=g}else m.add(s);break e}if(0===(1&t)){gi(o,c,t),gs();break e}s=Error(l(426))}else if(al&&1&u.mode){var v=vi(i);if(null!==v){0===(65536&v.flags)&&(v.flags|=256),yi(v,i,u,0,t),hl(ci(s,u));break e}}o=s=ci(s,u),4!==Iu&&(Iu=2),null===$u?$u=[o]:$u.push(o),o=i;do{switch(o.tag){case 3:o.flags|=65536,t&=-t,o.lanes|=t,Dl(o,hi(0,s,t));break e;case 1:u=s;var y=o.type,b=o.stateNode;if(0===(128&o.flags)&&("function"===typeof y.getDerivedStateFromError||null!==b&&"function"===typeof b.componentDidCatch&&(null===Qu||!Qu.has(b)))){o.flags|=65536,t&=-t,o.lanes|=t,Dl(o,mi(o,u,t));break e}}o=o.return}while(null!==o)}ks(n)}catch(S){t=S,Ru===n&&null!==n&&(Ru=n=n.return);continue}break}}function ms(){var e=_u.current;return _u.current=oi,null===e?oi:e}function gs(){0!==Iu&&3!==Iu&&2!==Iu||(Iu=4),null===Nu||0===(268435455&Fu)&&0===(268435455&Mu)||us(Nu,zu)}function vs(e,t){var n=Ou;Ou|=2;var r=ms();for(Nu===e&&zu===t||(Bu=null,ps(e,t));;)try{ys();break}catch(a){hs(e,a)}if(kl(),Ou=n,_u.current=r,null!==Ru)throw Error(l(261));return Nu=null,zu=0,Iu}function ys(){for(;null!==Ru;)Ss(Ru)}function bs(){for(;null!==Ru&&!Ye();)Ss(Ru)}function Ss(e){var t=Eu(e.alternate,e,Lu);e.memoizedProps=e.pendingProps,null===t?ks(e):Ru=t,Pu.current=null}function ks(e){var t=e;do{var n=t.alternate;if(e=t.return,0===(32768&t.flags)){if(null!==(n=qi(n,t,Lu)))return void(Ru=n)}else{if(null!==(n=Yi(n,t)))return n.flags&=32767,void(Ru=n);if(null===e)return Iu=6,void(Ru=null);e.flags|=32768,e.subtreeFlags=0,e.deletions=null}if(null!==(t=t.sibling))return void(Ru=t);Ru=t=e}while(null!==t);0===Iu&&(Iu=5)}function ws(e,t,n){var r=bt,a=Tu.transition;try{Tu.transition=null,bt=1,function(e,t,n,r){do{Cs()}while(null!==Yu);if(0!==(6&Ou))throw Error(l(327));n=e.finishedWork;var a=e.finishedLanes;if(null===n)return null;if(e.finishedWork=null,e.finishedLanes=0,n===e.current)throw Error(l(177));e.callbackNode=null,e.callbackPriority=0;var o=n.lanes|n.childLanes;if(function(e,t){var n=e.pendingLanes&~t;e.pendingLanes=t,e.suspendedLanes=0,e.pingedLanes=0,e.expiredLanes&=t,e.mutableReadLanes&=t,e.entangledLanes&=t,t=e.entanglements;var r=e.eventTimes;for(e=e.expirationTimes;0<n;){var a=31-ot(n),l=1<<a;t[a]=0,r[a]=-1,e[a]=-1,n&=~l}}(e,o),e===Nu&&(Ru=Nu=null,zu=0),0===(2064&n.subtreeFlags)&&0===(2064&n.flags)||qu||(qu=!0,Ns(tt,(function(){return Cs(),null}))),o=0!==(15990&n.flags),0!==(15990&n.subtreeFlags)||o){o=Tu.transition,Tu.transition=null;var i=bt;bt=1;var u=Ou;Ou|=4,Pu.current=null,function(e,t){if(ea=Bt,pr(e=dr())){if("selectionStart"in e)var n={start:e.selectionStart,end:e.selectionEnd};else e:{var r=(n=(n=e.ownerDocument)&&n.defaultView||window).getSelection&&n.getSelection();if(r&&0!==r.rangeCount){n=r.anchorNode;var a=r.anchorOffset,o=r.focusNode;r=r.focusOffset;try{n.nodeType,o.nodeType}catch(k){n=null;break e}var i=0,u=-1,s=-1,c=0,f=0,d=e,p=null;t:for(;;){for(var h;d!==n||0!==a&&3!==d.nodeType||(u=i+a),d!==o||0!==r&&3!==d.nodeType||(s=i+r),3===d.nodeType&&(i+=d.nodeValue.length),null!==(h=d.firstChild);)p=d,d=h;for(;;){if(d===e)break t;if(p===n&&++c===a&&(u=i),p===o&&++f===r&&(s=i),null!==(h=d.nextSibling))break;p=(d=p).parentNode}d=h}n=-1===u||-1===s?null:{start:u,end:s}}else n=null}n=n||{start:0,end:0}}else n=null;for(ta={focusedElem:e,selectionRange:n},Bt=!1,Ji=t;null!==Ji;)if(e=(t=Ji).child,0!==(1028&t.subtreeFlags)&&null!==e)e.return=t,Ji=e;else for(;null!==Ji;){t=Ji;try{var m=t.alternate;if(0!==(1024&t.flags))switch(t.tag){case 0:case 11:case 15:case 5:case 6:case 4:case 17:break;case 1:if(null!==m){var g=m.memoizedProps,v=m.memoizedState,y=t.stateNode,b=y.getSnapshotBeforeUpdate(t.elementType===t.type?g:gl(t.type,g),v);y.__reactInternalSnapshotBeforeUpdate=b}break;case 3:var S=t.stateNode.containerInfo;1===S.nodeType?S.textContent="":9===S.nodeType&&S.documentElement&&S.removeChild(S.documentElement);break;default:throw Error(l(163))}}catch(k){xs(t,t.return,k)}if(null!==(e=t.sibling)){e.return=t.return,Ji=e;break}Ji=t.return}m=nu,nu=!1}(e,n),vu(n,e),hr(ta),Bt=!!ea,ta=ea=null,e.current=n,bu(n,e,a),Ge(),Ou=u,bt=i,Tu.transition=o}else e.current=n;if(qu&&(qu=!1,Yu=e,Gu=a),o=e.pendingLanes,0===o&&(Qu=null),function(e){if(lt&&"function"===typeof lt.onCommitFiberRoot)try{lt.onCommitFiberRoot(at,e,void 0,128===(128&e.current.flags))}catch(t){}}(n.stateNode),as(e,Xe()),null!==t)for(r=e.onRecoverableError,n=0;n<t.length;n++)a=t[n],r(a.value,{componentStack:a.stack,digest:a.digest});if(Vu)throw Vu=!1,e=Ku,Ku=null,e;0!==(1&Gu)&&0!==e.tag&&Cs(),o=e.pendingLanes,0!==(1&o)?e===Zu?Xu++:(Xu=0,Zu=e):Xu=0,Ha()}(e,t,n,r)}finally{Tu.transition=a,bt=r}return null}function Cs(){if(null!==Yu){var e=St(Gu),t=Tu.transition,n=bt;try{if(Tu.transition=null,bt=16>e?16:e,null===Yu)var r=!1;else{if(e=Yu,Yu=null,Gu=0,0!==(6&Ou))throw Error(l(331));var a=Ou;for(Ou|=4,Ji=e.current;null!==Ji;){var o=Ji,i=o.child;if(0!==(16&Ji.flags)){var u=o.deletions;if(null!==u){for(var s=0;s<u.length;s++){var c=u[s];for(Ji=c;null!==Ji;){var f=Ji;switch(f.tag){case 0:case 11:case 15:ru(8,f,o)}var d=f.child;if(null!==d)d.return=f,Ji=d;else for(;null!==Ji;){var p=(f=Ji).sibling,h=f.return;if(ou(f),f===c){Ji=null;break}if(null!==p){p.return=h,Ji=p;break}Ji=h}}}var m=o.alternate;if(null!==m){var g=m.child;if(null!==g){m.child=null;do{var v=g.sibling;g.sibling=null,g=v}while(null!==g)}}Ji=o}}if(0!==(2064&o.subtreeFlags)&&null!==i)i.return=o,Ji=i;else e:for(;null!==Ji;){if(0!==(2048&(o=Ji).flags))switch(o.tag){case 0:case 11:case 15:ru(9,o,o.return)}var y=o.sibling;if(null!==y){y.return=o.return,Ji=y;break e}Ji=o.return}}var b=e.current;for(Ji=b;null!==Ji;){var S=(i=Ji).child;if(0!==(2064&i.subtreeFlags)&&null!==S)S.return=i,Ji=S;else e:for(i=b;null!==Ji;){if(0!==(2048&(u=Ji).flags))try{switch(u.tag){case 0:case 11:case 15:au(9,u)}}catch(w){xs(u,u.return,w)}if(u===i){Ji=null;break e}var k=u.sibling;if(null!==k){k.return=u.return,Ji=k;break e}Ji=u.return}}if(Ou=a,Ha(),lt&&"function"===typeof lt.onPostCommitFiberRoot)try{lt.onPostCommitFiberRoot(at,e)}catch(w){}r=!0}return r}finally{bt=n,Tu.transition=t}}return!1}function Es(e,t,n){e=Al(e,t=hi(0,t=ci(n,t),1),1),t=ts(),null!==e&&(vt(e,1,t),as(e,t))}function xs(e,t,n){if(3===e.tag)Es(e,e,n);else for(;null!==t;){if(3===t.tag){Es(t,e,n);break}if(1===t.tag){var r=t.stateNode;if("function"===typeof t.type.getDerivedStateFromError||"function"===typeof r.componentDidCatch&&(null===Qu||!Qu.has(r))){t=Al(t,e=mi(t,e=ci(n,e),1),1),e=ts(),null!==t&&(vt(t,1,e),as(t,e));break}}t=t.return}}function _s(e,t,n){var r=e.pingCache;null!==r&&r.delete(t),t=ts(),e.pingedLanes|=e.suspendedLanes&n,Nu===e&&(zu&n)===n&&(4===Iu||3===Iu&&(130023424&zu)===zu&&500>Xe()-Hu?ps(e,0):Uu|=n),as(e,t)}function Ps(e,t){0===t&&(0===(1&e.mode)?t=1:(t=ct,0===(130023424&(ct<<=1))&&(ct=4194304)));var n=ts();null!==(e=Ol(e,t))&&(vt(e,t,n),as(e,n))}function Ts(e){var t=e.memoizedState,n=0;null!==t&&(n=t.retryLane),Ps(e,n)}function Os(e,t){var n=0;switch(e.tag){case 13:var r=e.stateNode,a=e.memoizedState;null!==a&&(n=a.retryLane);break;case 19:r=e.stateNode;break;default:throw Error(l(314))}null!==r&&r.delete(t),Ps(e,n)}function Ns(e,t){return Qe(e,t)}function Rs(e,t,n,r){this.tag=e,this.key=n,this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null,this.index=0,this.ref=null,this.pendingProps=t,this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null,this.mode=r,this.subtreeFlags=this.flags=0,this.deletions=null,this.childLanes=this.lanes=0,this.alternate=null}function zs(e,t,n,r){return new Rs(e,t,n,r)}function Ls(e){return!(!(e=e.prototype)||!e.isReactComponent)}function As(e,t){var n=e.alternate;return null===n?((n=zs(e.tag,t,e.key,e.mode)).elementType=e.elementType,n.type=e.type,n.stateNode=e.stateNode,n.alternate=e,e.alternate=n):(n.pendingProps=t,n.type=e.type,n.flags=0,n.subtreeFlags=0,n.deletions=null),n.flags=14680064&e.flags,n.childLanes=e.childLanes,n.lanes=e.lanes,n.child=e.child,n.memoizedProps=e.memoizedProps,n.memoizedState=e.memoizedState,n.updateQueue=e.updateQueue,t=e.dependencies,n.dependencies=null===t?null:{lanes:t.lanes,firstContext:t.firstContext},n.sibling=e.sibling,n.index=e.index,n.ref=e.ref,n}function Is(e,t,n,r,a,o){var i=2;if(r=e,"function"===typeof e)Ls(e)&&(i=1);else if("string"===typeof e)i=5;else e:switch(e){case C:return Ds(n.children,a,o,t);case E:i=8,a|=8;break;case x:return(e=zs(12,n,t,2|a)).elementType=x,e.lanes=o,e;case O:return(e=zs(13,n,t,a)).elementType=O,e.lanes=o,e;case N:return(e=zs(19,n,t,a)).elementType=N,e.lanes=o,e;case L:return Fs(n,a,o,t);default:if("object"===typeof e&&null!==e)switch(e.$$typeof){case _:i=10;break e;case P:i=9;break e;case T:i=11;break e;case R:i=14;break e;case z:i=16,r=null;break e}throw Error(l(130,null==e?e:typeof e,""))}return(t=zs(i,n,t,a)).elementType=e,t.type=r,t.lanes=o,t}function Ds(e,t,n,r){return(e=zs(7,e,r,t)).lanes=n,e}function Fs(e,t,n,r){return(e=zs(22,e,r,t)).elementType=L,e.lanes=n,e.stateNode={isHidden:!1},e}function Ms(e,t,n){return(e=zs(6,e,null,t)).lanes=n,e}function Us(e,t,n){return(t=zs(4,null!==e.children?e.children:[],e.key,t)).lanes=n,t.stateNode={containerInfo:e.containerInfo,pendingChildren:null,implementation:e.implementation},t}function $s(e,t,n,r,a){this.tag=t,this.containerInfo=e,this.finishedWork=this.pingCache=this.current=this.pendingChildren=null,this.timeoutHandle=-1,this.callbackNode=this.pendingContext=this.context=null,this.callbackPriority=0,this.eventTimes=gt(0),this.expirationTimes=gt(-1),this.entangledLanes=this.finishedLanes=this.mutableReadLanes=this.expiredLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0,this.entanglements=gt(0),this.identifierPrefix=r,this.onRecoverableError=a,this.mutableSourceEagerHydrationData=null}function js(e,t,n,r,a,l,o,i,u){return e=new $s(e,t,n,i,u),1===t?(t=1,!0===l&&(t|=8)):t=0,l=zs(3,null,null,t),e.current=l,l.stateNode=e,l.memoizedState={element:r,isDehydrated:n,cache:null,transitions:null,pendingSuspenseBoundaries:null},Rl(l),e}function Hs(e){if(!e)return Pa;e:{if(He(e=e._reactInternals)!==e||1!==e.tag)throw Error(l(170));var t=e;do{switch(t.tag){case 3:t=t.stateNode.context;break e;case 1:if(za(t.type)){t=t.stateNode.__reactInternalMemoizedMergedChildContext;break e}}t=t.return}while(null!==t);throw Error(l(171))}if(1===e.tag){var n=e.type;if(za(n))return Ia(e,n,t)}return t}function Ws(e,t,n,r,a,l,o,i,u){return(e=js(n,r,!0,e,0,l,0,i,u)).context=Hs(null),n=e.current,(l=Ll(r=ts(),a=ns(n))).callback=void 0!==t&&null!==t?t:null,Al(n,l,a),e.current.lanes=a,vt(e,a,r),as(e,r),e}function Bs(e,t,n,r){var a=t.current,l=ts(),o=ns(a);return n=Hs(n),null===t.context?t.context=n:t.pendingContext=n,(t=Ll(l,o)).payload={element:e},null!==(r=void 0===r?null:r)&&(t.callback=r),null!==(e=Al(a,t,o))&&(rs(e,a,o,l),Il(e,a,o)),o}function Vs(e){return(e=e.current).child?(e.child.tag,e.child.stateNode):null}function Ks(e,t){if(null!==(e=e.memoizedState)&&null!==e.dehydrated){var n=e.retryLane;e.retryLane=0!==n&&n<t?n:t}}function Qs(e,t){Ks(e,t),(e=e.alternate)&&Ks(e,t)}Eu=function(e,t,n){if(null!==e)if(e.memoizedProps!==t.pendingProps||Oa.current)Si=!0;else{if(0===(e.lanes&n)&&0===(128&t.flags))return Si=!1,function(e,t,n){switch(t.tag){case 3:Ni(t),pl();break;case 5:lo(t);break;case 1:za(t.type)&&Da(t);break;case 4:ro(t,t.stateNode.containerInfo);break;case 10:var r=t.type._context,a=t.memoizedProps.value;_a(vl,r._currentValue),r._currentValue=a;break;case 13:if(null!==(r=t.memoizedState))return null!==r.dehydrated?(_a(io,1&io.current),t.flags|=128,null):0!==(n&t.child.childLanes)?Mi(e,t,n):(_a(io,1&io.current),null!==(e=Vi(e,t,n))?e.sibling:null);_a(io,1&io.current);break;case 19:if(r=0!==(n&t.childLanes),0!==(128&e.flags)){if(r)return Wi(e,t,n);t.flags|=128}if(null!==(a=t.memoizedState)&&(a.rendering=null,a.tail=null,a.lastEffect=null),_a(io,io.current),r)break;return null;case 22:case 23:return t.lanes=0,xi(e,t,n)}return Vi(e,t,n)}(e,t,n);Si=0!==(131072&e.flags)}else Si=!1,al&&0!==(1048576&t.flags)&&Ja(t,Ka,t.index);switch(t.lanes=0,t.tag){case 2:var r=t.type;Bi(e,t),e=t.pendingProps;var a=Ra(t,Ta.current);El(t,n),a=Eo(null,t,r,e,a,n);var o=xo();return t.flags|=1,"object"===typeof a&&null!==a&&"function"===typeof a.render&&void 0===a.$$typeof?(t.tag=1,t.memoizedState=null,t.updateQueue=null,za(r)?(o=!0,Da(t)):o=!1,t.memoizedState=null!==a.state&&void 0!==a.state?a.state:null,Rl(t),a.updater=jl,t.stateNode=a,a._reactInternals=t,Vl(t,r,e,n),t=Oi(null,t,r,!0,o,n)):(t.tag=0,al&&o&&el(t),ki(null,t,a,n),t=t.child),t;case 16:r=t.elementType;e:{switch(Bi(e,t),e=t.pendingProps,r=(a=r._init)(r._payload),t.type=r,a=t.tag=function(e){if("function"===typeof e)return Ls(e)?1:0;if(void 0!==e&&null!==e){if((e=e.$$typeof)===T)return 11;if(e===R)return 14}return 2}(r),e=gl(r,e),a){case 0:t=Pi(null,t,r,e,n);break e;case 1:t=Ti(null,t,r,e,n);break e;case 11:t=wi(null,t,r,e,n);break e;case 14:t=Ci(null,t,r,gl(r.type,e),n);break e}throw Error(l(306,r,""))}return t;case 0:return r=t.type,a=t.pendingProps,Pi(e,t,r,a=t.elementType===r?a:gl(r,a),n);case 1:return r=t.type,a=t.pendingProps,Ti(e,t,r,a=t.elementType===r?a:gl(r,a),n);case 3:e:{if(Ni(t),null===e)throw Error(l(387));r=t.pendingProps,a=(o=t.memoizedState).element,zl(e,t),Fl(t,r,null,n);var i=t.memoizedState;if(r=i.element,o.isDehydrated){if(o={element:r,isDehydrated:!1,cache:i.cache,pendingSuspenseBoundaries:i.pendingSuspenseBoundaries,transitions:i.transitions},t.updateQueue.baseState=o,t.memoizedState=o,256&t.flags){t=Ri(e,t,r,n,a=ci(Error(l(423)),t));break e}if(r!==a){t=Ri(e,t,r,n,a=ci(Error(l(424)),t));break e}for(rl=sa(t.stateNode.containerInfo.firstChild),nl=t,al=!0,ll=null,n=Xl(t,null,r,n),t.child=n;n;)n.flags=-3&n.flags|4096,n=n.sibling}else{if(pl(),r===a){t=Vi(e,t,n);break e}ki(e,t,r,n)}t=t.child}return t;case 5:return lo(t),null===e&&sl(t),r=t.type,a=t.pendingProps,o=null!==e?e.memoizedProps:null,i=a.children,na(r,a)?i=null:null!==o&&na(r,o)&&(t.flags|=32),_i(e,t),ki(e,t,i,n),t.child;case 6:return null===e&&sl(t),null;case 13:return Mi(e,t,n);case 4:return ro(t,t.stateNode.containerInfo),r=t.pendingProps,null===e?t.child=Gl(t,null,r,n):ki(e,t,r,n),t.child;case 11:return r=t.type,a=t.pendingProps,wi(e,t,r,a=t.elementType===r?a:gl(r,a),n);case 7:return ki(e,t,t.pendingProps,n),t.child;case 8:case 12:return ki(e,t,t.pendingProps.children,n),t.child;case 10:e:{if(r=t.type._context,a=t.pendingProps,o=t.memoizedProps,i=a.value,_a(vl,r._currentValue),r._currentValue=i,null!==o)if(ir(o.value,i)){if(o.children===a.children&&!Oa.current){t=Vi(e,t,n);break e}}else for(null!==(o=t.child)&&(o.return=t);null!==o;){var u=o.dependencies;if(null!==u){i=o.child;for(var s=u.firstContext;null!==s;){if(s.context===r){if(1===o.tag){(s=Ll(-1,n&-n)).tag=2;var c=o.updateQueue;if(null!==c){var f=(c=c.shared).pending;null===f?s.next=s:(s.next=f.next,f.next=s),c.pending=s}}o.lanes|=n,null!==(s=o.alternate)&&(s.lanes|=n),Cl(o.return,n,t),u.lanes|=n;break}s=s.next}}else if(10===o.tag)i=o.type===t.type?null:o.child;else if(18===o.tag){if(null===(i=o.return))throw Error(l(341));i.lanes|=n,null!==(u=i.alternate)&&(u.lanes|=n),Cl(i,n,t),i=o.sibling}else i=o.child;if(null!==i)i.return=o;else for(i=o;null!==i;){if(i===t){i=null;break}if(null!==(o=i.sibling)){o.return=i.return,i=o;break}i=i.return}o=i}ki(e,t,a.children,n),t=t.child}return t;case 9:return a=t.type,r=t.pendingProps.children,El(t,n),r=r(a=xl(a)),t.flags|=1,ki(e,t,r,n),t.child;case 14:return a=gl(r=t.type,t.pendingProps),Ci(e,t,r,a=gl(r.type,a),n);case 15:return Ei(e,t,t.type,t.pendingProps,n);case 17:return r=t.type,a=t.pendingProps,a=t.elementType===r?a:gl(r,a),Bi(e,t),t.tag=1,za(r)?(e=!0,Da(t)):e=!1,El(t,n),Wl(t,r,a),Vl(t,r,a,n),Oi(null,t,r,!0,e,n);case 19:return Wi(e,t,n);case 22:return xi(e,t,n)}throw Error(l(156,t.tag))};var qs="function"===typeof reportError?reportError:function(e){console.error(e)};function Ys(e){this._internalRoot=e}function Gs(e){this._internalRoot=e}function Xs(e){return!(!e||1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType)}function Zs(e){return!(!e||1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType&&(8!==e.nodeType||" react-mount-point-unstable "!==e.nodeValue))}function Js(){}function ec(e,t,n,r,a){var l=n._reactRootContainer;if(l){var o=l;if("function"===typeof a){var i=a;a=function(){var e=Vs(o);i.call(e)}}Bs(t,o,e,a)}else o=function(e,t,n,r,a){if(a){if("function"===typeof r){var l=r;r=function(){var e=Vs(o);l.call(e)}}var o=Ws(t,r,e,0,null,!1,0,"",Js);return e._reactRootContainer=o,e[ha]=o.current,Hr(8===e.nodeType?e.parentNode:e),fs(),o}for(;a=e.lastChild;)e.removeChild(a);if("function"===typeof r){var i=r;r=function(){var e=Vs(u);i.call(e)}}var u=js(e,0,!1,null,0,!1,0,"",Js);return e._reactRootContainer=u,e[ha]=u.current,Hr(8===e.nodeType?e.parentNode:e),fs((function(){Bs(t,u,n,r)})),u}(n,t,e,a,r);return Vs(o)}Gs.prototype.render=Ys.prototype.render=function(e){var t=this._internalRoot;if(null===t)throw Error(l(409));Bs(e,t,null,null)},Gs.prototype.unmount=Ys.prototype.unmount=function(){var e=this._internalRoot;if(null!==e){this._internalRoot=null;var t=e.containerInfo;fs((function(){Bs(null,e,null,null)})),t[ha]=null}},Gs.prototype.unstable_scheduleHydration=function(e){if(e){var t=Et();e={blockedOn:null,target:e,priority:t};for(var n=0;n<Lt.length&&0!==t&&t<Lt[n].priority;n++);Lt.splice(n,0,e),0===n&&Ft(e)}},kt=function(e){switch(e.tag){case 3:var t=e.stateNode;if(t.current.memoizedState.isDehydrated){var n=ft(t.pendingLanes);0!==n&&(yt(t,1|n),as(t,Xe()),0===(6&Ou)&&(Wu=Xe()+500,Ha()))}break;case 13:fs((function(){var t=Ol(e,1);if(null!==t){var n=ts();rs(t,e,1,n)}})),Qs(e,1)}},wt=function(e){if(13===e.tag){var t=Ol(e,134217728);if(null!==t)rs(t,e,134217728,ts());Qs(e,134217728)}},Ct=function(e){if(13===e.tag){var t=ns(e),n=Ol(e,t);if(null!==n)rs(n,e,t,ts());Qs(e,t)}},Et=function(){return bt},xt=function(e,t){var n=bt;try{return bt=e,t()}finally{bt=n}},we=function(e,t,n){switch(t){case"input":if(Z(e,n),t=n.name,"radio"===n.type&&null!=t){for(n=e;n.parentNode;)n=n.parentNode;for(n=n.querySelectorAll("input[name="+JSON.stringify(""+t)+'][type="radio"]'),t=0;t<n.length;t++){var r=n[t];if(r!==e&&r.form===e.form){var a=ka(r);if(!a)throw Error(l(90));Q(r),Z(r,a)}}}break;case"textarea":le(e,n);break;case"select":null!=(t=n.value)&&ne(e,!!n.multiple,t,!1)}},Te=cs,Oe=fs;var tc={usingClientEntryPoint:!1,Events:[ba,Sa,ka,_e,Pe,cs]},nc={findFiberByHostInstance:ya,bundleType:0,version:"18.2.0",rendererPackageName:"react-dom"},rc={bundleType:nc.bundleType,version:nc.version,rendererPackageName:nc.rendererPackageName,rendererConfig:nc.rendererConfig,overrideHookState:null,overrideHookStateDeletePath:null,overrideHookStateRenamePath:null,overrideProps:null,overridePropsDeletePath:null,overridePropsRenamePath:null,setErrorHandler:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:S.ReactCurrentDispatcher,findHostInstanceByFiber:function(e){return null===(e=Ve(e))?null:e.stateNode},findFiberByHostInstance:nc.findFiberByHostInstance||function(){return null},findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null,reconcilerVersion:"18.2.0-next-9e3b772b8-20220608"};if("undefined"!==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__){var ac=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!ac.isDisabled&&ac.supportsFiber)try{at=ac.inject(rc),lt=ac}catch(ce){}}t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=tc,t.createPortal=function(e,t){var n=2<arguments.length&&void 0!==arguments[2]?arguments[2]:null;if(!Xs(t))throw Error(l(200));return function(e,t,n){var r=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return{$$typeof:w,key:null==r?null:""+r,children:e,containerInfo:t,implementation:n}}(e,t,null,n)},t.createRoot=function(e,t){if(!Xs(e))throw Error(l(299));var n=!1,r="",a=qs;return null!==t&&void 0!==t&&(!0===t.unstable_strictMode&&(n=!0),void 0!==t.identifierPrefix&&(r=t.identifierPrefix),void 0!==t.onRecoverableError&&(a=t.onRecoverableError)),t=js(e,1,!1,null,0,n,0,r,a),e[ha]=t.current,Hr(8===e.nodeType?e.parentNode:e),new Ys(t)},t.findDOMNode=function(e){if(null==e)return null;if(1===e.nodeType)return e;var t=e._reactInternals;if(void 0===t){if("function"===typeof e.render)throw Error(l(188));throw e=Object.keys(e).join(","),Error(l(268,e))}return e=null===(e=Ve(t))?null:e.stateNode},t.flushSync=function(e){return fs(e)},t.hydrate=function(e,t,n){if(!Zs(t))throw Error(l(200));return ec(null,e,t,!0,n)},t.hydrateRoot=function(e,t,n){if(!Xs(e))throw Error(l(405));var r=null!=n&&n.hydratedSources||null,a=!1,o="",i=qs;if(null!==n&&void 0!==n&&(!0===n.unstable_strictMode&&(a=!0),void 0!==n.identifierPrefix&&(o=n.identifierPrefix),void 0!==n.onRecoverableError&&(i=n.onRecoverableError)),t=Ws(t,null,e,1,null!=n?n:null,a,0,o,i),e[ha]=t.current,Hr(e),r)for(e=0;e<r.length;e++)a=(a=(n=r[e])._getVersion)(n._source),null==t.mutableSourceEagerHydrationData?t.mutableSourceEagerHydrationData=[n,a]:t.mutableSourceEagerHydrationData.push(n,a);return new Gs(t)},t.render=function(e,t,n){if(!Zs(t))throw Error(l(200));return ec(null,e,t,!1,n)},t.unmountComponentAtNode=function(e){if(!Zs(e))throw Error(l(40));return!!e._reactRootContainer&&(fs((function(){ec(null,null,e,!1,(function(){e._reactRootContainer=null,e[ha]=null}))})),!0)},t.unstable_batchedUpdates=cs,t.unstable_renderSubtreeIntoContainer=function(e,t,n,r){if(!Zs(n))throw Error(l(200));if(null==e||void 0===e._reactInternals)throw Error(l(38));return ec(e,t,n,!1,r)},t.version="18.2.0-next-9e3b772b8-20220608"},250:(e,t,n)=>{"use strict";var r=n(164);t.createRoot=r.createRoot,t.hydrateRoot=r.hydrateRoot},164:(e,t,n)=>{"use strict";!function e(){if("undefined"!==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__&&"function"===typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE)try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(t){console.error(t)}}(),e.exports=n(463)},372:(e,t)=>{"use strict";var n,r=Symbol.for("react.element"),a=Symbol.for("react.portal"),l=Symbol.for("react.fragment"),o=Symbol.for("react.strict_mode"),i=Symbol.for("react.profiler"),u=Symbol.for("react.provider"),s=Symbol.for("react.context"),c=Symbol.for("react.server_context"),f=Symbol.for("react.forward_ref"),d=Symbol.for("react.suspense"),p=Symbol.for("react.suspense_list"),h=Symbol.for("react.memo"),m=Symbol.for("react.lazy"),g=Symbol.for("react.offscreen");function v(e){if("object"===typeof e&&null!==e){var t=e.$$typeof;switch(t){case r:switch(e=e.type){case l:case i:case o:case d:case p:return e;default:switch(e=e&&e.$$typeof){case c:case s:case f:case m:case h:case u:return e;default:return t}}case a:return t}}}n=Symbol.for("react.module.reference"),t.isValidElementType=function(e){return"string"===typeof e||"function"===typeof e||e===l||e===i||e===o||e===d||e===p||e===g||"object"===typeof e&&null!==e&&(e.$$typeof===m||e.$$typeof===h||e.$$typeof===u||e.$$typeof===s||e.$$typeof===f||e.$$typeof===n||void 0!==e.getModuleId)},t.typeOf=v},441:(e,t,n)=>{"use strict";e.exports=n(372)},374:(e,t,n)=>{"use strict";var r=n(791),a=Symbol.for("react.element"),l=Symbol.for("react.fragment"),o=Object.prototype.hasOwnProperty,i=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner,u={key:!0,ref:!0,__self:!0,__source:!0};function s(e,t,n){var r,l={},s=null,c=null;for(r in void 0!==n&&(s=""+n),void 0!==t.key&&(s=""+t.key),void 0!==t.ref&&(c=t.ref),t)o.call(t,r)&&!u.hasOwnProperty(r)&&(l[r]=t[r]);if(e&&e.defaultProps)for(r in t=e.defaultProps)void 0===l[r]&&(l[r]=t[r]);return{$$typeof:a,type:e,key:s,ref:c,props:l,_owner:i.current}}t.jsx=s},117:(e,t)=>{"use strict";var n=Symbol.for("react.element"),r=Symbol.for("react.portal"),a=Symbol.for("react.fragment"),l=Symbol.for("react.strict_mode"),o=Symbol.for("react.profiler"),i=Symbol.for("react.provider"),u=Symbol.for("react.context"),s=Symbol.for("react.forward_ref"),c=Symbol.for("react.suspense"),f=Symbol.for("react.memo"),d=Symbol.for("react.lazy"),p=Symbol.iterator;var h={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},m=Object.assign,g={};function v(e,t,n){this.props=e,this.context=t,this.refs=g,this.updater=n||h}function y(){}function b(e,t,n){this.props=e,this.context=t,this.refs=g,this.updater=n||h}v.prototype.isReactComponent={},v.prototype.setState=function(e,t){if("object"!==typeof e&&"function"!==typeof e&&null!=e)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,e,t,"setState")},v.prototype.forceUpdate=function(e){this.updater.enqueueForceUpdate(this,e,"forceUpdate")},y.prototype=v.prototype;var S=b.prototype=new y;S.constructor=b,m(S,v.prototype),S.isPureReactComponent=!0;var k=Array.isArray,w=Object.prototype.hasOwnProperty,C={current:null},E={key:!0,ref:!0,__self:!0,__source:!0};function x(e,t,r){var a,l={},o=null,i=null;if(null!=t)for(a in void 0!==t.ref&&(i=t.ref),void 0!==t.key&&(o=""+t.key),t)w.call(t,a)&&!E.hasOwnProperty(a)&&(l[a]=t[a]);var u=arguments.length-2;if(1===u)l.children=r;else if(1<u){for(var s=Array(u),c=0;c<u;c++)s[c]=arguments[c+2];l.children=s}if(e&&e.defaultProps)for(a in u=e.defaultProps)void 0===l[a]&&(l[a]=u[a]);return{$$typeof:n,type:e,key:o,ref:i,props:l,_owner:C.current}}function _(e){return"object"===typeof e&&null!==e&&e.$$typeof===n}var P=/\/+/g;function T(e,t){return"object"===typeof e&&null!==e&&null!=e.key?function(e){var t={"=":"=0",":":"=2"};return"$"+e.replace(/[=:]/g,(function(e){return t[e]}))}(""+e.key):t.toString(36)}function O(e,t,a,l,o){var i=typeof e;"undefined"!==i&&"boolean"!==i||(e=null);var u=!1;if(null===e)u=!0;else switch(i){case"string":case"number":u=!0;break;case"object":switch(e.$$typeof){case n:case r:u=!0}}if(u)return o=o(u=e),e=""===l?"."+T(u,0):l,k(o)?(a="",null!=e&&(a=e.replace(P,"$&/")+"/"),O(o,t,a,"",(function(e){return e}))):null!=o&&(_(o)&&(o=function(e,t){return{$$typeof:n,type:e.type,key:t,ref:e.ref,props:e.props,_owner:e._owner}}(o,a+(!o.key||u&&u.key===o.key?"":(""+o.key).replace(P,"$&/")+"/")+e)),t.push(o)),1;if(u=0,l=""===l?".":l+":",k(e))for(var s=0;s<e.length;s++){var c=l+T(i=e[s],s);u+=O(i,t,a,c,o)}else if(c=function(e){return null===e||"object"!==typeof e?null:"function"===typeof(e=p&&e[p]||e["@@iterator"])?e:null}(e),"function"===typeof c)for(e=c.call(e),s=0;!(i=e.next()).done;)u+=O(i=i.value,t,a,c=l+T(i,s++),o);else if("object"===i)throw t=String(e),Error("Objects are not valid as a React child (found: "+("[object Object]"===t?"object with keys {"+Object.keys(e).join(", ")+"}":t)+"). If you meant to render a collection of children, use an array instead.");return u}function N(e,t,n){if(null==e)return e;var r=[],a=0;return O(e,r,"","",(function(e){return t.call(n,e,a++)})),r}function R(e){if(-1===e._status){var t=e._result;(t=t()).then((function(t){0!==e._status&&-1!==e._status||(e._status=1,e._result=t)}),(function(t){0!==e._status&&-1!==e._status||(e._status=2,e._result=t)})),-1===e._status&&(e._status=0,e._result=t)}if(1===e._status)return e._result.default;throw e._result}var z={current:null},L={transition:null},A={ReactCurrentDispatcher:z,ReactCurrentBatchConfig:L,ReactCurrentOwner:C};t.Children={map:N,forEach:function(e,t,n){N(e,(function(){t.apply(this,arguments)}),n)},count:function(e){var t=0;return N(e,(function(){t++})),t},toArray:function(e){return N(e,(function(e){return e}))||[]},only:function(e){if(!_(e))throw Error("React.Children.only expected to receive a single React element child.");return e}},t.Component=v,t.Fragment=a,t.Profiler=o,t.PureComponent=b,t.StrictMode=l,t.Suspense=c,t.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=A,t.cloneElement=function(e,t,r){if(null===e||void 0===e)throw Error("React.cloneElement(...): The argument must be a React element, but you passed "+e+".");var a=m({},e.props),l=e.key,o=e.ref,i=e._owner;if(null!=t){if(void 0!==t.ref&&(o=t.ref,i=C.current),void 0!==t.key&&(l=""+t.key),e.type&&e.type.defaultProps)var u=e.type.defaultProps;for(s in t)w.call(t,s)&&!E.hasOwnProperty(s)&&(a[s]=void 0===t[s]&&void 0!==u?u[s]:t[s])}var s=arguments.length-2;if(1===s)a.children=r;else if(1<s){u=Array(s);for(var c=0;c<s;c++)u[c]=arguments[c+2];a.children=u}return{$$typeof:n,type:e.type,key:l,ref:o,props:a,_owner:i}},t.createContext=function(e){return(e={$$typeof:u,_currentValue:e,_currentValue2:e,_threadCount:0,Provider:null,Consumer:null,_defaultValue:null,_globalName:null}).Provider={$$typeof:i,_context:e},e.Consumer=e},t.createElement=x,t.createFactory=function(e){var t=x.bind(null,e);return t.type=e,t},t.createRef=function(){return{current:null}},t.forwardRef=function(e){return{$$typeof:s,render:e}},t.isValidElement=_,t.lazy=function(e){return{$$typeof:d,_payload:{_status:-1,_result:e},_init:R}},t.memo=function(e,t){return{$$typeof:f,type:e,compare:void 0===t?null:t}},t.startTransition=function(e){var t=L.transition;L.transition={};try{e()}finally{L.transition=t}},t.unstable_act=function(){throw Error("act(...) is not supported in production builds of React.")},t.useCallback=function(e,t){return z.current.useCallback(e,t)},t.useContext=function(e){return z.current.useContext(e)},t.useDebugValue=function(){},t.useDeferredValue=function(e){return z.current.useDeferredValue(e)},t.useEffect=function(e,t){return z.current.useEffect(e,t)},t.useId=function(){return z.current.useId()},t.useImperativeHandle=function(e,t,n){return z.current.useImperativeHandle(e,t,n)},t.useInsertionEffect=function(e,t){return z.current.useInsertionEffect(e,t)},t.useLayoutEffect=function(e,t){return z.current.useLayoutEffect(e,t)},t.useMemo=function(e,t){return z.current.useMemo(e,t)},t.useReducer=function(e,t,n){return z.current.useReducer(e,t,n)},t.useRef=function(e){return z.current.useRef(e)},t.useState=function(e){return z.current.useState(e)},t.useSyncExternalStore=function(e,t,n){return z.current.useSyncExternalStore(e,t,n)},t.useTransition=function(){return z.current.useTransition()},t.version="18.2.0"},791:(e,t,n)=>{"use strict";e.exports=n(117)},184:(e,t,n)=>{"use strict";e.exports=n(374)},813:(e,t)=>{"use strict";function n(e,t){var n=e.length;e.push(t);e:for(;0<n;){var r=n-1>>>1,a=e[r];if(!(0<l(a,t)))break e;e[r]=t,e[n]=a,n=r}}function r(e){return 0===e.length?null:e[0]}function a(e){if(0===e.length)return null;var t=e[0],n=e.pop();if(n!==t){e[0]=n;e:for(var r=0,a=e.length,o=a>>>1;r<o;){var i=2*(r+1)-1,u=e[i],s=i+1,c=e[s];if(0>l(u,n))s<a&&0>l(c,u)?(e[r]=c,e[s]=n,r=s):(e[r]=u,e[i]=n,r=i);else{if(!(s<a&&0>l(c,n)))break e;e[r]=c,e[s]=n,r=s}}}return t}function l(e,t){var n=e.sortIndex-t.sortIndex;return 0!==n?n:e.id-t.id}if("object"===typeof performance&&"function"===typeof performance.now){var o=performance;t.unstable_now=function(){return o.now()}}else{var i=Date,u=i.now();t.unstable_now=function(){return i.now()-u}}var s=[],c=[],f=1,d=null,p=3,h=!1,m=!1,g=!1,v="function"===typeof setTimeout?setTimeout:null,y="function"===typeof clearTimeout?clearTimeout:null,b="undefined"!==typeof setImmediate?setImmediate:null;function S(e){for(var t=r(c);null!==t;){if(null===t.callback)a(c);else{if(!(t.startTime<=e))break;a(c),t.sortIndex=t.expirationTime,n(s,t)}t=r(c)}}function k(e){if(g=!1,S(e),!m)if(null!==r(s))m=!0,L(w);else{var t=r(c);null!==t&&A(k,t.startTime-e)}}function w(e,n){m=!1,g&&(g=!1,y(_),_=-1),h=!0;var l=p;try{for(S(n),d=r(s);null!==d&&(!(d.expirationTime>n)||e&&!O());){var o=d.callback;if("function"===typeof o){d.callback=null,p=d.priorityLevel;var i=o(d.expirationTime<=n);n=t.unstable_now(),"function"===typeof i?d.callback=i:d===r(s)&&a(s),S(n)}else a(s);d=r(s)}if(null!==d)var u=!0;else{var f=r(c);null!==f&&A(k,f.startTime-n),u=!1}return u}finally{d=null,p=l,h=!1}}"undefined"!==typeof navigator&&void 0!==navigator.scheduling&&void 0!==navigator.scheduling.isInputPending&&navigator.scheduling.isInputPending.bind(navigator.scheduling);var C,E=!1,x=null,_=-1,P=5,T=-1;function O(){return!(t.unstable_now()-T<P)}function N(){if(null!==x){var e=t.unstable_now();T=e;var n=!0;try{n=x(!0,e)}finally{n?C():(E=!1,x=null)}}else E=!1}if("function"===typeof b)C=function(){b(N)};else if("undefined"!==typeof MessageChannel){var R=new MessageChannel,z=R.port2;R.port1.onmessage=N,C=function(){z.postMessage(null)}}else C=function(){v(N,0)};function L(e){x=e,E||(E=!0,C())}function A(e,n){_=v((function(){e(t.unstable_now())}),n)}t.unstable_IdlePriority=5,t.unstable_ImmediatePriority=1,t.unstable_LowPriority=4,t.unstable_NormalPriority=3,t.unstable_Profiling=null,t.unstable_UserBlockingPriority=2,t.unstable_cancelCallback=function(e){e.callback=null},t.unstable_continueExecution=function(){m||h||(m=!0,L(w))},t.unstable_forceFrameRate=function(e){0>e||125<e?console.error("forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported"):P=0<e?Math.floor(1e3/e):5},t.unstable_getCurrentPriorityLevel=function(){return p},t.unstable_getFirstCallbackNode=function(){return r(s)},t.unstable_next=function(e){switch(p){case 1:case 2:case 3:var t=3;break;default:t=p}var n=p;p=t;try{return e()}finally{p=n}},t.unstable_pauseExecution=function(){},t.unstable_requestPaint=function(){},t.unstable_runWithPriority=function(e,t){switch(e){case 1:case 2:case 3:case 4:case 5:break;default:e=3}var n=p;p=e;try{return t()}finally{p=n}},t.unstable_scheduleCallback=function(e,a,l){var o=t.unstable_now();switch("object"===typeof l&&null!==l?l="number"===typeof(l=l.delay)&&0<l?o+l:o:l=o,e){case 1:var i=-1;break;case 2:i=250;break;case 5:i=1073741823;break;case 4:i=1e4;break;default:i=5e3}return e={id:f++,callback:a,priorityLevel:e,startTime:l,expirationTime:i=l+i,sortIndex:-1},l>o?(e.sortIndex=l,n(c,e),null===r(s)&&e===r(c)&&(g?(y(_),_=-1):g=!0,A(k,l-o))):(e.sortIndex=i,n(s,e),m||h||(m=!0,L(w))),e},t.unstable_shouldYield=O,t.unstable_wrapCallback=function(e){var t=p;return function(){var n=p;p=t;try{return e.apply(this,arguments)}finally{p=n}}}},296:(e,t,n)=>{"use strict";e.exports=n(813)},613:e=>{e.exports=function(e,t,n,r){var a=n?n.call(r,e,t):void 0;if(void 0!==a)return!!a;if(e===t)return!0;if("object"!==typeof e||!e||"object"!==typeof t||!t)return!1;var l=Object.keys(e),o=Object.keys(t);if(l.length!==o.length)return!1;for(var i=Object.prototype.hasOwnProperty.bind(t),u=0;u<l.length;u++){var s=l[u];if(!i(s))return!1;var c=e[s],f=t[s];if(!1===(a=n?n.call(r,c,f,s):void 0)||void 0===a&&c!==f)return!1}return!0}}},t={};function n(r){var a=t[r];if(void 0!==a)return a.exports;var l=t[r]={exports:{}};return e[r](l,l.exports,n),l.exports}n.n=e=>{var t=e&&e.__esModule?()=>e.default:()=>e;return n.d(t,{a:t}),t},n.d=(e,t)=>{for(var r in t)n.o(t,r)&&!n.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},n.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t),n.nc=void 0,(()=>{"use strict";var e=n(441),t=n(791),r=n(613),a=n.n(r);const l=function(e){function t(e,r,u,s,d){for(var p,h,m,g,S,w=0,C=0,E=0,x=0,_=0,z=0,A=m=p=0,D=0,F=0,M=0,U=0,$=u.length,j=$-1,H="",W="",B="",V="";D<$;){if(h=u.charCodeAt(D),D===j&&0!==C+x+E+w&&(0!==C&&(h=47===C?10:47),x=E=w=0,$++,j++),0===C+x+E+w){if(D===j&&(0<F&&(H=H.replace(f,"")),0<H.trim().length)){switch(h){case 32:case 9:case 59:case 13:case 10:break;default:H+=u.charAt(D)}h=59}switch(h){case 123:for(p=(H=H.trim()).charCodeAt(0),m=1,U=++D;D<$;){switch(h=u.charCodeAt(D)){case 123:m++;break;case 125:m--;break;case 47:switch(h=u.charCodeAt(D+1)){case 42:case 47:e:{for(A=D+1;A<j;++A)switch(u.charCodeAt(A)){case 47:if(42===h&&42===u.charCodeAt(A-1)&&D+2!==A){D=A+1;break e}break;case 10:if(47===h){D=A+1;break e}}D=A}}break;case 91:h++;case 40:h++;case 34:case 39:for(;D++<j&&u.charCodeAt(D)!==h;);}if(0===m)break;D++}if(m=u.substring(U,D),0===p&&(p=(H=H.replace(c,"").trim()).charCodeAt(0)),64===p){switch(0<F&&(H=H.replace(f,"")),h=H.charCodeAt(1)){case 100:case 109:case 115:case 45:F=r;break;default:F=R}if(U=(m=t(r,F,m,h,d+1)).length,0<L&&(S=i(3,m,F=n(R,H,M),r,T,P,U,h,d,s),H=F.join(""),void 0!==S&&0===(U=(m=S.trim()).length)&&(h=0,m="")),0<U)switch(h){case 115:H=H.replace(k,o);case 100:case 109:case 45:m=H+"{"+m+"}";break;case 107:m=(H=H.replace(v,"$1 $2"))+"{"+m+"}",m=1===N||2===N&&l("@"+m,3)?"@-webkit-"+m+"@"+m:"@"+m;break;default:m=H+m,112===s&&(W+=m,m="")}else m=""}else m=t(r,n(r,H,M),m,s,d+1);B+=m,m=M=F=A=p=0,H="",h=u.charCodeAt(++D);break;case 125:case 59:if(1<(U=(H=(0<F?H.replace(f,""):H).trim()).length))switch(0===A&&(p=H.charCodeAt(0),45===p||96<p&&123>p)&&(U=(H=H.replace(" ",":")).length),0<L&&void 0!==(S=i(1,H,r,e,T,P,W.length,s,d,s))&&0===(U=(H=S.trim()).length)&&(H="\0\0"),p=H.charCodeAt(0),h=H.charCodeAt(1),p){case 0:break;case 64:if(105===h||99===h){V+=H+u.charAt(D);break}default:58!==H.charCodeAt(U-1)&&(W+=a(H,p,h,H.charCodeAt(2)))}M=F=A=p=0,H="",h=u.charCodeAt(++D)}}switch(h){case 13:case 10:47===C?C=0:0===1+p&&107!==s&&0<H.length&&(F=1,H+="\0"),0<L*I&&i(0,H,r,e,T,P,W.length,s,d,s),P=1,T++;break;case 59:case 125:if(0===C+x+E+w){P++;break}default:switch(P++,g=u.charAt(D),h){case 9:case 32:if(0===x+w+C)switch(_){case 44:case 58:case 9:case 32:g="";break;default:32!==h&&(g=" ")}break;case 0:g="\\0";break;case 12:g="\\f";break;case 11:g="\\v";break;case 38:0===x+C+w&&(F=M=1,g="\f"+g);break;case 108:if(0===x+C+w+O&&0<A)switch(D-A){case 2:112===_&&58===u.charCodeAt(D-3)&&(O=_);case 8:111===z&&(O=z)}break;case 58:0===x+C+w&&(A=D);break;case 44:0===C+E+x+w&&(F=1,g+="\r");break;case 34:case 39:0===C&&(x=x===h?0:0===x?h:x);break;case 91:0===x+C+E&&w++;break;case 93:0===x+C+E&&w--;break;case 41:0===x+C+w&&E--;break;case 40:if(0===x+C+w){if(0===p)if(2*_+3*z===533);else p=1;E++}break;case 64:0===C+E+x+w+A+m&&(m=1);break;case 42:case 47:if(!(0<x+w+E))switch(C){case 0:switch(2*h+3*u.charCodeAt(D+1)){case 235:C=47;break;case 220:U=D,C=42}break;case 42:47===h&&42===_&&U+2!==D&&(33===u.charCodeAt(U+2)&&(W+=u.substring(U,D+1)),g="",C=0)}}0===C&&(H+=g)}z=_,_=h,D++}if(0<(U=W.length)){if(F=r,0<L&&(void 0!==(S=i(2,W,F,e,T,P,U,s,d,s))&&0===(W=S).length))return V+W+B;if(W=F.join(",")+"{"+W+"}",0!==N*O){switch(2!==N||l(W,2)||(O=0),O){case 111:W=W.replace(b,":-moz-$1")+W;break;case 112:W=W.replace(y,"::-webkit-input-$1")+W.replace(y,"::-moz-$1")+W.replace(y,":-ms-input-$1")+W}O=0}}return V+W+B}function n(e,t,n){var a=t.trim().split(m);t=a;var l=a.length,o=e.length;switch(o){case 0:case 1:var i=0;for(e=0===o?"":e[0]+" ";i<l;++i)t[i]=r(e,t[i],n).trim();break;default:var u=i=0;for(t=[];i<l;++i)for(var s=0;s<o;++s)t[u++]=r(e[s]+" ",a[i],n).trim()}return t}function r(e,t,n){var r=t.charCodeAt(0);switch(33>r&&(r=(t=t.trim()).charCodeAt(0)),r){case 38:return t.replace(g,"$1"+e.trim());case 58:return e.trim()+t.replace(g,"$1"+e.trim());default:if(0<1*n&&0<t.indexOf("\f"))return t.replace(g,(58===e.charCodeAt(0)?"":"$1")+e.trim())}return e+t}function a(e,t,n,r){var o=e+";",i=2*t+3*n+4*r;if(944===i){e=o.indexOf(":",9)+1;var u=o.substring(e,o.length-1).trim();return u=o.substring(0,e).trim()+u+";",1===N||2===N&&l(u,1)?"-webkit-"+u+u:u}if(0===N||2===N&&!l(o,1))return o;switch(i){case 1015:return 97===o.charCodeAt(10)?"-webkit-"+o+o:o;case 951:return 116===o.charCodeAt(3)?"-webkit-"+o+o:o;case 963:return 110===o.charCodeAt(5)?"-webkit-"+o+o:o;case 1009:if(100!==o.charCodeAt(4))break;case 969:case 942:return"-webkit-"+o+o;case 978:return"-webkit-"+o+"-moz-"+o+o;case 1019:case 983:return"-webkit-"+o+"-moz-"+o+"-ms-"+o+o;case 883:if(45===o.charCodeAt(8))return"-webkit-"+o+o;if(0<o.indexOf("image-set(",11))return o.replace(_,"$1-webkit-$2")+o;break;case 932:if(45===o.charCodeAt(4))switch(o.charCodeAt(5)){case 103:return"-webkit-box-"+o.replace("-grow","")+"-webkit-"+o+"-ms-"+o.replace("grow","positive")+o;case 115:return"-webkit-"+o+"-ms-"+o.replace("shrink","negative")+o;case 98:return"-webkit-"+o+"-ms-"+o.replace("basis","preferred-size")+o}return"-webkit-"+o+"-ms-"+o+o;case 964:return"-webkit-"+o+"-ms-flex-"+o+o;case 1023:if(99!==o.charCodeAt(8))break;return"-webkit-box-pack"+(u=o.substring(o.indexOf(":",15)).replace("flex-","").replace("space-between","justify"))+"-webkit-"+o+"-ms-flex-pack"+u+o;case 1005:return p.test(o)?o.replace(d,":-webkit-")+o.replace(d,":-moz-")+o:o;case 1e3:switch(t=(u=o.substring(13).trim()).indexOf("-")+1,u.charCodeAt(0)+u.charCodeAt(t)){case 226:u=o.replace(S,"tb");break;case 232:u=o.replace(S,"tb-rl");break;case 220:u=o.replace(S,"lr");break;default:return o}return"-webkit-"+o+"-ms-"+u+o;case 1017:if(-1===o.indexOf("sticky",9))break;case 975:switch(t=(o=e).length-10,i=(u=(33===o.charCodeAt(t)?o.substring(0,t):o).substring(e.indexOf(":",7)+1).trim()).charCodeAt(0)+(0|u.charCodeAt(7))){case 203:if(111>u.charCodeAt(8))break;case 115:o=o.replace(u,"-webkit-"+u)+";"+o;break;case 207:case 102:o=o.replace(u,"-webkit-"+(102<i?"inline-":"")+"box")+";"+o.replace(u,"-webkit-"+u)+";"+o.replace(u,"-ms-"+u+"box")+";"+o}return o+";";case 938:if(45===o.charCodeAt(5))switch(o.charCodeAt(6)){case 105:return u=o.replace("-items",""),"-webkit-"+o+"-webkit-box-"+u+"-ms-flex-"+u+o;case 115:return"-webkit-"+o+"-ms-flex-item-"+o.replace(C,"")+o;default:return"-webkit-"+o+"-ms-flex-line-pack"+o.replace("align-content","").replace(C,"")+o}break;case 973:case 989:if(45!==o.charCodeAt(3)||122===o.charCodeAt(4))break;case 931:case 953:if(!0===x.test(e))return 115===(u=e.substring(e.indexOf(":")+1)).charCodeAt(0)?a(e.replace("stretch","fill-available"),t,n,r).replace(":fill-available",":stretch"):o.replace(u,"-webkit-"+u)+o.replace(u,"-moz-"+u.replace("fill-",""))+o;break;case 962:if(o="-webkit-"+o+(102===o.charCodeAt(5)?"-ms-"+o:"")+o,211===n+r&&105===o.charCodeAt(13)&&0<o.indexOf("transform",10))return o.substring(0,o.indexOf(";",27)+1).replace(h,"$1-webkit-$2")+o}return o}function l(e,t){var n=e.indexOf(1===t?":":"{"),r=e.substring(0,3!==t?n:10);return n=e.substring(n+1,e.length-1),A(2!==t?r:r.replace(E,"$1"),n,t)}function o(e,t){var n=a(t,t.charCodeAt(0),t.charCodeAt(1),t.charCodeAt(2));return n!==t+";"?n.replace(w," or ($1)").substring(4):"("+t+")"}function i(e,t,n,r,a,l,o,i,u,c){for(var f,d=0,p=t;d<L;++d)switch(f=z[d].call(s,e,p,n,r,a,l,o,i,u,c)){case void 0:case!1:case!0:case null:break;default:p=f}if(p!==t)return p}function u(e){return void 0!==(e=e.prefix)&&(A=null,e?"function"!==typeof e?N=1:(N=2,A=e):N=0),u}function s(e,n){var r=e;if(33>r.charCodeAt(0)&&(r=r.trim()),r=[r],0<L){var a=i(-1,n,r,r,T,P,0,0,0,0);void 0!==a&&"string"===typeof a&&(n=a)}var l=t(R,r,n,0,0);return 0<L&&(void 0!==(a=i(-2,l,r,r,T,P,l.length,0,0,0))&&(l=a)),"",O=0,P=T=1,l}var c=/^\0+/g,f=/[\0\r\f]/g,d=/: */g,p=/zoo|gra/,h=/([,: ])(transform)/g,m=/,\r+?/g,g=/([\t\r\n ])*\f?&/g,v=/@(k\w+)\s*(\S*)\s*/,y=/::(place)/g,b=/:(read-only)/g,S=/[svh]\w+-[tblr]{2}/,k=/\(\s*(.*)\s*\)/g,w=/([\s\S]*?);/g,C=/-self|flex-/g,E=/[^]*?(:[rp][el]a[\w-]+)[^]*/,x=/stretch|:\s*\w+\-(?:conte|avail)/,_=/([^-])(image-set\()/,P=1,T=1,O=0,N=1,R=[],z=[],L=0,A=null,I=0;return s.use=function e(t){switch(t){case void 0:case null:L=z.length=0;break;default:if("function"===typeof t)z[L++]=t;else if("object"===typeof t)for(var n=0,r=t.length;n<r;++n)e(t[n]);else I=0|!!t}return e},s.set=u,void 0!==e&&u(e),s};const o={animationIterationCount:1,borderImageOutset:1,borderImageSlice:1,borderImageWidth:1,boxFlex:1,boxFlexGroup:1,boxOrdinalGroup:1,columnCount:1,columns:1,flex:1,flexGrow:1,flexPositive:1,flexShrink:1,flexNegative:1,flexOrder:1,gridRow:1,gridRowEnd:1,gridRowSpan:1,gridRowStart:1,gridColumn:1,gridColumnEnd:1,gridColumnSpan:1,gridColumnStart:1,msGridRow:1,msGridRowSpan:1,msGridColumn:1,msGridColumnSpan:1,fontWeight:1,lineHeight:1,opacity:1,order:1,orphans:1,tabSize:1,widows:1,zIndex:1,zoom:1,WebkitLineClamp:1,fillOpacity:1,floodOpacity:1,stopOpacity:1,strokeDasharray:1,strokeDashoffset:1,strokeMiterlimit:1,strokeOpacity:1,strokeWidth:1};function i(e){var t=Object.create(null);return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}var u=/^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|cellPadding|cellSpacing|challenge|charSet|checked|cite|classID|className|cols|colSpan|content|contentEditable|contextMenu|controls|controlsList|coords|crossOrigin|data|dateTime|decoding|default|defer|dir|disabled|disablePictureInPicture|download|draggable|encType|enterKeyHint|form|formAction|formEncType|formMethod|formNoValidate|formTarget|frameBorder|headers|height|hidden|high|href|hrefLang|htmlFor|httpEquiv|id|inputMode|integrity|is|keyParams|keyType|kind|label|lang|list|loading|loop|low|marginHeight|marginWidth|max|maxLength|media|mediaGroup|method|min|minLength|multiple|muted|name|nonce|noValidate|open|optimum|pattern|placeholder|playsInline|poster|preload|profile|radioGroup|readOnly|referrerPolicy|rel|required|reversed|role|rows|rowSpan|sandbox|scope|scoped|scrolling|seamless|selected|shape|size|sizes|slot|span|spellCheck|src|srcDoc|srcLang|srcSet|start|step|style|summary|tabIndex|target|title|translate|type|useMap|value|width|wmode|wrap|about|datatype|inlist|prefix|property|resource|typeof|vocab|autoCapitalize|autoCorrect|autoSave|color|incremental|fallback|inert|itemProp|itemScope|itemType|itemID|itemRef|on|option|results|security|unselectable|accentHeight|accumulate|additive|alignmentBaseline|allowReorder|alphabetic|amplitude|arabicForm|ascent|attributeName|attributeType|autoReverse|azimuth|baseFrequency|baselineShift|baseProfile|bbox|begin|bias|by|calcMode|capHeight|clip|clipPathUnits|clipPath|clipRule|colorInterpolation|colorInterpolationFilters|colorProfile|colorRendering|contentScriptType|contentStyleType|cursor|cx|cy|d|decelerate|descent|diffuseConstant|direction|display|divisor|dominantBaseline|dur|dx|dy|edgeMode|elevation|enableBackground|end|exponent|externalResourcesRequired|fill|fillOpacity|fillRule|filter|filterRes|filterUnits|floodColor|floodOpacity|focusable|fontFamily|fontSize|fontSizeAdjust|fontStretch|fontStyle|fontVariant|fontWeight|format|from|fr|fx|fy|g1|g2|glyphName|glyphOrientationHorizontal|glyphOrientationVertical|glyphRef|gradientTransform|gradientUnits|hanging|horizAdvX|horizOriginX|ideographic|imageRendering|in|in2|intercept|k|k1|k2|k3|k4|kernelMatrix|kernelUnitLength|kerning|keyPoints|keySplines|keyTimes|lengthAdjust|letterSpacing|lightingColor|limitingConeAngle|local|markerEnd|markerMid|markerStart|markerHeight|markerUnits|markerWidth|mask|maskContentUnits|maskUnits|mathematical|mode|numOctaves|offset|opacity|operator|order|orient|orientation|origin|overflow|overlinePosition|overlineThickness|panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectRatio|primitiveUnits|r|radius|refX|refY|renderingIntent|repeatCount|repeatDur|requiredExtensions|requiredFeatures|restart|result|rotate|rx|ry|scale|seed|shapeRendering|slope|spacing|specularConstant|specularExponent|speed|spreadMethod|startOffset|stdDeviation|stemh|stemv|stitchTiles|stopColor|stopOpacity|strikethroughPosition|strikethroughThickness|string|stroke|strokeDasharray|strokeDashoffset|strokeLinecap|strokeLinejoin|strokeMiterlimit|strokeOpacity|strokeWidth|surfaceScale|systemLanguage|tableValues|targetX|targetY|textAnchor|textDecoration|textRendering|textLength|to|transform|u1|u2|underlinePosition|underlineThickness|unicode|unicodeBidi|unicodeRange|unitsPerEm|vAlphabetic|vHanging|vIdeographic|vMathematical|values|vectorEffect|version|vertAdvY|vertOriginX|vertOriginY|viewBox|viewTarget|visibility|widths|wordSpacing|writingMode|x|xHeight|x1|x2|xChannelSelector|xlinkActuate|xlinkArcrole|xlinkHref|xlinkRole|xlinkShow|xlinkTitle|xlinkType|xmlBase|xmlns|xmlnsXlink|xmlLang|xmlSpace|y|y1|y2|yChannelSelector|z|zoomAndPan|for|class|autofocus)|(([Dd][Aa][Tt][Aa]|[Aa][Rr][Ii][Aa]|x)-.*))$/,s=i((function(e){return u.test(e)||111===e.charCodeAt(0)&&110===e.charCodeAt(1)&&e.charCodeAt(2)<91})),c=n(110),f=n.n(c);function d(){return(d=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}var p=function(e,t){for(var n=[e[0]],r=0,a=t.length;r<a;r+=1)n.push(t[r],e[r+1]);return n},h=function(t){return null!==t&&"object"==typeof t&&"[object Object]"===(t.toString?t.toString():Object.prototype.toString.call(t))&&!(0,e.typeOf)(t)},m=Object.freeze([]),g=Object.freeze({});function v(e){return"function"==typeof e}function y(e){return e.displayName||e.name||"Component"}function b(e){return e&&"string"==typeof e.styledComponentId}var S="undefined"!=typeof process&&void 0!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}&&({NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.REACT_APP_SC_ATTR||{NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.SC_ATTR)||"data-styled",k="undefined"!=typeof window&&"HTMLElement"in window,w=Boolean("boolean"==typeof SC_DISABLE_SPEEDY?SC_DISABLE_SPEEDY:"undefined"!=typeof process&&void 0!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}&&(void 0!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.REACT_APP_SC_DISABLE_SPEEDY&&""!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.REACT_APP_SC_DISABLE_SPEEDY?"false"!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.REACT_APP_SC_DISABLE_SPEEDY&&{NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.REACT_APP_SC_DISABLE_SPEEDY:void 0!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.SC_DISABLE_SPEEDY&&""!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.SC_DISABLE_SPEEDY&&("false"!=={NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.SC_DISABLE_SPEEDY&&{NODE_ENV:"production",PUBLIC_URL:"",WDS_SOCKET_HOST:void 0,WDS_SOCKET_PATH:void 0,WDS_SOCKET_PORT:void 0,FAST_REFRESH:!0}.SC_DISABLE_SPEEDY)));function C(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];throw new Error("An error occurred. See https://git.io/JUIaE#"+e+" for more information."+(n.length>0?" Args: "+n.join(", "):""))}var E=function(){function e(e){this.groupSizes=new Uint32Array(512),this.length=512,this.tag=e}var t=e.prototype;return t.indexOfGroup=function(e){for(var t=0,n=0;n<e;n++)t+=this.groupSizes[n];return t},t.insertRules=function(e,t){if(e>=this.groupSizes.length){for(var n=this.groupSizes,r=n.length,a=r;e>=a;)(a<<=1)<0&&C(16,""+e);this.groupSizes=new Uint32Array(a),this.groupSizes.set(n),this.length=a;for(var l=r;l<a;l++)this.groupSizes[l]=0}for(var o=this.indexOfGroup(e+1),i=0,u=t.length;i<u;i++)this.tag.insertRule(o,t[i])&&(this.groupSizes[e]++,o++)},t.clearGroup=function(e){if(e<this.length){var t=this.groupSizes[e],n=this.indexOfGroup(e),r=n+t;this.groupSizes[e]=0;for(var a=n;a<r;a++)this.tag.deleteRule(n)}},t.getGroup=function(e){var t="";if(e>=this.length||0===this.groupSizes[e])return t;for(var n=this.groupSizes[e],r=this.indexOfGroup(e),a=r+n,l=r;l<a;l++)t+=this.tag.getRule(l)+"/*!sc*/\n";return t},e}(),x=new Map,_=new Map,P=1,T=function(e){if(x.has(e))return x.get(e);for(;_.has(P);)P++;var t=P++;return x.set(e,t),_.set(t,e),t},O=function(e){return _.get(e)},N=function(e,t){t>=P&&(P=t+1),x.set(e,t),_.set(t,e)},R="style["+S+'][data-styled-version="5.3.11"]',z=new RegExp("^"+S+'\\.g(\\d+)\\[id="([\\w\\d-]+)"\\].*?"([^"]*)'),L=function(e,t,n){for(var r,a=n.split(","),l=0,o=a.length;l<o;l++)(r=a[l])&&e.registerName(t,r)},A=function(e,t){for(var n=(t.textContent||"").split("/*!sc*/\n"),r=[],a=0,l=n.length;a<l;a++){var o=n[a].trim();if(o){var i=o.match(z);if(i){var u=0|parseInt(i[1],10),s=i[2];0!==u&&(N(s,u),L(e,s,i[3]),e.getTag().insertRules(u,r)),r.length=0}else r.push(o)}}},I=function(){return n.nc},D=function(e){var t=document.head,n=e||t,r=document.createElement("style"),a=function(e){for(var t=e.childNodes,n=t.length;n>=0;n--){var r=t[n];if(r&&1===r.nodeType&&r.hasAttribute(S))return r}}(n),l=void 0!==a?a.nextSibling:null;r.setAttribute(S,"active"),r.setAttribute("data-styled-version","5.3.11");var o=I();return o&&r.setAttribute("nonce",o),n.insertBefore(r,l),r},F=function(){function e(e){var t=this.element=D(e);t.appendChild(document.createTextNode("")),this.sheet=function(e){if(e.sheet)return e.sheet;for(var t=document.styleSheets,n=0,r=t.length;n<r;n++){var a=t[n];if(a.ownerNode===e)return a}C(17)}(t),this.length=0}var t=e.prototype;return t.insertRule=function(e,t){try{return this.sheet.insertRule(t,e),this.length++,!0}catch(e){return!1}},t.deleteRule=function(e){this.sheet.deleteRule(e),this.length--},t.getRule=function(e){var t=this.sheet.cssRules[e];return void 0!==t&&"string"==typeof t.cssText?t.cssText:""},e}(),M=function(){function e(e){var t=this.element=D(e);this.nodes=t.childNodes,this.length=0}var t=e.prototype;return t.insertRule=function(e,t){if(e<=this.length&&e>=0){var n=document.createTextNode(t),r=this.nodes[e];return this.element.insertBefore(n,r||null),this.length++,!0}return!1},t.deleteRule=function(e){this.element.removeChild(this.nodes[e]),this.length--},t.getRule=function(e){return e<this.length?this.nodes[e].textContent:""},e}(),U=function(){function e(e){this.rules=[],this.length=0}var t=e.prototype;return t.insertRule=function(e,t){return e<=this.length&&(this.rules.splice(e,0,t),this.length++,!0)},t.deleteRule=function(e){this.rules.splice(e,1),this.length--},t.getRule=function(e){return e<this.length?this.rules[e]:""},e}(),$=k,j={isServer:!k,useCSSOMInjection:!w},H=function(){function e(e,t,n){void 0===e&&(e=g),void 0===t&&(t={}),this.options=d({},j,{},e),this.gs=t,this.names=new Map(n),this.server=!!e.isServer,!this.server&&k&&$&&($=!1,function(e){for(var t=document.querySelectorAll(R),n=0,r=t.length;n<r;n++){var a=t[n];a&&"active"!==a.getAttribute(S)&&(A(e,a),a.parentNode&&a.parentNode.removeChild(a))}}(this))}e.registerId=function(e){return T(e)};var t=e.prototype;return t.reconstructWithOptions=function(t,n){return void 0===n&&(n=!0),new e(d({},this.options,{},t),this.gs,n&&this.names||void 0)},t.allocateGSInstance=function(e){return this.gs[e]=(this.gs[e]||0)+1},t.getTag=function(){return this.tag||(this.tag=(n=(t=this.options).isServer,r=t.useCSSOMInjection,a=t.target,e=n?new U(a):r?new F(a):new M(a),new E(e)));var e,t,n,r,a},t.hasNameForId=function(e,t){return this.names.has(e)&&this.names.get(e).has(t)},t.registerName=function(e,t){if(T(e),this.names.has(e))this.names.get(e).add(t);else{var n=new Set;n.add(t),this.names.set(e,n)}},t.insertRules=function(e,t,n){this.registerName(e,t),this.getTag().insertRules(T(e),n)},t.clearNames=function(e){this.names.has(e)&&this.names.get(e).clear()},t.clearRules=function(e){this.getTag().clearGroup(T(e)),this.clearNames(e)},t.clearTag=function(){this.tag=void 0},t.toString=function(){return function(e){for(var t=e.getTag(),n=t.length,r="",a=0;a<n;a++){var l=O(a);if(void 0!==l){var o=e.names.get(l),i=t.getGroup(a);if(o&&i&&o.size){var u=S+".g"+a+'[id="'+l+'"]',s="";void 0!==o&&o.forEach((function(e){e.length>0&&(s+=e+",")})),r+=""+i+u+'{content:"'+s+'"}/*!sc*/\n'}}}return r}(this)},e}(),W=/(a)(d)/gi,B=function(e){return String.fromCharCode(e+(e>25?39:97))};function V(e){var t,n="";for(t=Math.abs(e);t>52;t=t/52|0)n=B(t%52)+n;return(B(t%52)+n).replace(W,"$1-$2")}var K=function(e,t){for(var n=t.length;n;)e=33*e^t.charCodeAt(--n);return e},Q=function(e){return K(5381,e)};function q(e){for(var t=0;t<e.length;t+=1){var n=e[t];if(v(n)&&!b(n))return!1}return!0}var Y=Q("5.3.11"),G=function(){function e(e,t,n){this.rules=e,this.staticRulesId="",this.isStatic=(void 0===n||n.isStatic)&&q(e),this.componentId=t,this.baseHash=K(Y,t),this.baseStyle=n,H.registerId(t)}return e.prototype.generateAndInjectStyles=function(e,t,n){var r=this.componentId,a=[];if(this.baseStyle&&a.push(this.baseStyle.generateAndInjectStyles(e,t,n)),this.isStatic&&!n.hash)if(this.staticRulesId&&t.hasNameForId(r,this.staticRulesId))a.push(this.staticRulesId);else{var l=he(this.rules,e,t,n).join(""),o=V(K(this.baseHash,l)>>>0);if(!t.hasNameForId(r,o)){var i=n(l,"."+o,void 0,r);t.insertRules(r,o,i)}a.push(o),this.staticRulesId=o}else{for(var u=this.rules.length,s=K(this.baseHash,n.hash),c="",f=0;f<u;f++){var d=this.rules[f];if("string"==typeof d)c+=d;else if(d){var p=he(d,e,t,n),h=Array.isArray(p)?p.join(""):p;s=K(s,h+f),c+=h}}if(c){var m=V(s>>>0);if(!t.hasNameForId(r,m)){var g=n(c,"."+m,void 0,r);t.insertRules(r,m,g)}a.push(m)}}return a.join(" ")},e}(),X=/^\s*\/\/.*$/gm,Z=[":","[",".","#"];function J(e){var t,n,r,a,o=void 0===e?g:e,i=o.options,u=void 0===i?g:i,s=o.plugins,c=void 0===s?m:s,f=new l(u),d=[],p=function(e){function t(t){if(t)try{e(t+"}")}catch(e){}}return function(n,r,a,l,o,i,u,s,c,f){switch(n){case 1:if(0===c&&64===r.charCodeAt(0))return e(r+";"),"";break;case 2:if(0===s)return r+"/*|*/";break;case 3:switch(s){case 102:case 112:return e(a[0]+r),"";default:return r+(0===f?"/*|*/":"")}case-2:r.split("/*|*/}").forEach(t)}}}((function(e){d.push(e)})),h=function(e,r,l){return 0===r&&-1!==Z.indexOf(l[n.length])||l.match(a)?e:"."+t};function v(e,l,o,i){void 0===i&&(i="&");var u=e.replace(X,""),s=l&&o?o+" "+l+" { "+u+" }":u;return t=i,n=l,r=new RegExp("\\"+n+"\\b","g"),a=new RegExp("(\\"+n+"\\b){2,}"),f(o||!l?"":l,s)}return f.use([].concat(c,[function(e,t,a){2===e&&a.length&&a[0].lastIndexOf(n)>0&&(a[0]=a[0].replace(r,h))},p,function(e){if(-2===e){var t=d;return d=[],t}}])),v.hash=c.length?c.reduce((function(e,t){return t.name||C(15),K(e,t.name)}),5381).toString():"",v}var ee=t.createContext(),te=(ee.Consumer,t.createContext()),ne=(te.Consumer,new H),re=J();function ae(){return(0,t.useContext)(ee)||ne}function le(){return(0,t.useContext)(te)||re}function oe(e){var n=(0,t.useState)(e.stylisPlugins),r=n[0],l=n[1],o=ae(),i=(0,t.useMemo)((function(){var t=o;return e.sheet?t=e.sheet:e.target&&(t=t.reconstructWithOptions({target:e.target},!1)),e.disableCSSOMInjection&&(t=t.reconstructWithOptions({useCSSOMInjection:!1})),t}),[e.disableCSSOMInjection,e.sheet,e.target]),u=(0,t.useMemo)((function(){return J({options:{prefix:!e.disableVendorPrefixes},plugins:r})}),[e.disableVendorPrefixes,r]);return(0,t.useEffect)((function(){a()(r,e.stylisPlugins)||l(e.stylisPlugins)}),[e.stylisPlugins]),t.createElement(ee.Provider,{value:i},t.createElement(te.Provider,{value:u},e.children))}var ie=function(){function e(e,t){var n=this;this.inject=function(e,t){void 0===t&&(t=re);var r=n.name+t.hash;e.hasNameForId(n.id,r)||e.insertRules(n.id,r,t(n.rules,r,"@keyframes"))},this.toString=function(){return C(12,String(n.name))},this.name=e,this.id="sc-keyframes-"+e,this.rules=t}return e.prototype.getName=function(e){return void 0===e&&(e=re),this.name+e.hash},e}(),ue=/([A-Z])/,se=/([A-Z])/g,ce=/^ms-/,fe=function(e){return"-"+e.toLowerCase()};function de(e){return ue.test(e)?e.replace(se,fe).replace(ce,"-ms-"):e}var pe=function(e){return null==e||!1===e||""===e};function he(e,t,n,r){if(Array.isArray(e)){for(var a,l=[],i=0,u=e.length;i<u;i+=1)""!==(a=he(e[i],t,n,r))&&(Array.isArray(a)?l.push.apply(l,a):l.push(a));return l}return pe(e)?"":b(e)?"."+e.styledComponentId:v(e)?"function"!=typeof(s=e)||s.prototype&&s.prototype.isReactComponent||!t?e:he(e(t),t,n,r):e instanceof ie?n?(e.inject(n,r),e.getName(r)):e:h(e)?function e(t,n){var r,a,l=[];for(var i in t)t.hasOwnProperty(i)&&!pe(t[i])&&(Array.isArray(t[i])&&t[i].isCss||v(t[i])?l.push(de(i)+":",t[i],";"):h(t[i])?l.push.apply(l,e(t[i],i)):l.push(de(i)+": "+(r=i,(null==(a=t[i])||"boolean"==typeof a||""===a?"":"number"!=typeof a||0===a||r in o||r.startsWith("--")?String(a).trim():a+"px")+";")));return n?[n+" {"].concat(l,["}"]):l}(e):e.toString();var s}var me=function(e){return Array.isArray(e)&&(e.isCss=!0),e};function ge(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];return v(e)||h(e)?me(he(p(m,[e].concat(n)))):0===n.length&&1===e.length&&"string"==typeof e[0]?e:me(he(p(e,n)))}new Set;var ve=function(e,t,n){return void 0===n&&(n=g),e.theme!==n.theme&&e.theme||t||n.theme},ye=/[!"#$%&'()*+,./:;<=>?@[\\\]^`{|}~-]+/g,be=/(^-|-$)/g;function Se(e){return e.replace(ye,"-").replace(be,"")}var ke=function(e){return V(Q(e)>>>0)};function we(e){return"string"==typeof e&&!0}var Ce=function(e){return"function"==typeof e||"object"==typeof e&&null!==e&&!Array.isArray(e)},Ee=function(e){return"__proto__"!==e&&"constructor"!==e&&"prototype"!==e};function xe(e,t,n){var r=e[n];Ce(t)&&Ce(r)?_e(r,t):e[n]=t}function _e(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];for(var a=0,l=n;a<l.length;a++){var o=l[a];if(Ce(o))for(var i in o)Ee(i)&&xe(e,o[i],i)}return e}var Pe=t.createContext();Pe.Consumer;var Te={};function Oe(e,n,r){var a=b(e),l=!we(e),o=n.attrs,i=void 0===o?m:o,u=n.componentId,c=void 0===u?function(e,t){var n="string"!=typeof e?"sc":Se(e);Te[n]=(Te[n]||0)+1;var r=n+"-"+ke("5.3.11"+n+Te[n]);return t?t+"-"+r:r}(n.displayName,n.parentComponentId):u,p=n.displayName,h=void 0===p?function(e){return we(e)?"styled."+e:"Styled("+y(e)+")"}(e):p,S=n.displayName&&n.componentId?Se(n.displayName)+"-"+n.componentId:n.componentId||c,k=a&&e.attrs?Array.prototype.concat(e.attrs,i).filter(Boolean):i,w=n.shouldForwardProp;a&&e.shouldForwardProp&&(w=n.shouldForwardProp?function(t,r,a){return e.shouldForwardProp(t,r,a)&&n.shouldForwardProp(t,r,a)}:e.shouldForwardProp);var C,E=new G(r,S,a?e.componentStyle:void 0),x=E.isStatic&&0===i.length,_=function(e,n){return function(e,n,r,a){var l=e.attrs,o=e.componentStyle,i=e.defaultProps,u=e.foldedComponentIds,c=e.shouldForwardProp,f=e.styledComponentId,p=e.target,h=function(e,t,n){void 0===e&&(e=g);var r=d({},t,{theme:e}),a={};return n.forEach((function(e){var t,n,l,o=e;for(t in v(o)&&(o=o(r)),o)r[t]=a[t]="className"===t?(n=a[t],l=o[t],n&&l?n+" "+l:n||l):o[t]})),[r,a]}(ve(n,(0,t.useContext)(Pe),i)||g,n,l),m=h[0],y=h[1],b=function(e,t,n,r){var a=ae(),l=le();return t?e.generateAndInjectStyles(g,a,l):e.generateAndInjectStyles(n,a,l)}(o,a,m),S=r,k=y.$as||n.$as||y.as||n.as||p,w=we(k),C=y!==n?d({},n,{},y):n,E={};for(var x in C)"$"!==x[0]&&"as"!==x&&("forwardedAs"===x?E.as=C[x]:(c?c(x,s,k):!w||s(x))&&(E[x]=C[x]));return n.style&&y.style!==n.style&&(E.style=d({},n.style,{},y.style)),E.className=Array.prototype.concat(u,f,b!==f?b:null,n.className,y.className).filter(Boolean).join(" "),E.ref=S,(0,t.createElement)(k,E)}(C,e,n,x)};return _.displayName=h,(C=t.forwardRef(_)).attrs=k,C.componentStyle=E,C.displayName=h,C.shouldForwardProp=w,C.foldedComponentIds=a?Array.prototype.concat(e.foldedComponentIds,e.styledComponentId):m,C.styledComponentId=S,C.target=a?e.target:e,C.withComponent=function(e){var t=n.componentId,a=function(e,t){if(null==e)return{};var n,r,a={},l=Object.keys(e);for(r=0;r<l.length;r++)n=l[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(n,["componentId"]),l=t&&t+"-"+(we(e)?e:Se(y(e)));return Oe(e,d({},a,{attrs:k,componentId:l}),r)},Object.defineProperty(C,"defaultProps",{get:function(){return this._foldedDefaultProps},set:function(t){this._foldedDefaultProps=a?_e({},e.defaultProps,t):t}}),Object.defineProperty(C,"toString",{value:function(){return"."+C.styledComponentId}}),l&&f()(C,e,{attrs:!0,componentStyle:!0,displayName:!0,foldedComponentIds:!0,shouldForwardProp:!0,styledComponentId:!0,target:!0,withComponent:!0}),C}var Ne=function(t){return function t(n,r,a){if(void 0===a&&(a=g),!(0,e.isValidElementType)(r))return C(1,String(r));var l=function(){return n(r,a,ge.apply(void 0,arguments))};return l.withConfig=function(e){return t(n,r,d({},a,{},e))},l.attrs=function(e){return t(n,r,d({},a,{attrs:Array.prototype.concat(a.attrs,e).filter(Boolean)}))},l}(Oe,t)};["a","abbr","address","area","article","aside","audio","b","base","bdi","bdo","big","blockquote","body","br","button","canvas","caption","cite","code","col","colgroup","data","datalist","dd","del","details","dfn","dialog","div","dl","dt","em","embed","fieldset","figcaption","figure","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","iframe","img","input","ins","kbd","keygen","label","legend","li","link","main","map","mark","marquee","menu","menuitem","meta","meter","nav","noscript","object","ol","optgroup","option","output","p","param","picture","pre","progress","q","rp","rt","ruby","s","samp","script","section","select","small","source","span","strong","style","sub","summary","sup","table","tbody","td","textarea","tfoot","th","thead","time","title","tr","track","u","ul","var","video","wbr","circle","clipPath","defs","ellipse","foreignObject","g","image","line","linearGradient","marker","mask","path","pattern","polygon","polyline","radialGradient","rect","stop","svg","text","textPath","tspan"].forEach((function(e){Ne[e]=Ne(e)}));!function(){function e(e,t){this.rules=e,this.componentId=t,this.isStatic=q(e),H.registerId(this.componentId+1)}var t=e.prototype;t.createStyles=function(e,t,n,r){var a=r(he(this.rules,t,n,r).join(""),""),l=this.componentId+e;n.insertRules(l,l,a)},t.removeStyles=function(e,t){t.clearRules(this.componentId+e)},t.renderStyles=function(e,t,n,r){e>2&&H.registerId(this.componentId+e),this.removeStyles(e,n),this.createStyles(e,t,n,r)}}();!function(){function e(){var e=this;this._emitSheetCSS=function(){var t=e.instance.toString();if(!t)return"";var n=I();return"<style "+[n&&'nonce="'+n+'"',S+'="true"','data-styled-version="5.3.11"'].filter(Boolean).join(" ")+">"+t+"</style>"},this.getStyleTags=function(){return e.sealed?C(2):e._emitSheetCSS()},this.getStyleElement=function(){var n;if(e.sealed)return C(2);var r=((n={})[S]="",n["data-styled-version"]="5.3.11",n.dangerouslySetInnerHTML={__html:e.instance.toString()},n),a=I();return a&&(r.nonce=a),[t.createElement("style",d({},r,{key:"sc-0-0"}))]},this.seal=function(){e.sealed=!0},this.instance=new H({isServer:!0}),this.sealed=!1}var n=e.prototype;n.collectStyles=function(e){return this.sealed?C(2):t.createElement(oe,{sheet:this.instance},e)},n.interleaveWithNodeStream=function(e){return C(3)}}();const Re=Ne;var ze=n(184);const Le=e=>{const t=document.createElement("template");return t.setAttribute("style",e),Object.entries(t.style).filter((e=>{let[t]=e;return!/^[0-9]+$/.test(t)})).filter((e=>{let[,t]=e;return Boolean(t)})).reduce(((e,t)=>{let[n,r]=t;return{...e,[n]:r}}),{})},Ae=Re.a`
-  display: flex;
-  align-items: center;
-  height: 44px;
-  padding: 0 12px;
-  background-color: #54b4cd;
-  border-radius: 8px;
-  font-size: 1rem;
-  font-weight: 700;
-  text-decoration: none;
-  color: #ffffff;
-  position: relative;
-
-  span {
-    margin-bottom: 1px;
-  }
-
-  &:hover {
-    filter: brightness(110%);
-  }
-`,Ie=e=>{let{style:t}=e;return(0,ze.jsx)(Ae,{href:"https://traefik.io/upgrade-traefik",target:"_blank",style:t?Le(t):{},children:(0,ze.jsx)("span",{children:"Upgrade to Traefik Hub"})})},De=e=>{let{style:t}=e;return(0,ze.jsx)(Ie,{style:t})};var Fe=n(250);!function(e){let{name:t,component:n}=e;const r=class extends HTMLElement{constructor(){super(),this.styleHost=void 0,this.mountPoint=void 0,this.styleHost=document.createElement("head"),this.mountPoint=document.createElement("div"),this.attachShadow({mode:"open"})}connectedCallback(){if(this.isConnected){var e,t;const r=Object.assign({},...Array.from(this.attributes,(e=>{let{name:t,value:n}=e;return{[t]:n}})));null===(e=this.shadowRoot)||void 0===e||e.appendChild(this.styleHost),null===(t=this.shadowRoot)||void 0===t||t.appendChild(this.mountPoint);Fe.createRoot(this.mountPoint).render((0,ze.jsx)(oe,{target:this.styleHost,children:(0,ze.jsx)(n,{...r})}))}}disconnectedCallback(){var e,t;this.isConnected||(null===(e=this.shadowRoot)||void 0===e||e.removeChild(this.mountPoint),null===(t=this.shadowRoot)||void 0===t||t.removeChild(this.styleHost))}};customElements.define(t,r)}({name:"hub-button-app",component:De})})()})();
-//# sourceMappingURL=/traefiklabs-hub-button-app/main-v1.js.map
\ No newline at end of file
diff --git a/webui/public/traefiklabs-hub-button-app/main-v1.js.map b/webui/public/traefiklabs-hub-button-app/main-v1.js.map
deleted file mode 100644
index 6f7d84ded..000000000
--- a/webui/public/traefiklabs-hub-button-app/main-v1.js.map
+++ /dev/null
@@ -1 +0,0 @@
-{"version":3,"file":"/traefiklabs-hub-button-app/main-v1.js","mappings":";wCAEA,IAAIA,EAAUC,EAAQ,KAMlBC,EAAgB,CAClBC,mBAAmB,EACnBC,aAAa,EACbC,cAAc,EACdC,cAAc,EACdC,aAAa,EACbC,iBAAiB,EACjBC,0BAA0B,EAC1BC,0BAA0B,EAC1BC,QAAQ,EACRC,WAAW,EACXC,MAAM,GAEJC,EAAgB,CAClBC,MAAM,EACNC,QAAQ,EACRC,WAAW,EACXC,QAAQ,EACRC,QAAQ,EACRC,WAAW,EACXC,OAAO,GASLC,EAAe,CACjB,UAAY,EACZC,SAAS,EACTjB,cAAc,EACdC,aAAa,EACbK,WAAW,EACXC,MAAM,GAEJW,EAAe,CAAC,EAIpB,SAASC,EAAWC,GAElB,OAAI1B,EAAQ2B,OAAOD,GACVJ,EAIFE,EAAaE,EAAoB,WAAMxB,CAChD,CAXAsB,EAAaxB,EAAQ4B,YAhBK,CACxB,UAAY,EACZC,QAAQ,EACRvB,cAAc,EACdC,aAAa,EACbK,WAAW,GAYbY,EAAaxB,EAAQ8B,MAAQR,EAY7B,IAAIS,EAAiBC,OAAOD,eACxBE,EAAsBD,OAAOC,oBAC7BC,EAAwBF,OAAOE,sBAC/BC,EAA2BH,OAAOG,yBAClCC,EAAiBJ,OAAOI,eACxBC,EAAkBL,OAAOf,UAsC7BqB,EAAOC,QArCP,SAASC,EAAqBC,EAAiBC,EAAiBC,GAC9D,GAA+B,kBAApBD,EAA8B,CAEvC,GAAIL,EAAiB,CACnB,IAAIO,EAAqBR,EAAeM,GAEpCE,GAAsBA,IAAuBP,GAC/CG,EAAqBC,EAAiBG,EAAoBD,EAE9D,CAEA,IAAIE,EAAOZ,EAAoBS,GAE3BR,IACFW,EAAOA,EAAKC,OAAOZ,EAAsBQ,KAM3C,IAHA,IAAIK,EAAgBtB,EAAWgB,GAC3BO,EAAgBvB,EAAWiB,GAEtBO,EAAI,EAAGA,EAAIJ,EAAK7B,SAAUiC,EAAG,CACpC,IAAIC,EAAML,EAAKI,GAEf,IAAKnC,EAAcoC,MAAUP,IAAaA,EAAUO,OAAWF,IAAiBA,EAAcE,OAAWH,IAAiBA,EAAcG,IAAO,CAC7I,IAAIC,EAAahB,EAAyBO,EAAiBQ,GAE3D,IAEEnB,EAAeU,EAAiBS,EAAKC,EACvC,CAAE,MAAOC,GAAI,CACf,CACF,CACF,CAEA,OAAOX,CACT,4BC3Fa,IAAIY,EAAE,oBAAoBC,QAAQA,OAAOC,IAAIC,EAAEH,EAAEC,OAAOC,IAAI,iBAAiB,MAAME,EAAEJ,EAAEC,OAAOC,IAAI,gBAAgB,MAAMH,EAAEC,EAAEC,OAAOC,IAAI,kBAAkB,MAAMG,EAAEL,EAAEC,OAAOC,IAAI,qBAAqB,MAAMI,EAAEN,EAAEC,OAAOC,IAAI,kBAAkB,MAAMK,EAAEP,EAAEC,OAAOC,IAAI,kBAAkB,MAAMM,EAAER,EAAEC,OAAOC,IAAI,iBAAiB,MAAMO,EAAET,EAAEC,OAAOC,IAAI,oBAAoB,MAAMQ,EAAEV,EAAEC,OAAOC,IAAI,yBAAyB,MAAMS,EAAEX,EAAEC,OAAOC,IAAI,qBAAqB,MAAMU,EAAEZ,EAAEC,OAAOC,IAAI,kBAAkB,MAAMW,EAAEb,EACpfC,OAAOC,IAAI,uBAAuB,MAAMY,EAAEd,EAAEC,OAAOC,IAAI,cAAc,MAAMa,EAAEf,EAAEC,OAAOC,IAAI,cAAc,MAAMc,EAAEhB,EAAEC,OAAOC,IAAI,eAAe,MAAMe,EAAEjB,EAAEC,OAAOC,IAAI,qBAAqB,MAAMgB,EAAElB,EAAEC,OAAOC,IAAI,mBAAmB,MAAMiB,EAAEnB,EAAEC,OAAOC,IAAI,eAAe,MAClQ,SAASkB,EAAEC,GAAG,GAAG,kBAAkBA,GAAG,OAAOA,EAAE,CAAC,IAAIC,EAAED,EAAEE,SAAS,OAAOD,GAAG,KAAKnB,EAAE,OAAOkB,EAAEA,EAAE7D,MAAQ,KAAKiD,EAAE,KAAKC,EAAE,KAAKX,EAAE,KAAKO,EAAE,KAAKD,EAAE,KAAKO,EAAE,OAAOS,EAAE,QAAQ,OAAOA,EAAEA,GAAGA,EAAEE,UAAY,KAAKf,EAAE,KAAKG,EAAE,KAAKI,EAAE,KAAKD,EAAE,KAAKP,EAAE,OAAOc,EAAE,QAAQ,OAAOC,GAAG,KAAKlB,EAAE,OAAOkB,EAAE,CAAC,CAAC,SAASE,EAAEH,GAAG,OAAOD,EAAEC,KAAKX,CAAC,CAACxB,EAAQuC,UAAUhB,EAAEvB,EAAQwC,eAAehB,EAAExB,EAAQyC,gBAAgBnB,EAAEtB,EAAQ0C,gBAAgBrB,EAAErB,EAAQ2C,QAAQ1B,EAAEjB,EAAQX,WAAWoC,EAAEzB,EAAQ4C,SAAS/B,EAAEb,EAAQ6C,KAAKhB,EAAE7B,EAAQT,KAAKqC,EAAE5B,EAAQ8C,OAAO5B,EAChflB,EAAQ+C,SAAS3B,EAAEpB,EAAQgD,WAAW7B,EAAEnB,EAAQiD,SAASvB,EAAE1B,EAAQkD,YAAY,SAASf,GAAG,OAAOG,EAAEH,IAAID,EAAEC,KAAKZ,CAAC,EAAEvB,EAAQmD,iBAAiBb,EAAEtC,EAAQoD,kBAAkB,SAASjB,GAAG,OAAOD,EAAEC,KAAKb,CAAC,EAAEtB,EAAQqD,kBAAkB,SAASlB,GAAG,OAAOD,EAAEC,KAAKd,CAAC,EAAErB,EAAQsD,UAAU,SAASnB,GAAG,MAAM,kBAAkBA,GAAG,OAAOA,GAAGA,EAAEE,WAAWpB,CAAC,EAAEjB,EAAQuD,aAAa,SAASpB,GAAG,OAAOD,EAAEC,KAAKV,CAAC,EAAEzB,EAAQwD,WAAW,SAASrB,GAAG,OAAOD,EAAEC,KAAKtB,CAAC,EAAEb,EAAQyD,OAAO,SAAStB,GAAG,OAAOD,EAAEC,KAAKN,CAAC,EAC1d7B,EAAQZ,OAAO,SAAS+C,GAAG,OAAOD,EAAEC,KAAKP,CAAC,EAAE5B,EAAQ0D,SAAS,SAASvB,GAAG,OAAOD,EAAEC,KAAKjB,CAAC,EAAElB,EAAQ2D,WAAW,SAASxB,GAAG,OAAOD,EAAEC,KAAKf,CAAC,EAAEpB,EAAQ4D,aAAa,SAASzB,GAAG,OAAOD,EAAEC,KAAKhB,CAAC,EAAEnB,EAAQ6D,WAAW,SAAS1B,GAAG,OAAOD,EAAEC,KAAKT,CAAC,EAC1O1B,EAAQ8D,mBAAmB,SAAS3B,GAAG,MAAM,kBAAkBA,GAAG,oBAAoBA,GAAGA,IAAItB,GAAGsB,IAAIX,GAAGW,IAAIf,GAAGe,IAAIhB,GAAGgB,IAAIT,GAAGS,IAAIR,GAAG,kBAAkBQ,GAAG,OAAOA,IAAIA,EAAEE,WAAWR,GAAGM,EAAEE,WAAWT,GAAGO,EAAEE,WAAWhB,GAAGc,EAAEE,WAAWf,GAAGa,EAAEE,WAAWZ,GAAGU,EAAEE,WAAWN,GAAGI,EAAEE,WAAWL,GAAGG,EAAEE,WAAWJ,GAAGE,EAAEE,WAAWP,EAAE,EAAE9B,EAAQ+D,OAAO7B,8BCXjUnC,EAAOC,QAAU,EAAjBD,iCCSW,IAAIiE,EAAGtG,EAAQ,KAASuG,EAAGvG,EAAQ,KAAa,SAASgE,EAAES,GAAG,IAAI,IAAIrB,EAAE,yDAAyDqB,EAAElB,EAAE,EAAEA,EAAEpC,UAAUJ,OAAOwC,IAAIH,GAAG,WAAWoD,mBAAmBrF,UAAUoC,IAAI,MAAM,yBAAyBkB,EAAE,WAAWrB,EAAE,gHAAgH,CAAC,IAAIqD,EAAG,IAAIC,IAAIC,EAAG,CAAC,EAAE,SAASC,EAAGnC,EAAErB,GAAGyD,EAAGpC,EAAErB,GAAGyD,EAAGpC,EAAE,UAAUrB,EAAE,CACxb,SAASyD,EAAGpC,EAAErB,GAAW,IAARuD,EAAGlC,GAAGrB,EAAMqB,EAAE,EAAEA,EAAErB,EAAErC,OAAO0D,IAAIgC,EAAGK,IAAI1D,EAAEqB,GAAG,CAC5D,IAAIsC,IAAK,qBAAqBC,QAAQ,qBAAqBA,OAAOC,UAAU,qBAAqBD,OAAOC,SAASC,eAAeC,EAAGpF,OAAOf,UAAUoG,eAAeC,EAAG,8VAA8VC,EACpgB,CAAC,EAAEC,EAAG,CAAC,EACiN,SAASnD,EAAEK,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,GAAG8D,KAAKC,gBAAgB,IAAIrE,GAAG,IAAIA,GAAG,IAAIA,EAAEoE,KAAKE,cAAclE,EAAEgE,KAAKG,mBAAmBxE,EAAEqE,KAAKI,gBAAgBrE,EAAEiE,KAAKK,aAAapD,EAAE+C,KAAK5G,KAAKwC,EAAEoE,KAAKM,YAAYrE,EAAE+D,KAAKO,kBAAkBrE,CAAC,CAAC,IAAIc,EAAE,CAAC,EACpb,uIAAuIwD,MAAM,KAAKC,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAE,MAAK,GAAG,EAAG,IAAG,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,YAAY,SAAS,CAAC,UAAU,OAAO,CAAC,YAAY,eAAewD,SAAQ,SAASxD,GAAG,IAAIrB,EAAEqB,EAAE,GAAGD,EAAEpB,GAAG,IAAIgB,EAAEhB,EAAE,GAAE,EAAGqB,EAAE,GAAG,MAAK,GAAG,EAAG,IAAG,CAAC,kBAAkB,YAAY,aAAa,SAASwD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAEyD,cAAc,MAAK,GAAG,EAAG,IAC1e,CAAC,cAAc,4BAA4B,YAAY,iBAAiBD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAE,MAAK,GAAG,EAAG,IAAG,8OAA8OuD,MAAM,KAAKC,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAEyD,cAAc,MAAK,GAAG,EAAG,IACxb,CAAC,UAAU,WAAW,QAAQ,YAAYD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAE,MAAK,GAAG,EAAG,IAAG,CAAC,UAAU,YAAYwD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAE,MAAK,GAAG,EAAG,IAAG,CAAC,OAAO,OAAO,OAAO,QAAQwD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAE,MAAK,GAAG,EAAG,IAAG,CAAC,UAAU,SAASwD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAEyD,cAAc,MAAK,GAAG,EAAG,IAAG,IAAIC,EAAG,gBAAgB,SAASC,EAAG3D,GAAG,OAAOA,EAAE,GAAG4D,aAAa,CAIxZ,SAASC,EAAG7D,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEqB,EAAE4C,eAAehE,GAAGoB,EAAEpB,GAAG,MAAQ,OAAOD,EAAE,IAAIA,EAAEvC,KAAK4C,KAAK,EAAEJ,EAAErC,SAAS,MAAMqC,EAAE,IAAI,MAAMA,EAAE,IAAI,MAAMA,EAAE,IAAI,MAAMA,EAAE,MAP9I,SAAYqB,EAAErB,EAAEG,EAAEC,GAAG,GAAG,OAAOJ,GAAG,qBAAqBA,GADqE,SAAYqB,EAAErB,EAAEG,EAAEC,GAAG,GAAG,OAAOD,GAAG,IAAIA,EAAE3C,KAAK,OAAM,EAAG,cAAcwC,GAAG,IAAK,WAAW,IAAK,SAAS,OAAM,EAAG,IAAK,UAAU,OAAGI,IAAc,OAAOD,GAASA,EAAEkE,gBAAmD,WAAnChD,EAAEA,EAAEyD,cAAcK,MAAM,EAAE,KAAsB,UAAU9D,GAAE,QAAQ,OAAM,EAAG,CAC/T+D,CAAG/D,EAAErB,EAAEG,EAAEC,GAAG,OAAM,EAAG,GAAGA,EAAE,OAAM,EAAG,GAAG,OAAOD,EAAE,OAAOA,EAAE3C,MAAM,KAAK,EAAE,OAAOwC,EAAE,KAAK,EAAE,OAAM,IAAKA,EAAE,KAAK,EAAE,OAAOqF,MAAMrF,GAAG,KAAK,EAAE,OAAOqF,MAAMrF,IAAI,EAAEA,EAAE,OAAM,CAAE,CAOtEsF,CAAGtF,EAAEG,EAAEJ,EAAEK,KAAKD,EAAE,MAAMC,GAAG,OAAOL,EARxK,SAAYsB,GAAG,QAAG0C,EAAGwB,KAAKpB,EAAG9C,KAAe0C,EAAGwB,KAAKrB,EAAG7C,KAAe4C,EAAGuB,KAAKnE,GAAU8C,EAAG9C,IAAG,GAAG6C,EAAG7C,IAAG,GAAS,GAAE,CAQwDoE,CAAGzF,KAAK,OAAOG,EAAEkB,EAAEqE,gBAAgB1F,GAAGqB,EAAEsE,aAAa3F,EAAE,GAAGG,IAAIJ,EAAEyE,gBAAgBnD,EAAEtB,EAAE0E,cAAc,OAAOtE,EAAE,IAAIJ,EAAEvC,MAAQ,GAAG2C,GAAGH,EAAED,EAAEuE,cAAclE,EAAEL,EAAEwE,mBAAmB,OAAOpE,EAAEkB,EAAEqE,gBAAgB1F,IAAaG,EAAE,KAAXJ,EAAEA,EAAEvC,OAAc,IAAIuC,IAAG,IAAKI,EAAE,GAAG,GAAGA,EAAEC,EAAEiB,EAAEuE,eAAexF,EAAEJ,EAAEG,GAAGkB,EAAEsE,aAAa3F,EAAEG,KAAI,CAHjd,0jCAA0jCyE,MAAM,KAAKC,SAAQ,SAASxD,GAAG,IAAIrB,EAAEqB,EAAEwE,QAAQd,EACzmCC,GAAI5D,EAAEpB,GAAG,IAAIgB,EAAEhB,EAAE,GAAE,EAAGqB,EAAE,MAAK,GAAG,EAAG,IAAG,2EAA2EuD,MAAM,KAAKC,SAAQ,SAASxD,GAAG,IAAIrB,EAAEqB,EAAEwE,QAAQd,EAAGC,GAAI5D,EAAEpB,GAAG,IAAIgB,EAAEhB,EAAE,GAAE,EAAGqB,EAAE,gCAA+B,GAAG,EAAG,IAAG,CAAC,WAAW,WAAW,aAAawD,SAAQ,SAASxD,GAAG,IAAIrB,EAAEqB,EAAEwE,QAAQd,EAAGC,GAAI5D,EAAEpB,GAAG,IAAIgB,EAAEhB,EAAE,GAAE,EAAGqB,EAAE,wCAAuC,GAAG,EAAG,IAAG,CAAC,WAAW,eAAewD,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAEyD,cAAc,MAAK,GAAG,EAAG,IACld1D,EAAE0E,UAAU,IAAI9E,EAAE,YAAY,GAAE,EAAG,aAAa,gCAA+B,GAAG,GAAI,CAAC,MAAM,OAAO,SAAS,cAAc6D,SAAQ,SAASxD,GAAGD,EAAEC,GAAG,IAAIL,EAAEK,EAAE,GAAE,EAAGA,EAAEyD,cAAc,MAAK,GAAG,EAAG,IAE5L,IAAIiB,EAAG7C,EAAG8C,mDAAmDC,EAAGhG,OAAOC,IAAI,iBAAiBgG,EAAGjG,OAAOC,IAAI,gBAAgBiG,EAAGlG,OAAOC,IAAI,kBAAkBkG,EAAGnG,OAAOC,IAAI,qBAAqBmG,EAAGpG,OAAOC,IAAI,kBAAkBoG,EAAGrG,OAAOC,IAAI,kBAAkBqG,EAAGtG,OAAOC,IAAI,iBAAiBsG,EAAGvG,OAAOC,IAAI,qBAAqBuG,EAAGxG,OAAOC,IAAI,kBAAkBwG,EAAGzG,OAAOC,IAAI,uBAAuByG,EAAG1G,OAAOC,IAAI,cAAc0G,EAAG3G,OAAOC,IAAI,cAAcD,OAAOC,IAAI,eAAeD,OAAOC,IAAI,0BACje,IAAI2G,EAAG5G,OAAOC,IAAI,mBAAmBD,OAAOC,IAAI,uBAAuBD,OAAOC,IAAI,eAAeD,OAAOC,IAAI,wBAAwB,IAAI4G,EAAG7G,OAAO8G,SAAS,SAASC,EAAG3F,GAAG,OAAG,OAAOA,GAAG,kBAAkBA,EAAS,KAAwC,oBAAnCA,EAAEyF,GAAIzF,EAAEyF,IAAKzF,EAAE,eAA0CA,EAAE,IAAI,CAAC,IAAoB4F,EAAhBzF,EAAE7C,OAAOuI,OAAU,SAASC,EAAG9F,GAAG,QAAG,IAAS4F,EAAG,IAAI,MAAMG,OAAQ,CAAC,MAAMjH,GAAG,IAAIH,EAAEG,EAAEkH,MAAMC,OAAOC,MAAM,gBAAgBN,EAAGjH,GAAGA,EAAE,IAAI,EAAE,CAAC,MAAM,KAAKiH,EAAG5F,CAAC,CAAC,IAAImG,GAAG,EACzb,SAASC,EAAGpG,EAAErB,GAAG,IAAIqB,GAAGmG,EAAG,MAAM,GAAGA,GAAG,EAAG,IAAIrH,EAAEiH,MAAMM,kBAAkBN,MAAMM,uBAAkB,EAAO,IAAI,GAAG1H,EAAE,GAAGA,EAAE,WAAW,MAAMoH,OAAQ,EAAEzI,OAAOD,eAAesB,EAAEpC,UAAU,QAAQ,CAAC+J,IAAI,WAAW,MAAMP,OAAQ,IAAI,kBAAkBQ,SAASA,QAAQC,UAAU,CAAC,IAAID,QAAQC,UAAU7H,EAAE,GAAG,CAAC,MAAMS,GAAG,IAAIL,EAAEK,CAAC,CAACmH,QAAQC,UAAUxG,EAAE,GAAGrB,EAAE,KAAK,CAAC,IAAIA,EAAEuF,MAAM,CAAC,MAAM9E,GAAGL,EAAEK,CAAC,CAACY,EAAEkE,KAAKvF,EAAEpC,UAAU,KAAK,CAAC,IAAI,MAAMwJ,OAAQ,CAAC,MAAM3G,GAAGL,EAAEK,CAAC,CAACY,GAAG,CAAC,CAAC,MAAMZ,GAAG,GAAGA,GAAGL,GAAG,kBAAkBK,EAAE4G,MAAM,CAAC,IAAI,IAAItH,EAAEU,EAAE4G,MAAMzC,MAAM,MACnfvE,EAAED,EAAEiH,MAAMzC,MAAM,MAAMtE,EAAEP,EAAEpC,OAAO,EAAE4C,EAAEF,EAAE1C,OAAO,EAAE,GAAG2C,GAAG,GAAGC,GAAGR,EAAEO,KAAKD,EAAEE,IAAIA,IAAI,KAAK,GAAGD,GAAG,GAAGC,EAAED,IAAIC,IAAI,GAAGR,EAAEO,KAAKD,EAAEE,GAAG,CAAC,GAAG,IAAID,GAAG,IAAIC,EAAG,MAAMD,IAAQ,IAAJC,GAASR,EAAEO,KAAKD,EAAEE,GAAG,CAAC,IAAIC,EAAE,KAAKT,EAAEO,GAAGuF,QAAQ,WAAW,QAA6F,OAArFxE,EAAEnE,aAAasD,EAAEsH,SAAS,iBAAiBtH,EAAEA,EAAEqF,QAAQ,cAAcxE,EAAEnE,cAAqBsD,CAAC,QAAO,GAAGF,GAAG,GAAGC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQiH,GAAG,EAAGJ,MAAMM,kBAAkBvH,CAAC,CAAC,OAAOkB,EAAEA,EAAEA,EAAEnE,aAAamE,EAAE3D,KAAK,IAAIyJ,EAAG9F,GAAG,EAAE,CAC9Z,SAAS0G,EAAG1G,GAAG,OAAOA,EAAE2G,KAAK,KAAK,EAAE,OAAOb,EAAG9F,EAAE7D,MAAM,KAAK,GAAG,OAAO2J,EAAG,QAAQ,KAAK,GAAG,OAAOA,EAAG,YAAY,KAAK,GAAG,OAAOA,EAAG,gBAAgB,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO9F,EAAEoG,EAAGpG,EAAE7D,MAAK,GAAM,KAAK,GAAG,OAAO6D,EAAEoG,EAAGpG,EAAE7D,KAAKgB,QAAO,GAAM,KAAK,EAAE,OAAO6C,EAAEoG,EAAGpG,EAAE7D,MAAK,GAAM,QAAQ,MAAM,GAAG,CACxR,SAASyK,EAAG5G,GAAG,GAAG,MAAMA,EAAE,OAAO,KAAK,GAAG,oBAAoBA,EAAE,OAAOA,EAAEnE,aAAamE,EAAE3D,MAAM,KAAK,GAAG,kBAAkB2D,EAAE,OAAOA,EAAE,OAAOA,GAAG,KAAK8E,EAAG,MAAM,WAAW,KAAKD,EAAG,MAAM,SAAS,KAAKG,EAAG,MAAM,WAAW,KAAKD,EAAG,MAAM,aAAa,KAAKK,EAAG,MAAM,WAAW,KAAKC,EAAG,MAAM,eAAe,GAAG,kBAAkBrF,EAAE,OAAOA,EAAEE,UAAU,KAAKgF,EAAG,OAAOlF,EAAEnE,aAAa,WAAW,YAAY,KAAKoJ,EAAG,OAAOjF,EAAE6G,SAAShL,aAAa,WAAW,YAAY,KAAKsJ,EAAG,IAAIxG,EAAEqB,EAAE7C,OAC7Z,OADoa6C,EAAEA,EAAEnE,eACndmE,EAAE,MADieA,EAAErB,EAAE9C,aAClf8C,EAAEtC,MAAM,IAAY,cAAc2D,EAAE,IAAI,cAAqBA,EAAE,KAAKsF,EAAG,OAA6B,QAAtB3G,EAAEqB,EAAEnE,aAAa,MAAc8C,EAAEiI,EAAG5G,EAAE7D,OAAO,OAAO,KAAKoJ,EAAG5G,EAAEqB,EAAE8G,SAAS9G,EAAEA,EAAE+G,MAAM,IAAI,OAAOH,EAAG5G,EAAErB,GAAG,CAAC,MAAMG,GAAG,EAAE,OAAO,IAAI,CAC3M,SAASkI,EAAGhH,GAAG,IAAIrB,EAAEqB,EAAE7D,KAAK,OAAO6D,EAAE2G,KAAK,KAAK,GAAG,MAAM,QAAQ,KAAK,EAAE,OAAOhI,EAAE9C,aAAa,WAAW,YAAY,KAAK,GAAG,OAAO8C,EAAEkI,SAAShL,aAAa,WAAW,YAAY,KAAK,GAAG,MAAM,qBAAqB,KAAK,GAAG,OAAkBmE,GAAXA,EAAErB,EAAExB,QAAWtB,aAAamE,EAAE3D,MAAM,GAAGsC,EAAE9C,cAAc,KAAKmE,EAAE,cAAcA,EAAE,IAAI,cAAc,KAAK,EAAE,MAAM,WAAW,KAAK,EAAE,OAAOrB,EAAE,KAAK,EAAE,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,OAAOiI,EAAGjI,GAAG,KAAK,EAAE,OAAOA,IAAIoG,EAAG,aAAa,OAAO,KAAK,GAAG,MAAM,YACtf,KAAK,GAAG,MAAM,WAAW,KAAK,GAAG,MAAM,QAAQ,KAAK,GAAG,MAAM,WAAW,KAAK,GAAG,MAAM,eAAe,KAAK,GAAG,MAAM,gBAAgB,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,GAAG,oBAAoBpG,EAAE,OAAOA,EAAE9C,aAAa8C,EAAEtC,MAAM,KAAK,GAAG,kBAAkBsC,EAAE,OAAOA,EAAE,OAAO,IAAI,CAAC,SAASsI,EAAGjH,GAAG,cAAcA,GAAG,IAAK,UAAU,IAAK,SAAS,IAAK,SAAS,IAAK,YAAqB,IAAK,SAAS,OAAOA,EAAE,QAAQ,MAAM,GAAG,CACra,SAASkH,EAAGlH,GAAG,IAAIrB,EAAEqB,EAAE7D,KAAK,OAAO6D,EAAEA,EAAEmH,WAAW,UAAUnH,EAAEyD,gBAAgB,aAAa9E,GAAG,UAAUA,EAAE,CAEtF,SAASyI,EAAGpH,GAAGA,EAAEqH,gBAAgBrH,EAAEqH,cADvD,SAAYrH,GAAG,IAAIrB,EAAEuI,EAAGlH,GAAG,UAAU,QAAQlB,EAAExB,OAAOG,yBAAyBuC,EAAEsH,YAAY/K,UAAUoC,GAAGI,EAAE,GAAGiB,EAAErB,GAAG,IAAIqB,EAAE2C,eAAehE,IAAI,qBAAqBG,GAAG,oBAAoBA,EAAEyI,KAAK,oBAAoBzI,EAAEwH,IAAI,CAAC,IAAI5H,EAAEI,EAAEyI,IAAIvI,EAAEF,EAAEwH,IAAiL,OAA7KhJ,OAAOD,eAAe2C,EAAErB,EAAE,CAAC6I,cAAa,EAAGD,IAAI,WAAW,OAAO7I,EAAEwF,KAAKnB,KAAK,EAAEuD,IAAI,SAAStG,GAAGjB,EAAE,GAAGiB,EAAEhB,EAAEkF,KAAKnB,KAAK/C,EAAE,IAAI1C,OAAOD,eAAe2C,EAAErB,EAAE,CAAC8I,WAAW3I,EAAE2I,aAAmB,CAACC,SAAS,WAAW,OAAO3I,CAAC,EAAE4I,SAAS,SAAS3H,GAAGjB,EAAE,GAAGiB,CAAC,EAAE4H,aAAa,WAAW5H,EAAEqH,cACxf,YAAYrH,EAAErB,EAAE,EAAE,CAAC,CAAkDkJ,CAAG7H,GAAG,CAAC,SAAS8H,EAAG9H,GAAG,IAAIA,EAAE,OAAM,EAAG,IAAIrB,EAAEqB,EAAEqH,cAAc,IAAI1I,EAAE,OAAM,EAAG,IAAIG,EAAEH,EAAE+I,WAAe3I,EAAE,GAAqD,OAAlDiB,IAAIjB,EAAEmI,EAAGlH,GAAGA,EAAE+H,QAAQ,OAAO,QAAQ/H,EAAEgI,QAAOhI,EAAEjB,KAAaD,IAAGH,EAAEgJ,SAAS3H,IAAG,EAAM,CAAC,SAASiI,EAAGjI,GAAwD,GAAG,qBAAxDA,EAAEA,IAAI,qBAAqBwC,SAASA,cAAS,IAAkC,OAAO,KAAK,IAAI,OAAOxC,EAAEkI,eAAelI,EAAEmI,IAAI,CAAC,MAAMxJ,GAAG,OAAOqB,EAAEmI,IAAI,CAAC,CACpa,SAASC,EAAGpI,EAAErB,GAAG,IAAIG,EAAEH,EAAEoJ,QAAQ,OAAO5H,EAAE,CAAC,EAAExB,EAAE,CAAC0J,oBAAe,EAAOC,kBAAa,EAAON,WAAM,EAAOD,QAAQ,MAAMjJ,EAAEA,EAAEkB,EAAEuI,cAAcC,gBAAgB,CAAC,SAASC,EAAGzI,EAAErB,GAAG,IAAIG,EAAE,MAAMH,EAAE2J,aAAa,GAAG3J,EAAE2J,aAAavJ,EAAE,MAAMJ,EAAEoJ,QAAQpJ,EAAEoJ,QAAQpJ,EAAE0J,eAAevJ,EAAEmI,EAAG,MAAMtI,EAAEqJ,MAAMrJ,EAAEqJ,MAAMlJ,GAAGkB,EAAEuI,cAAc,CAACC,eAAezJ,EAAE2J,aAAa5J,EAAE6J,WAAW,aAAahK,EAAExC,MAAM,UAAUwC,EAAExC,KAAK,MAAMwC,EAAEoJ,QAAQ,MAAMpJ,EAAEqJ,MAAM,CAAC,SAASY,EAAG5I,EAAErB,GAAe,OAAZA,EAAEA,EAAEoJ,UAAiBlE,EAAG7D,EAAE,UAAUrB,GAAE,EAAG,CAC9d,SAASkK,EAAG7I,EAAErB,GAAGiK,EAAG5I,EAAErB,GAAG,IAAIG,EAAEmI,EAAGtI,EAAEqJ,OAAOjJ,EAAEJ,EAAExC,KAAK,GAAG,MAAM2C,EAAK,WAAWC,GAAM,IAAID,GAAG,KAAKkB,EAAEgI,OAAOhI,EAAEgI,OAAOlJ,KAAEkB,EAAEgI,MAAM,GAAGlJ,GAAOkB,EAAEgI,QAAQ,GAAGlJ,IAAIkB,EAAEgI,MAAM,GAAGlJ,QAAQ,GAAG,WAAWC,GAAG,UAAUA,EAA8B,YAA3BiB,EAAEqE,gBAAgB,SAAgB1F,EAAEgE,eAAe,SAASmG,GAAG9I,EAAErB,EAAExC,KAAK2C,GAAGH,EAAEgE,eAAe,iBAAiBmG,GAAG9I,EAAErB,EAAExC,KAAK8K,EAAGtI,EAAE2J,eAAe,MAAM3J,EAAEoJ,SAAS,MAAMpJ,EAAE0J,iBAAiBrI,EAAEqI,iBAAiB1J,EAAE0J,eAAe,CACla,SAASU,EAAG/I,EAAErB,EAAEG,GAAG,GAAGH,EAAEgE,eAAe,UAAUhE,EAAEgE,eAAe,gBAAgB,CAAC,IAAI5D,EAAEJ,EAAExC,KAAK,KAAK,WAAW4C,GAAG,UAAUA,QAAG,IAASJ,EAAEqJ,OAAO,OAAOrJ,EAAEqJ,OAAO,OAAOrJ,EAAE,GAAGqB,EAAEuI,cAAcG,aAAa5J,GAAGH,IAAIqB,EAAEgI,QAAQhI,EAAEgI,MAAMrJ,GAAGqB,EAAEsI,aAAa3J,CAAC,CAAU,MAATG,EAAEkB,EAAE3D,QAAc2D,EAAE3D,KAAK,IAAI2D,EAAEqI,iBAAiBrI,EAAEuI,cAAcC,eAAe,KAAK1J,IAAIkB,EAAE3D,KAAKyC,EAAE,CACzV,SAASgK,GAAG9I,EAAErB,EAAEG,GAAM,WAAWH,GAAGsJ,EAAGjI,EAAEgJ,iBAAiBhJ,IAAE,MAAMlB,EAAEkB,EAAEsI,aAAa,GAAGtI,EAAEuI,cAAcG,aAAa1I,EAAEsI,eAAe,GAAGxJ,IAAIkB,EAAEsI,aAAa,GAAGxJ,GAAE,CAAC,IAAImK,GAAGC,MAAMC,QAC7K,SAASC,GAAGpJ,EAAErB,EAAEG,EAAEC,GAAe,GAAZiB,EAAEA,EAAEqJ,QAAW1K,EAAE,CAACA,EAAE,CAAC,EAAE,IAAI,IAAID,EAAE,EAAEA,EAAEI,EAAExC,OAAOoC,IAAIC,EAAE,IAAIG,EAAEJ,KAAI,EAAG,IAAII,EAAE,EAAEA,EAAEkB,EAAE1D,OAAOwC,IAAIJ,EAAEC,EAAEgE,eAAe,IAAI3C,EAAElB,GAAGkJ,OAAOhI,EAAElB,GAAGwK,WAAW5K,IAAIsB,EAAElB,GAAGwK,SAAS5K,GAAGA,GAAGK,IAAIiB,EAAElB,GAAGyK,iBAAgB,EAAG,KAAK,CAAmB,IAAlBzK,EAAE,GAAGmI,EAAGnI,GAAGH,EAAE,KAASD,EAAE,EAAEA,EAAEsB,EAAE1D,OAAOoC,IAAI,CAAC,GAAGsB,EAAEtB,GAAGsJ,QAAQlJ,EAAiD,OAA9CkB,EAAEtB,GAAG4K,UAAS,OAAGvK,IAAIiB,EAAEtB,GAAG6K,iBAAgB,IAAW,OAAO5K,GAAGqB,EAAEtB,GAAG8K,WAAW7K,EAAEqB,EAAEtB,GAAG,CAAC,OAAOC,IAAIA,EAAE2K,UAAS,EAAG,CAAC,CACxY,SAASG,GAAGzJ,EAAErB,GAAG,GAAG,MAAMA,EAAE+K,wBAAwB,MAAM3D,MAAMxG,EAAE,KAAK,OAAOY,EAAE,CAAC,EAAExB,EAAE,CAACqJ,WAAM,EAAOM,kBAAa,EAAOqB,SAAS,GAAG3J,EAAEuI,cAAcG,cAAc,CAAC,SAASkB,GAAG5J,EAAErB,GAAG,IAAIG,EAAEH,EAAEqJ,MAAM,GAAG,MAAMlJ,EAAE,CAA+B,GAA9BA,EAAEH,EAAEgL,SAAShL,EAAEA,EAAE2J,aAAgB,MAAMxJ,EAAE,CAAC,GAAG,MAAMH,EAAE,MAAMoH,MAAMxG,EAAE,KAAK,GAAG0J,GAAGnK,GAAG,CAAC,GAAG,EAAEA,EAAExC,OAAO,MAAMyJ,MAAMxG,EAAE,KAAKT,EAAEA,EAAE,EAAE,CAACH,EAAEG,CAAC,CAAC,MAAMH,IAAIA,EAAE,IAAIG,EAAEH,CAAC,CAACqB,EAAEuI,cAAc,CAACG,aAAazB,EAAGnI,GAAG,CACnY,SAAS+K,GAAG7J,EAAErB,GAAG,IAAIG,EAAEmI,EAAGtI,EAAEqJ,OAAOjJ,EAAEkI,EAAGtI,EAAE2J,cAAc,MAAMxJ,KAAIA,EAAE,GAAGA,KAAMkB,EAAEgI,QAAQhI,EAAEgI,MAAMlJ,GAAG,MAAMH,EAAE2J,cAActI,EAAEsI,eAAexJ,IAAIkB,EAAEsI,aAAaxJ,IAAI,MAAMC,IAAIiB,EAAEsI,aAAa,GAAGvJ,EAAE,CAAC,SAAS+K,GAAG9J,GAAG,IAAIrB,EAAEqB,EAAE+J,YAAYpL,IAAIqB,EAAEuI,cAAcG,cAAc,KAAK/J,GAAG,OAAOA,IAAIqB,EAAEgI,MAAMrJ,EAAE,CAAC,SAASqL,GAAGhK,GAAG,OAAOA,GAAG,IAAK,MAAM,MAAM,6BAA6B,IAAK,OAAO,MAAM,qCAAqC,QAAQ,MAAM,+BAA+B,CAC7c,SAASiK,GAAGjK,EAAErB,GAAG,OAAO,MAAMqB,GAAG,iCAAiCA,EAAEgK,GAAGrL,GAAG,+BAA+BqB,GAAG,kBAAkBrB,EAAE,+BAA+BqB,CAAC,CAChK,IAAIkK,GAAelK,GAAZmK,IAAYnK,GAAsJ,SAASA,EAAErB,GAAG,GAAG,+BAA+BqB,EAAEoK,cAAc,cAAcpK,EAAEA,EAAEqK,UAAU1L,MAAM,CAA2F,KAA1FuL,GAAGA,IAAI1H,SAASC,cAAc,QAAU4H,UAAU,QAAQ1L,EAAE2L,UAAUC,WAAW,SAAa5L,EAAEuL,GAAGM,WAAWxK,EAAEwK,YAAYxK,EAAEyK,YAAYzK,EAAEwK,YAAY,KAAK7L,EAAE6L,YAAYxK,EAAE0K,YAAY/L,EAAE6L,WAAW,CAAC,EAAvb,qBAAqBG,OAAOA,MAAMC,wBAAwB,SAASjM,EAAEG,EAAEC,EAAEL,GAAGiM,MAAMC,yBAAwB,WAAW,OAAO5K,GAAErB,EAAEG,EAAM,GAAE,EAAEkB,IACtK,SAAS6K,GAAG7K,EAAErB,GAAG,GAAGA,EAAE,CAAC,IAAIG,EAAEkB,EAAEwK,WAAW,GAAG1L,GAAGA,IAAIkB,EAAE8K,WAAW,IAAIhM,EAAEiM,SAAwB,YAAdjM,EAAEkM,UAAUrM,EAAS,CAACqB,EAAE+J,YAAYpL,CAAC,CACtH,IAAIsM,GAAG,CAACC,yBAAwB,EAAGC,aAAY,EAAGC,mBAAkB,EAAGC,kBAAiB,EAAGC,kBAAiB,EAAGC,SAAQ,EAAGC,cAAa,EAAGC,iBAAgB,EAAGC,aAAY,EAAGC,SAAQ,EAAGC,MAAK,EAAGC,UAAS,EAAGC,cAAa,EAAGC,YAAW,EAAGC,cAAa,EAAGC,WAAU,EAAGC,UAAS,EAAGC,SAAQ,EAAGC,YAAW,EAAGC,aAAY,EAAGC,cAAa,EAAGC,YAAW,EAAGC,eAAc,EAAGC,gBAAe,EAAGC,iBAAgB,EAAGC,YAAW,EAAGC,WAAU,EAAGC,YAAW,EAAGC,SAAQ,EAAGC,OAAM,EAAGC,SAAQ,EAAGC,SAAQ,EAAGC,QAAO,EAAGC,QAAO,EAClfC,MAAK,EAAGC,aAAY,EAAGC,cAAa,EAAGC,aAAY,EAAGC,iBAAgB,EAAGC,kBAAiB,EAAGC,kBAAiB,EAAGC,eAAc,EAAGC,aAAY,GAAIC,GAAG,CAAC,SAAS,KAAK,MAAM,KAA6H,SAASC,GAAG9N,EAAErB,EAAEG,GAAG,OAAO,MAAMH,GAAG,mBAAmBA,GAAG,KAAKA,EAAE,GAAGG,GAAG,kBAAkBH,GAAG,IAAIA,GAAGsM,GAAGtI,eAAe3C,IAAIiL,GAAGjL,IAAI,GAAGrB,GAAGsH,OAAOtH,EAAE,IAAI,CACzb,SAASoP,GAAG/N,EAAErB,GAAa,IAAI,IAAIG,KAAlBkB,EAAEA,EAAEgO,MAAmBrP,EAAE,GAAGA,EAAEgE,eAAe7D,GAAG,CAAC,IAAIC,EAAE,IAAID,EAAEmP,QAAQ,MAAMvP,EAAEoP,GAAGhP,EAAEH,EAAEG,GAAGC,GAAG,UAAUD,IAAIA,EAAE,YAAYC,EAAEiB,EAAEkO,YAAYpP,EAAEJ,GAAGsB,EAAElB,GAAGJ,CAAC,CAAC,CADYpB,OAAOa,KAAK8M,IAAIzH,SAAQ,SAASxD,GAAG6N,GAAGrK,SAAQ,SAAS7E,GAAGA,EAAEA,EAAEqB,EAAEmO,OAAO,GAAGvK,cAAc5D,EAAEoO,UAAU,GAAGnD,GAAGtM,GAAGsM,GAAGjL,EAAE,GAAE,IAChI,IAAIqO,GAAGlO,EAAE,CAACmO,UAAS,GAAI,CAACC,MAAK,EAAGC,MAAK,EAAGC,IAAG,EAAGC,KAAI,EAAGC,OAAM,EAAGC,IAAG,EAAGC,KAAI,EAAGC,OAAM,EAAGC,QAAO,EAAGC,MAAK,EAAGC,MAAK,EAAGC,OAAM,EAAGC,QAAO,EAAGC,OAAM,EAAGC,KAAI,IAClT,SAASC,GAAGtP,EAAErB,GAAG,GAAGA,EAAE,CAAC,GAAG0P,GAAGrO,KAAK,MAAMrB,EAAEgL,UAAU,MAAMhL,EAAE+K,yBAAyB,MAAM3D,MAAMxG,EAAE,IAAIS,IAAI,GAAG,MAAMrB,EAAE+K,wBAAwB,CAAC,GAAG,MAAM/K,EAAEgL,SAAS,MAAM5D,MAAMxG,EAAE,KAAK,GAAG,kBAAkBZ,EAAE+K,2BAA2B,WAAW/K,EAAE+K,yBAAyB,MAAM3D,MAAMxG,EAAE,IAAK,CAAC,GAAG,MAAMZ,EAAEqP,OAAO,kBAAkBrP,EAAEqP,MAAM,MAAMjI,MAAMxG,EAAE,IAAK,CAAC,CAClW,SAASgQ,GAAGvP,EAAErB,GAAG,IAAI,IAAIqB,EAAEiO,QAAQ,KAAK,MAAM,kBAAkBtP,EAAE6Q,GAAG,OAAOxP,GAAG,IAAK,iBAAiB,IAAK,gBAAgB,IAAK,YAAY,IAAK,gBAAgB,IAAK,gBAAgB,IAAK,mBAAmB,IAAK,iBAAiB,IAAK,gBAAgB,OAAM,EAAG,QAAQ,OAAM,EAAG,CAAC,IAAIyP,GAAG,KAAK,SAASC,GAAG1P,GAA6F,OAA1FA,EAAEA,EAAE2P,QAAQ3P,EAAE4P,YAAYrN,QAASsN,0BAA0B7P,EAAEA,EAAE6P,yBAAgC,IAAI7P,EAAE+K,SAAS/K,EAAE8P,WAAW9P,CAAC,CAAC,IAAI+P,GAAG,KAAKC,GAAG,KAAKC,GAAG,KACpc,SAASC,GAAGlQ,GAAG,GAAGA,EAAEmQ,GAAGnQ,GAAG,CAAC,GAAG,oBAAoB+P,GAAG,MAAMhK,MAAMxG,EAAE,MAAM,IAAIZ,EAAEqB,EAAEoQ,UAAUzR,IAAIA,EAAE0R,GAAG1R,GAAGoR,GAAG/P,EAAEoQ,UAAUpQ,EAAE7D,KAAKwC,GAAG,CAAC,CAAC,SAAS2R,GAAGtQ,GAAGgQ,GAAGC,GAAGA,GAAGM,KAAKvQ,GAAGiQ,GAAG,CAACjQ,GAAGgQ,GAAGhQ,CAAC,CAAC,SAASwQ,KAAK,GAAGR,GAAG,CAAC,IAAIhQ,EAAEgQ,GAAGrR,EAAEsR,GAAoB,GAAjBA,GAAGD,GAAG,KAAKE,GAAGlQ,GAAMrB,EAAE,IAAIqB,EAAE,EAAEA,EAAErB,EAAErC,OAAO0D,IAAIkQ,GAAGvR,EAAEqB,GAAG,CAAC,CAAC,SAASyQ,GAAGzQ,EAAErB,GAAG,OAAOqB,EAAErB,EAAE,CAAC,SAAS+R,KAAK,CAAC,IAAIC,IAAG,EAAG,SAASC,GAAG5Q,EAAErB,EAAEG,GAAG,GAAG6R,GAAG,OAAO3Q,EAAErB,EAAEG,GAAG6R,IAAG,EAAG,IAAI,OAAOF,GAAGzQ,EAAErB,EAAEG,EAAE,CAAC,QAAW6R,IAAG,GAAG,OAAOX,IAAI,OAAOC,MAAGS,KAAKF,KAAI,CAAC,CAChb,SAASK,GAAG7Q,EAAErB,GAAG,IAAIG,EAAEkB,EAAEoQ,UAAU,GAAG,OAAOtR,EAAE,OAAO,KAAK,IAAIC,EAAEsR,GAAGvR,GAAG,GAAG,OAAOC,EAAE,OAAO,KAAKD,EAAEC,EAAEJ,GAAGqB,EAAE,OAAOrB,GAAG,IAAK,UAAU,IAAK,iBAAiB,IAAK,gBAAgB,IAAK,uBAAuB,IAAK,cAAc,IAAK,qBAAqB,IAAK,cAAc,IAAK,qBAAqB,IAAK,YAAY,IAAK,mBAAmB,IAAK,gBAAgBI,GAAGA,EAAEyK,YAAqBzK,IAAI,YAAbiB,EAAEA,EAAE7D,OAAuB,UAAU6D,GAAG,WAAWA,GAAG,aAAaA,IAAIA,GAAGjB,EAAE,MAAMiB,EAAE,QAAQA,GAAE,EAAG,GAAGA,EAAE,OAAO,KAAK,GAAGlB,GAAG,oBACleA,EAAE,MAAMiH,MAAMxG,EAAE,IAAIZ,SAASG,IAAI,OAAOA,CAAC,CAAC,IAAIgS,IAAG,EAAG,GAAGxO,EAAG,IAAI,IAAIyO,GAAG,CAAC,EAAEzT,OAAOD,eAAe0T,GAAG,UAAU,CAACxJ,IAAI,WAAWuJ,IAAG,CAAE,IAAIvO,OAAOyO,iBAAiB,OAAOD,GAAGA,IAAIxO,OAAO0O,oBAAoB,OAAOF,GAAGA,GAAG,CAAC,MAAM/Q,IAAG8Q,IAAG,CAAE,CAAC,SAASI,GAAGlR,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,EAAEC,EAAEC,GAAG,IAAIC,EAAE8J,MAAM3M,UAAUuH,MAAMI,KAAKxH,UAAU,GAAG,IAAIiC,EAAEwS,MAAMrS,EAAEM,EAAE,CAAC,MAAMC,GAAG0D,KAAKqO,QAAQ/R,EAAE,CAAC,CAAC,IAAIgS,IAAG,EAAGC,GAAG,KAAKC,IAAG,EAAGC,GAAG,KAAKC,GAAG,CAACL,QAAQ,SAASpR,GAAGqR,IAAG,EAAGC,GAAGtR,CAAC,GAAG,SAAS0R,GAAG1R,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,EAAEC,EAAEC,GAAGkS,IAAG,EAAGC,GAAG,KAAKJ,GAAGC,MAAMM,GAAG/U,UAAU,CACjW,SAASiV,GAAG3R,GAAG,IAAIrB,EAAEqB,EAAElB,EAAEkB,EAAE,GAAGA,EAAE4R,UAAU,KAAKjT,EAAEkT,QAAQlT,EAAEA,EAAEkT,WAAW,CAAC7R,EAAErB,EAAE,GAAO,KAAa,MAAjBA,EAAEqB,GAAS8R,SAAchT,EAAEH,EAAEkT,QAAQ7R,EAAErB,EAAEkT,aAAa7R,EAAE,CAAC,OAAO,IAAIrB,EAAEgI,IAAI7H,EAAE,IAAI,CAAC,SAASiT,GAAG/R,GAAG,GAAG,KAAKA,EAAE2G,IAAI,CAAC,IAAIhI,EAAEqB,EAAEgS,cAAsE,GAAxD,OAAOrT,IAAkB,QAAdqB,EAAEA,EAAE4R,aAAqBjT,EAAEqB,EAAEgS,gBAAmB,OAAOrT,EAAE,OAAOA,EAAEsT,UAAU,CAAC,OAAO,IAAI,CAAC,SAASC,GAAGlS,GAAG,GAAG2R,GAAG3R,KAAKA,EAAE,MAAM+F,MAAMxG,EAAE,KAAM,CAE1S,SAAS4S,GAAGnS,GAAW,OAAO,QAAfA,EADtN,SAAYA,GAAG,IAAIrB,EAAEqB,EAAE4R,UAAU,IAAIjT,EAAE,CAAS,GAAG,QAAXA,EAAEgT,GAAG3R,IAAe,MAAM+F,MAAMxG,EAAE,MAAM,OAAOZ,IAAIqB,EAAE,KAAKA,CAAC,CAAC,IAAI,IAAIlB,EAAEkB,EAAEjB,EAAEJ,IAAI,CAAC,IAAID,EAAEI,EAAE+S,OAAO,GAAG,OAAOnT,EAAE,MAAM,IAAIM,EAAEN,EAAEkT,UAAU,GAAG,OAAO5S,EAAE,CAAY,GAAG,QAAdD,EAAEL,EAAEmT,QAAmB,CAAC/S,EAAEC,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAGL,EAAE0T,QAAQpT,EAAEoT,MAAM,CAAC,IAAIpT,EAAEN,EAAE0T,MAAMpT,GAAG,CAAC,GAAGA,IAAIF,EAAE,OAAOoT,GAAGxT,GAAGsB,EAAE,GAAGhB,IAAID,EAAE,OAAOmT,GAAGxT,GAAGC,EAAEK,EAAEA,EAAEqT,OAAO,CAAC,MAAMtM,MAAMxG,EAAE,KAAM,CAAC,GAAGT,EAAE+S,SAAS9S,EAAE8S,OAAO/S,EAAEJ,EAAEK,EAAEC,MAAM,CAAC,IAAI,IAAIC,GAAE,EAAGC,EAAER,EAAE0T,MAAMlT,GAAG,CAAC,GAAGA,IAAIJ,EAAE,CAACG,GAAE,EAAGH,EAAEJ,EAAEK,EAAEC,EAAE,KAAK,CAAC,GAAGE,IAAIH,EAAE,CAACE,GAAE,EAAGF,EAAEL,EAAEI,EAAEE,EAAE,KAAK,CAACE,EAAEA,EAAEmT,OAAO,CAAC,IAAIpT,EAAE,CAAC,IAAIC,EAAEF,EAAEoT,MAAMlT,GAAG,CAAC,GAAGA,IAC5fJ,EAAE,CAACG,GAAE,EAAGH,EAAEE,EAAED,EAAEL,EAAE,KAAK,CAAC,GAAGQ,IAAIH,EAAE,CAACE,GAAE,EAAGF,EAAEC,EAAEF,EAAEJ,EAAE,KAAK,CAACQ,EAAEA,EAAEmT,OAAO,CAAC,IAAIpT,EAAE,MAAM8G,MAAMxG,EAAE,KAAM,CAAC,CAAC,GAAGT,EAAE8S,YAAY7S,EAAE,MAAMgH,MAAMxG,EAAE,KAAM,CAAC,GAAG,IAAIT,EAAE6H,IAAI,MAAMZ,MAAMxG,EAAE,MAAM,OAAOT,EAAEsR,UAAUkC,UAAUxT,EAAEkB,EAAErB,CAAC,CAAkB4T,CAAGvS,IAAmBwS,GAAGxS,GAAG,IAAI,CAAC,SAASwS,GAAGxS,GAAG,GAAG,IAAIA,EAAE2G,KAAK,IAAI3G,EAAE2G,IAAI,OAAO3G,EAAE,IAAIA,EAAEA,EAAEoS,MAAM,OAAOpS,GAAG,CAAC,IAAIrB,EAAE6T,GAAGxS,GAAG,GAAG,OAAOrB,EAAE,OAAOA,EAAEqB,EAAEA,EAAEqS,OAAO,CAAC,OAAO,IAAI,CAC1X,IAAII,GAAG3Q,EAAG4Q,0BAA0BC,GAAG7Q,EAAG8Q,wBAAwBC,GAAG/Q,EAAGgR,qBAAqBC,GAAGjR,EAAGkR,sBAAsBC,GAAEnR,EAAGoR,aAAaC,GAAGrR,EAAGsR,iCAAiCC,GAAGvR,EAAGwR,2BAA2BC,GAAGzR,EAAG0R,8BAA8BC,GAAG3R,EAAG4R,wBAAwBC,GAAG7R,EAAG8R,qBAAqBC,GAAG/R,EAAGgS,sBAAsBC,GAAG,KAAKC,GAAG,KACvV,IAAIC,GAAGC,KAAKC,MAAMD,KAAKC,MAAiC,SAAYnU,GAAU,OAAPA,KAAK,EAAS,IAAIA,EAAE,GAAG,IAAIoU,GAAGpU,GAAGqU,GAAG,GAAG,CAAC,EAA/ED,GAAGF,KAAKI,IAAID,GAAGH,KAAKK,IAA4D,IAAIC,GAAG,GAAGC,GAAG,QAC7H,SAASC,GAAG1U,GAAG,OAAOA,GAAGA,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAS,QAAFA,EAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,SAAS,OAAS,UAAFA,EAAY,KAAK,UAAU,OAAO,UAAU,KAAK,UAAU,OAAO,UAAU,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,OAAO,WACzgB,QAAQ,OAAOA,EAAE,CAAC,SAAS2U,GAAG3U,EAAErB,GAAG,IAAIG,EAAEkB,EAAE4U,aAAa,GAAG,IAAI9V,EAAE,OAAO,EAAE,IAAIC,EAAE,EAAEL,EAAEsB,EAAE6U,eAAe7V,EAAEgB,EAAE8U,YAAY7V,EAAI,UAAFH,EAAY,GAAG,IAAIG,EAAE,CAAC,IAAIC,EAAED,GAAGP,EAAE,IAAIQ,EAAEH,EAAE2V,GAAGxV,GAAS,KAALF,GAAGC,KAAUF,EAAE2V,GAAG1V,GAAI,MAAa,KAAPC,EAAEH,GAAGJ,GAAQK,EAAE2V,GAAGzV,GAAG,IAAID,IAAID,EAAE2V,GAAG1V,IAAI,GAAG,IAAID,EAAE,OAAO,EAAE,GAAG,IAAIJ,GAAGA,IAAII,GAAG,KAAKJ,EAAED,MAAKA,EAAEK,GAAGA,KAAEC,EAAEL,GAAGA,IAAQ,KAAKD,GAAG,KAAO,QAAFM,IAAY,OAAOL,EAA0C,GAAxC,KAAO,EAAFI,KAAOA,GAAK,GAAFD,GAA4B,KAAtBH,EAAEqB,EAAE+U,gBAAwB,IAAI/U,EAAEA,EAAEgV,cAAcrW,GAAGI,EAAE,EAAEJ,GAAcD,EAAE,IAAbI,EAAE,GAAGmV,GAAGtV,IAAUI,GAAGiB,EAAElB,GAAGH,IAAID,EAAE,OAAOK,CAAC,CACvc,SAASkW,GAAGjV,EAAErB,GAAG,OAAOqB,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAOrB,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAOA,EAAE,IAAuJ,QAAQ,OAAO,EAAE,CACrN,SAASuW,GAAGlV,GAAgC,OAAO,KAApCA,GAAkB,WAAhBA,EAAE4U,cAAsC5U,EAAI,WAAFA,EAAa,WAAW,CAAC,CAAC,SAASmV,KAAK,IAAInV,EAAEwU,GAAoC,OAA1B,KAAQ,SAAfA,KAAK,MAAqBA,GAAG,IAAWxU,CAAC,CAAC,SAASoV,GAAGpV,GAAG,IAAI,IAAIrB,EAAE,GAAGG,EAAE,EAAE,GAAGA,EAAEA,IAAIH,EAAE4R,KAAKvQ,GAAG,OAAOrB,CAAC,CAC3a,SAAS0W,GAAGrV,EAAErB,EAAEG,GAAGkB,EAAE4U,cAAcjW,EAAE,YAAYA,IAAIqB,EAAE6U,eAAe,EAAE7U,EAAE8U,YAAY,IAAG9U,EAAEA,EAAEsV,YAAW3W,EAAE,GAAGsV,GAAGtV,IAAQG,CAAC,CACzH,SAASyW,GAAGvV,EAAErB,GAAG,IAAIG,EAAEkB,EAAE+U,gBAAgBpW,EAAE,IAAIqB,EAAEA,EAAEgV,cAAclW,GAAG,CAAC,IAAIC,EAAE,GAAGkV,GAAGnV,GAAGJ,EAAE,GAAGK,EAAEL,EAAEC,EAAEqB,EAAEjB,GAAGJ,IAAIqB,EAAEjB,IAAIJ,GAAGG,IAAIJ,CAAC,CAAC,CAAC,IAAI8W,GAAE,EAAE,SAASC,GAAGzV,GAAS,OAAO,GAAbA,IAAIA,GAAa,EAAEA,EAAE,KAAO,UAAFA,GAAa,GAAG,UAAU,EAAE,CAAC,CAAC,IAAI0V,GAAGC,GAAGC,GAAGC,GAAGC,GAAGC,IAAG,EAAGC,GAAG,GAAGC,GAAG,KAAKC,GAAG,KAAKC,GAAG,KAAKC,GAAG,IAAIC,IAAIC,GAAG,IAAID,IAAIE,GAAG,GAAGC,GAAG,6PAA6PjT,MAAM,KAChiB,SAASkT,GAAGzW,EAAErB,GAAG,OAAOqB,GAAG,IAAK,UAAU,IAAK,WAAWiW,GAAG,KAAK,MAAM,IAAK,YAAY,IAAK,YAAYC,GAAG,KAAK,MAAM,IAAK,YAAY,IAAK,WAAWC,GAAG,KAAK,MAAM,IAAK,cAAc,IAAK,aAAaC,GAAGM,OAAO/X,EAAEgY,WAAW,MAAM,IAAK,oBAAoB,IAAK,qBAAqBL,GAAGI,OAAO/X,EAAEgY,WAAW,CACnT,SAASC,GAAG5W,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,GAAG,OAAG,OAAOgB,GAAGA,EAAE6W,cAAc7X,GAASgB,EAAE,CAAC8W,UAAUnY,EAAEoY,aAAajY,EAAEkY,iBAAiBjY,EAAE8X,YAAY7X,EAAEiY,iBAAiB,CAACvY,IAAI,OAAOC,IAAY,QAARA,EAAEwR,GAAGxR,KAAagX,GAAGhX,IAAIqB,IAAEA,EAAEgX,kBAAkBjY,EAAEJ,EAAEqB,EAAEiX,iBAAiB,OAAOvY,IAAI,IAAIC,EAAEsP,QAAQvP,IAAIC,EAAE4R,KAAK7R,GAAUsB,EAAC,CAEpR,SAASkX,GAAGlX,GAAG,IAAIrB,EAAEwY,GAAGnX,EAAE2P,QAAQ,GAAG,OAAOhR,EAAE,CAAC,IAAIG,EAAE6S,GAAGhT,GAAG,GAAG,OAAOG,EAAE,GAAW,MAARH,EAAEG,EAAE6H,MAAY,GAAW,QAARhI,EAAEoT,GAAGjT,IAA4D,OAA/CkB,EAAE8W,UAAUnY,OAAEmX,GAAG9V,EAAEoX,UAAS,WAAWxB,GAAG9W,EAAE,SAAgB,GAAG,IAAIH,GAAGG,EAAEsR,UAAUkC,QAAQN,cAAcqF,aAAmE,YAArDrX,EAAE8W,UAAU,IAAIhY,EAAE6H,IAAI7H,EAAEsR,UAAUkH,cAAc,KAAY,CAACtX,EAAE8W,UAAU,IAAI,CAClT,SAASS,GAAGvX,GAAG,GAAG,OAAOA,EAAE8W,UAAU,OAAM,EAAG,IAAI,IAAInY,EAAEqB,EAAEiX,iBAAiB,EAAEtY,EAAErC,QAAQ,CAAC,IAAIwC,EAAE0Y,GAAGxX,EAAE+W,aAAa/W,EAAEgX,iBAAiBrY,EAAE,GAAGqB,EAAE6W,aAAa,GAAG,OAAO/X,EAAiG,OAAe,QAARH,EAAEwR,GAAGrR,KAAa6W,GAAGhX,GAAGqB,EAAE8W,UAAUhY,GAAE,EAA3H,IAAIC,EAAE,IAAtBD,EAAEkB,EAAE6W,aAAwBvP,YAAYxI,EAAE3C,KAAK2C,GAAG2Q,GAAG1Q,EAAED,EAAE6Q,OAAO8H,cAAc1Y,GAAG0Q,GAAG,KAA0D9Q,EAAE+Y,OAAO,CAAC,OAAM,CAAE,CAAC,SAASC,GAAG3X,EAAErB,EAAEG,GAAGyY,GAAGvX,IAAIlB,EAAE4X,OAAO/X,EAAE,CAAC,SAASiZ,KAAK7B,IAAG,EAAG,OAAOE,IAAIsB,GAAGtB,MAAMA,GAAG,MAAM,OAAOC,IAAIqB,GAAGrB,MAAMA,GAAG,MAAM,OAAOC,IAAIoB,GAAGpB,MAAMA,GAAG,MAAMC,GAAG5S,QAAQmU,IAAIrB,GAAG9S,QAAQmU,GAAG,CACnf,SAASE,GAAG7X,EAAErB,GAAGqB,EAAE8W,YAAYnY,IAAIqB,EAAE8W,UAAU,KAAKf,KAAKA,IAAG,EAAGjU,EAAG4Q,0BAA0B5Q,EAAG4R,wBAAwBkE,KAAK,CAC5H,SAASE,GAAG9X,GAAG,SAASrB,EAAEA,GAAG,OAAOkZ,GAAGlZ,EAAEqB,EAAE,CAAC,GAAG,EAAEgW,GAAG1Z,OAAO,CAACub,GAAG7B,GAAG,GAAGhW,GAAG,IAAI,IAAIlB,EAAE,EAAEA,EAAEkX,GAAG1Z,OAAOwC,IAAI,CAAC,IAAIC,EAAEiX,GAAGlX,GAAGC,EAAE+X,YAAY9W,IAAIjB,EAAE+X,UAAU,KAAK,CAAC,CAAyF,IAAxF,OAAOb,IAAI4B,GAAG5B,GAAGjW,GAAG,OAAOkW,IAAI2B,GAAG3B,GAAGlW,GAAG,OAAOmW,IAAI0B,GAAG1B,GAAGnW,GAAGoW,GAAG5S,QAAQ7E,GAAG2X,GAAG9S,QAAQ7E,GAAOG,EAAE,EAAEA,EAAEyX,GAAGja,OAAOwC,KAAIC,EAAEwX,GAAGzX,IAAKgY,YAAY9W,IAAIjB,EAAE+X,UAAU,MAAM,KAAK,EAAEP,GAAGja,QAAiB,QAARwC,EAAEyX,GAAG,IAAYO,WAAYI,GAAGpY,GAAG,OAAOA,EAAEgY,WAAWP,GAAGmB,OAAO,CAAC,IAAIK,GAAGrT,EAAGsT,wBAAwBC,IAAG,EAC5a,SAASC,GAAGlY,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAE8W,GAAExW,EAAE+Y,GAAGI,WAAWJ,GAAGI,WAAW,KAAK,IAAI3C,GAAE,EAAE4C,GAAGpY,EAAErB,EAAEG,EAAEC,EAAE,CAAC,QAAQyW,GAAE9W,EAAEqZ,GAAGI,WAAWnZ,CAAC,CAAC,CAAC,SAASqZ,GAAGrY,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAE8W,GAAExW,EAAE+Y,GAAGI,WAAWJ,GAAGI,WAAW,KAAK,IAAI3C,GAAE,EAAE4C,GAAGpY,EAAErB,EAAEG,EAAEC,EAAE,CAAC,QAAQyW,GAAE9W,EAAEqZ,GAAGI,WAAWnZ,CAAC,CAAC,CACjO,SAASoZ,GAAGpY,EAAErB,EAAEG,EAAEC,GAAG,GAAGkZ,GAAG,CAAC,IAAIvZ,EAAE8Y,GAAGxX,EAAErB,EAAEG,EAAEC,GAAG,GAAG,OAAOL,EAAE4Z,GAAGtY,EAAErB,EAAEI,EAAEwZ,GAAGzZ,GAAG2X,GAAGzW,EAAEjB,QAAQ,GANtF,SAAYiB,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,OAAOC,GAAG,IAAK,UAAU,OAAOsX,GAAGW,GAAGX,GAAGjW,EAAErB,EAAEG,EAAEC,EAAEL,IAAG,EAAG,IAAK,YAAY,OAAOwX,GAAGU,GAAGV,GAAGlW,EAAErB,EAAEG,EAAEC,EAAEL,IAAG,EAAG,IAAK,YAAY,OAAOyX,GAAGS,GAAGT,GAAGnW,EAAErB,EAAEG,EAAEC,EAAEL,IAAG,EAAG,IAAK,cAAc,IAAIM,EAAEN,EAAEiY,UAAkD,OAAxCP,GAAG9P,IAAItH,EAAE4X,GAAGR,GAAG7O,IAAIvI,IAAI,KAAKgB,EAAErB,EAAEG,EAAEC,EAAEL,KAAU,EAAG,IAAK,oBAAoB,OAAOM,EAAEN,EAAEiY,UAAUL,GAAGhQ,IAAItH,EAAE4X,GAAGN,GAAG/O,IAAIvI,IAAI,KAAKgB,EAAErB,EAAEG,EAAEC,EAAEL,KAAI,EAAG,OAAM,CAAE,CAM1Q8Z,CAAG9Z,EAAEsB,EAAErB,EAAEG,EAAEC,GAAGA,EAAE0Z,uBAAuB,GAAGhC,GAAGzW,EAAEjB,GAAK,EAAFJ,IAAM,EAAE6X,GAAGvI,QAAQjO,GAAG,CAAC,KAAK,OAAOtB,GAAG,CAAC,IAAIM,EAAEmR,GAAGzR,GAA0D,GAAvD,OAAOM,GAAG0W,GAAG1W,GAAiB,QAAdA,EAAEwY,GAAGxX,EAAErB,EAAEG,EAAEC,KAAauZ,GAAGtY,EAAErB,EAAEI,EAAEwZ,GAAGzZ,GAAME,IAAIN,EAAE,MAAMA,EAAEM,CAAC,CAAC,OAAON,GAAGK,EAAE0Z,iBAAiB,MAAMH,GAAGtY,EAAErB,EAAEI,EAAE,KAAKD,EAAE,CAAC,CAAC,IAAIyZ,GAAG,KACpU,SAASf,GAAGxX,EAAErB,EAAEG,EAAEC,GAA2B,GAAxBwZ,GAAG,KAAwB,QAAXvY,EAAEmX,GAAVnX,EAAE0P,GAAG3Q,KAAuB,GAAW,QAARJ,EAAEgT,GAAG3R,IAAYA,EAAE,UAAU,GAAW,MAARlB,EAAEH,EAAEgI,KAAW,CAAS,GAAG,QAAX3G,EAAE+R,GAAGpT,IAAe,OAAOqB,EAAEA,EAAE,IAAI,MAAM,GAAG,IAAIlB,EAAE,CAAC,GAAGH,EAAEyR,UAAUkC,QAAQN,cAAcqF,aAAa,OAAO,IAAI1Y,EAAEgI,IAAIhI,EAAEyR,UAAUkH,cAAc,KAAKtX,EAAE,IAAI,MAAMrB,IAAIqB,IAAIA,EAAE,MAAW,OAALuY,GAAGvY,EAAS,IAAI,CAC7S,SAAS0Y,GAAG1Y,GAAG,OAAOA,GAAG,IAAK,SAAS,IAAK,QAAQ,IAAK,QAAQ,IAAK,cAAc,IAAK,OAAO,IAAK,MAAM,IAAK,WAAW,IAAK,WAAW,IAAK,UAAU,IAAK,YAAY,IAAK,OAAO,IAAK,UAAU,IAAK,WAAW,IAAK,QAAQ,IAAK,UAAU,IAAK,UAAU,IAAK,WAAW,IAAK,QAAQ,IAAK,YAAY,IAAK,UAAU,IAAK,QAAQ,IAAK,QAAQ,IAAK,OAAO,IAAK,gBAAgB,IAAK,cAAc,IAAK,YAAY,IAAK,aAAa,IAAK,QAAQ,IAAK,SAAS,IAAK,SAAS,IAAK,SAAS,IAAK,cAAc,IAAK,WAAW,IAAK,aAAa,IAAK,eAAe,IAAK,SAAS,IAAK,kBAAkB,IAAK,YAAY,IAAK,mBAAmB,IAAK,iBAAiB,IAAK,oBAAoB,IAAK,aAAa,IAAK,YAAY,IAAK,cAAc,IAAK,OAAO,IAAK,mBAAmB,IAAK,QAAQ,IAAK,aAAa,IAAK,WAAW,IAAK,SAAS,IAAK,cAAc,OAAO,EAAE,IAAK,OAAO,IAAK,YAAY,IAAK,WAAW,IAAK,YAAY,IAAK,WAAW,IAAK,YAAY,IAAK,WAAW,IAAK,YAAY,IAAK,cAAc,IAAK,aAAa,IAAK,cAAc,IAAK,SAAS,IAAK,SAAS,IAAK,YAAY,IAAK,QAAQ,IAAK,aAAa,IAAK,aAAa,IAAK,eAAe,IAAK,eAAe,OAAO,EACpqC,IAAK,UAAU,OAAOmT,MAAM,KAAKE,GAAG,OAAO,EAAE,KAAKE,GAAG,OAAO,EAAE,KAAKE,GAAG,KAAKE,GAAG,OAAO,GAAG,KAAKE,GAAG,OAAO,UAAU,QAAQ,OAAO,GAAG,QAAQ,OAAO,GAAG,CAAC,IAAI8E,GAAG,KAAKC,GAAG,KAAKC,GAAG,KAAK,SAASC,KAAK,GAAGD,GAAG,OAAOA,GAAG,IAAI7Y,EAAkBjB,EAAhBJ,EAAEia,GAAG9Z,EAAEH,EAAErC,OAASoC,EAAE,UAAUia,GAAGA,GAAG3Q,MAAM2Q,GAAG5O,YAAY/K,EAAEN,EAAEpC,OAAO,IAAI0D,EAAE,EAAEA,EAAElB,GAAGH,EAAEqB,KAAKtB,EAAEsB,GAAGA,KAAK,IAAIf,EAAEH,EAAEkB,EAAE,IAAIjB,EAAE,EAAEA,GAAGE,GAAGN,EAAEG,EAAEC,KAAKL,EAAEM,EAAED,GAAGA,KAAK,OAAO8Z,GAAGna,EAAEoF,MAAM9D,EAAE,EAAEjB,EAAE,EAAEA,OAAE,EAAO,CACxY,SAASga,GAAG/Y,GAAG,IAAIrB,EAAEqB,EAAEgZ,QAA+E,MAAvE,aAAahZ,EAAgB,KAAbA,EAAEA,EAAEiZ,WAAgB,KAAKta,IAAIqB,EAAE,IAAKA,EAAErB,EAAE,KAAKqB,IAAIA,EAAE,IAAW,IAAIA,GAAG,KAAKA,EAAEA,EAAE,CAAC,CAAC,SAASkZ,KAAK,OAAM,CAAE,CAAC,SAASC,KAAK,OAAM,CAAE,CAC5K,SAASC,GAAGpZ,GAAG,SAASrB,EAAEA,EAAEI,EAAEL,EAAEM,EAAEC,GAA6G,IAAI,IAAIH,KAAlHiE,KAAKsW,WAAW1a,EAAEoE,KAAKuW,YAAY5a,EAAEqE,KAAK5G,KAAK4C,EAAEgE,KAAK8T,YAAY7X,EAAE+D,KAAK4M,OAAO1Q,EAAE8D,KAAKwW,cAAc,KAAkBvZ,EAAEA,EAAE2C,eAAe7D,KAAKH,EAAEqB,EAAElB,GAAGiE,KAAKjE,GAAGH,EAAEA,EAAEK,GAAGA,EAAEF,IAAgI,OAA5HiE,KAAKyW,oBAAoB,MAAMxa,EAAEya,iBAAiBza,EAAEya,kBAAiB,IAAKza,EAAE0a,aAAaR,GAAGC,GAAGpW,KAAK4W,qBAAqBR,GAAUpW,IAAI,CAC9E,OAD+E5C,EAAExB,EAAEpC,UAAU,CAACqd,eAAe,WAAW7W,KAAK0W,kBAAiB,EAAG,IAAIzZ,EAAE+C,KAAK8T,YAAY7W,IAAIA,EAAE4Z,eAAe5Z,EAAE4Z,iBAAiB,mBAAmB5Z,EAAE0Z,cAC7e1Z,EAAE0Z,aAAY,GAAI3W,KAAKyW,mBAAmBN,GAAG,EAAET,gBAAgB,WAAW,IAAIzY,EAAE+C,KAAK8T,YAAY7W,IAAIA,EAAEyY,gBAAgBzY,EAAEyY,kBAAkB,mBAAmBzY,EAAE6Z,eAAe7Z,EAAE6Z,cAAa,GAAI9W,KAAK4W,qBAAqBT,GAAG,EAAEY,QAAQ,WAAW,EAAEC,aAAab,KAAYva,CAAC,CACjR,IAAoLqb,GAAGC,GAAGC,GAAtLC,GAAG,CAACC,WAAW,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,UAAU,SAASva,GAAG,OAAOA,EAAEua,WAAWC,KAAKC,KAAK,EAAEhB,iBAAiB,EAAEiB,UAAU,GAAGC,GAAGvB,GAAGe,IAAIS,GAAGza,EAAE,CAAC,EAAEga,GAAG,CAACU,KAAK,EAAEC,OAAO,IAAIC,GAAG3B,GAAGwB,IAAaI,GAAG7a,EAAE,CAAC,EAAEya,GAAG,CAACK,QAAQ,EAAEC,QAAQ,EAAEC,QAAQ,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,iBAAiBC,GAAGC,OAAO,EAAEC,QAAQ,EAAEC,cAAc,SAAS/b,GAAG,YAAO,IAASA,EAAE+b,cAAc/b,EAAEgc,cAAchc,EAAE4P,WAAW5P,EAAEic,UAAUjc,EAAEgc,YAAYhc,EAAE+b,aAAa,EAAEG,UAAU,SAASlc,GAAG,MAAG,cAC3eA,EAASA,EAAEkc,WAAUlc,IAAIka,KAAKA,IAAI,cAAcla,EAAE7D,MAAM6d,GAAGha,EAAEib,QAAQf,GAAGe,QAAQhB,GAAGja,EAAEkb,QAAQhB,GAAGgB,SAASjB,GAAGD,GAAG,EAAEE,GAAGla,GAAUga,GAAE,EAAEmC,UAAU,SAASnc,GAAG,MAAM,cAAcA,EAAEA,EAAEmc,UAAUlC,EAAE,IAAImC,GAAGhD,GAAG4B,IAAiCqB,GAAGjD,GAA7BjZ,EAAE,CAAC,EAAE6a,GAAG,CAACsB,aAAa,KAA4CC,GAAGnD,GAA9BjZ,EAAE,CAAC,EAAEya,GAAG,CAACmB,cAAc,KAA0ES,GAAGpD,GAA5DjZ,EAAE,CAAC,EAAEga,GAAG,CAACsC,cAAc,EAAEC,YAAY,EAAEC,cAAc,KAAcC,GAAGzc,EAAE,CAAC,EAAEga,GAAG,CAAC0C,cAAc,SAAS7c,GAAG,MAAM,kBAAkBA,EAAEA,EAAE6c,cAActa,OAAOsa,aAAa,IAAIC,GAAG1D,GAAGwD,IAAyBG,GAAG3D,GAArBjZ,EAAE,CAAC,EAAEga,GAAG,CAAC6C,KAAK,KAAcC,GAAG,CAACC,IAAI,SACxfC,SAAS,IAAIC,KAAK,YAAYC,GAAG,UAAUC,MAAM,aAAaC,KAAK,YAAYC,IAAI,SAASC,IAAI,KAAKC,KAAK,cAAcC,KAAK,cAAcC,OAAO,aAAaC,gBAAgB,gBAAgBC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KACtf,IAAI,KAAK,IAAI,KAAK,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,UAAU,IAAI,aAAa,IAAI,QAAQC,GAAG,CAACC,IAAI,SAASC,QAAQ,UAAUC,KAAK,UAAUC,MAAM,YAAY,SAASC,GAAGpe,GAAG,IAAIrB,EAAEoE,KAAK8T,YAAY,OAAOlY,EAAEgd,iBAAiBhd,EAAEgd,iBAAiB3b,MAAIA,EAAE+d,GAAG/d,OAAMrB,EAAEqB,EAAK,CAAC,SAAS4b,KAAK,OAAOwC,EAAE,CAChS,IAAIC,GAAGle,EAAE,CAAC,EAAEya,GAAG,CAACpc,IAAI,SAASwB,GAAG,GAAGA,EAAExB,IAAI,CAAC,IAAIG,EAAEse,GAAGjd,EAAExB,MAAMwB,EAAExB,IAAI,GAAG,iBAAiBG,EAAE,OAAOA,CAAC,CAAC,MAAM,aAAaqB,EAAE7D,KAAc,MAAR6D,EAAE+Y,GAAG/Y,IAAU,QAAQse,OAAOC,aAAave,GAAI,YAAYA,EAAE7D,MAAM,UAAU6D,EAAE7D,KAAK2hB,GAAG9d,EAAEgZ,UAAU,eAAe,EAAE,EAAEwF,KAAK,EAAEC,SAAS,EAAElD,QAAQ,EAAEC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,EAAEgD,OAAO,EAAEC,OAAO,EAAEhD,iBAAiBC,GAAG3C,SAAS,SAASjZ,GAAG,MAAM,aAAaA,EAAE7D,KAAK4c,GAAG/Y,GAAG,CAAC,EAAEgZ,QAAQ,SAAShZ,GAAG,MAAM,YAAYA,EAAE7D,MAAM,UAAU6D,EAAE7D,KAAK6D,EAAEgZ,QAAQ,CAAC,EAAE4F,MAAM,SAAS5e,GAAG,MAAM,aAC7eA,EAAE7D,KAAK4c,GAAG/Y,GAAG,YAAYA,EAAE7D,MAAM,UAAU6D,EAAE7D,KAAK6D,EAAEgZ,QAAQ,CAAC,IAAI6F,GAAGzF,GAAGiF,IAAiIS,GAAG1F,GAA7HjZ,EAAE,CAAC,EAAE6a,GAAG,CAACrE,UAAU,EAAEoI,MAAM,EAAEC,OAAO,EAAEC,SAAS,EAAEC,mBAAmB,EAAEC,MAAM,EAAEC,MAAM,EAAEC,MAAM,EAAEC,YAAY,EAAEC,UAAU,KAAmIC,GAAGpG,GAArHjZ,EAAE,CAAC,EAAEya,GAAG,CAAC6E,QAAQ,EAAEC,cAAc,EAAEC,eAAe,EAAElE,OAAO,EAAEC,QAAQ,EAAEH,QAAQ,EAAEC,SAAS,EAAEG,iBAAiBC,MAA0EgE,GAAGxG,GAA3DjZ,EAAE,CAAC,EAAEga,GAAG,CAAC/W,aAAa,EAAEsZ,YAAY,EAAEC,cAAc,KAAckD,GAAG1f,EAAE,CAAC,EAAE6a,GAAG,CAAC8E,OAAO,SAAS9f,GAAG,MAAM,WAAWA,EAAEA,EAAE8f,OAAO,gBAAgB9f,GAAGA,EAAE+f,YAAY,CAAC,EACnfC,OAAO,SAAShgB,GAAG,MAAM,WAAWA,EAAEA,EAAEggB,OAAO,gBAAgBhgB,GAAGA,EAAEigB,YAAY,eAAejgB,GAAGA,EAAEkgB,WAAW,CAAC,EAAEC,OAAO,EAAEC,UAAU,IAAIC,GAAGjH,GAAGyG,IAAIS,GAAG,CAAC,EAAE,GAAG,GAAG,IAAIC,GAAGje,GAAI,qBAAqBC,OAAOie,GAAG,KAAKle,GAAI,iBAAiBE,WAAWge,GAAGhe,SAASie,cAAc,IAAIC,GAAGpe,GAAI,cAAcC,SAASie,GAAGG,GAAGre,KAAMie,IAAIC,IAAI,EAAEA,IAAI,IAAIA,IAAII,GAAGtC,OAAOC,aAAa,IAAIsC,IAAG,EAC1W,SAASC,GAAG9gB,EAAErB,GAAG,OAAOqB,GAAG,IAAK,QAAQ,OAAO,IAAIsgB,GAAGrS,QAAQtP,EAAEqa,SAAS,IAAK,UAAU,OAAO,MAAMra,EAAEqa,QAAQ,IAAK,WAAW,IAAK,YAAY,IAAK,WAAW,OAAM,EAAG,QAAQ,OAAM,EAAG,CAAC,SAAS+H,GAAG/gB,GAAc,MAAM,kBAAjBA,EAAEA,EAAE8a,SAAkC,SAAS9a,EAAEA,EAAEgd,KAAK,IAAI,CAAC,IAAIgE,IAAG,EAE9Q,IAAIC,GAAG,CAACC,OAAM,EAAGC,MAAK,EAAGC,UAAS,EAAG,kBAAiB,EAAGC,OAAM,EAAGC,OAAM,EAAGC,QAAO,EAAGC,UAAS,EAAGC,OAAM,EAAGC,QAAO,EAAGC,KAAI,EAAGC,MAAK,EAAGC,MAAK,EAAGC,KAAI,EAAGC,MAAK,GAAI,SAASC,GAAGhiB,GAAG,IAAIrB,EAAEqB,GAAGA,EAAEmH,UAAUnH,EAAEmH,SAAS1D,cAAc,MAAM,UAAU9E,IAAIsiB,GAAGjhB,EAAE7D,MAAM,aAAawC,CAAO,CAAC,SAASsjB,GAAGjiB,EAAErB,EAAEG,EAAEC,GAAGuR,GAAGvR,GAAsB,GAAnBJ,EAAEujB,GAAGvjB,EAAE,aAAgBrC,SAASwC,EAAE,IAAI6b,GAAG,WAAW,SAAS,KAAK7b,EAAEC,GAAGiB,EAAEuQ,KAAK,CAAC4R,MAAMrjB,EAAEsjB,UAAUzjB,IAAI,CAAC,IAAI0jB,GAAG,KAAKC,GAAG,KAAK,SAASC,GAAGviB,GAAGwiB,GAAGxiB,EAAE,EAAE,CAAC,SAASyiB,GAAGziB,GAAe,GAAG8H,EAAT4a,GAAG1iB,IAAY,OAAOA,CAAC,CACpe,SAAS2iB,GAAG3iB,EAAErB,GAAG,GAAG,WAAWqB,EAAE,OAAOrB,CAAC,CAAC,IAAIikB,IAAG,EAAG,GAAGtgB,EAAG,CAAC,IAAIugB,GAAG,GAAGvgB,EAAG,CAAC,IAAIwgB,GAAG,YAAYtgB,SAAS,IAAIsgB,GAAG,CAAC,IAAIC,GAAGvgB,SAASC,cAAc,OAAOsgB,GAAGze,aAAa,UAAU,WAAWwe,GAAG,oBAAoBC,GAAGC,OAAO,CAACH,GAAGC,EAAE,MAAMD,IAAG,EAAGD,GAAGC,MAAMrgB,SAASie,cAAc,EAAEje,SAASie,aAAa,CAAC,SAASwC,KAAKZ,KAAKA,GAAGa,YAAY,mBAAmBC,IAAIb,GAAGD,GAAG,KAAK,CAAC,SAASc,GAAGnjB,GAAG,GAAG,UAAUA,EAAEoD,cAAcqf,GAAGH,IAAI,CAAC,IAAI3jB,EAAE,GAAGsjB,GAAGtjB,EAAE2jB,GAAGtiB,EAAE0P,GAAG1P,IAAI4Q,GAAG2R,GAAG5jB,EAAE,CAAC,CAC/b,SAASykB,GAAGpjB,EAAErB,EAAEG,GAAG,YAAYkB,GAAGijB,KAAUX,GAAGxjB,GAARujB,GAAG1jB,GAAU0kB,YAAY,mBAAmBF,KAAK,aAAanjB,GAAGijB,IAAI,CAAC,SAASK,GAAGtjB,GAAG,GAAG,oBAAoBA,GAAG,UAAUA,GAAG,YAAYA,EAAE,OAAOyiB,GAAGH,GAAG,CAAC,SAASiB,GAAGvjB,EAAErB,GAAG,GAAG,UAAUqB,EAAE,OAAOyiB,GAAG9jB,EAAE,CAAC,SAAS6kB,GAAGxjB,EAAErB,GAAG,GAAG,UAAUqB,GAAG,WAAWA,EAAE,OAAOyiB,GAAG9jB,EAAE,CAAiE,IAAI8kB,GAAG,oBAAoBnmB,OAAOkS,GAAGlS,OAAOkS,GAA5G,SAAYxP,EAAErB,GAAG,OAAOqB,IAAIrB,IAAI,IAAIqB,GAAG,EAAEA,IAAI,EAAErB,IAAIqB,IAAIA,GAAGrB,IAAIA,CAAC,EACtW,SAAS+kB,GAAG1jB,EAAErB,GAAG,GAAG8kB,GAAGzjB,EAAErB,GAAG,OAAM,EAAG,GAAG,kBAAkBqB,GAAG,OAAOA,GAAG,kBAAkBrB,GAAG,OAAOA,EAAE,OAAM,EAAG,IAAIG,EAAExB,OAAOa,KAAK6B,GAAGjB,EAAEzB,OAAOa,KAAKQ,GAAG,GAAGG,EAAExC,SAASyC,EAAEzC,OAAO,OAAM,EAAG,IAAIyC,EAAE,EAAEA,EAAED,EAAExC,OAAOyC,IAAI,CAAC,IAAIL,EAAEI,EAAEC,GAAG,IAAI2D,EAAGwB,KAAKvF,EAAED,KAAK+kB,GAAGzjB,EAAEtB,GAAGC,EAAED,IAAI,OAAM,CAAE,CAAC,OAAM,CAAE,CAAC,SAASilB,GAAG3jB,GAAG,KAAKA,GAAGA,EAAEwK,YAAYxK,EAAEA,EAAEwK,WAAW,OAAOxK,CAAC,CACtU,SAAS4jB,GAAG5jB,EAAErB,GAAG,IAAwBI,EAApBD,EAAE6kB,GAAG3jB,GAAO,IAAJA,EAAE,EAAYlB,GAAG,CAAC,GAAG,IAAIA,EAAEiM,SAAS,CAA0B,GAAzBhM,EAAEiB,EAAElB,EAAEiL,YAAYzN,OAAU0D,GAAGrB,GAAGI,GAAGJ,EAAE,MAAM,CAACklB,KAAK/kB,EAAEglB,OAAOnlB,EAAEqB,GAAGA,EAAEjB,CAAC,CAACiB,EAAE,CAAC,KAAKlB,GAAG,CAAC,GAAGA,EAAEilB,YAAY,CAACjlB,EAAEA,EAAEilB,YAAY,MAAM/jB,CAAC,CAAClB,EAAEA,EAAEgR,UAAU,CAAChR,OAAE,CAAM,CAACA,EAAE6kB,GAAG7kB,EAAE,CAAC,CAAC,SAASklB,GAAGhkB,EAAErB,GAAG,SAAOqB,IAAGrB,KAAEqB,IAAIrB,KAAKqB,GAAG,IAAIA,EAAE+K,YAAYpM,GAAG,IAAIA,EAAEoM,SAASiZ,GAAGhkB,EAAErB,EAAEmR,YAAY,aAAa9P,EAAEA,EAAEikB,SAAStlB,KAAGqB,EAAEkkB,4BAAwD,GAA7BlkB,EAAEkkB,wBAAwBvlB,KAAY,CAC9Z,SAASwlB,KAAK,IAAI,IAAInkB,EAAEuC,OAAO5D,EAAEsJ,IAAKtJ,aAAaqB,EAAEokB,mBAAmB,CAAC,IAAI,IAAItlB,EAAE,kBAAkBH,EAAE0lB,cAAc5F,SAAS6F,IAAI,CAAC,MAAMvlB,GAAGD,GAAE,CAAE,CAAC,IAAGA,EAAyB,MAAMH,EAAEsJ,GAA/BjI,EAAErB,EAAE0lB,eAAgC7hB,SAAS,CAAC,OAAO7D,CAAC,CAAC,SAAS4lB,GAAGvkB,GAAG,IAAIrB,EAAEqB,GAAGA,EAAEmH,UAAUnH,EAAEmH,SAAS1D,cAAc,OAAO9E,IAAI,UAAUA,IAAI,SAASqB,EAAE7D,MAAM,WAAW6D,EAAE7D,MAAM,QAAQ6D,EAAE7D,MAAM,QAAQ6D,EAAE7D,MAAM,aAAa6D,EAAE7D,OAAO,aAAawC,GAAG,SAASqB,EAAEwkB,gBAAgB,CACxa,SAASC,GAAGzkB,GAAG,IAAIrB,EAAEwlB,KAAKrlB,EAAEkB,EAAE0kB,YAAY3lB,EAAEiB,EAAE2kB,eAAe,GAAGhmB,IAAIG,GAAGA,GAAGA,EAAEkK,eAAegb,GAAGllB,EAAEkK,cAAc4b,gBAAgB9lB,GAAG,CAAC,GAAG,OAAOC,GAAGwlB,GAAGzlB,GAAG,GAAGH,EAAEI,EAAE8lB,WAAc,KAAR7kB,EAAEjB,EAAE+lB,OAAiB9kB,EAAErB,GAAG,mBAAmBG,EAAEA,EAAEimB,eAAepmB,EAAEG,EAAEkmB,aAAa9Q,KAAK+Q,IAAIjlB,EAAElB,EAAEkJ,MAAM1L,aAAa,IAAG0D,GAAGrB,EAAEG,EAAEkK,eAAexG,WAAW7D,EAAEumB,aAAa3iB,QAAS4iB,aAAa,CAACnlB,EAAEA,EAAEmlB,eAAe,IAAIzmB,EAAEI,EAAEiL,YAAYzN,OAAO0C,EAAEkV,KAAK+Q,IAAIlmB,EAAE8lB,MAAMnmB,GAAGK,OAAE,IAASA,EAAE+lB,IAAI9lB,EAAEkV,KAAK+Q,IAAIlmB,EAAE+lB,IAAIpmB,IAAIsB,EAAEolB,QAAQpmB,EAAED,IAAIL,EAAEK,EAAEA,EAAEC,EAAEA,EAAEN,GAAGA,EAAEklB,GAAG9kB,EAAEE,GAAG,IAAIC,EAAE2kB,GAAG9kB,EACvfC,GAAGL,GAAGO,IAAI,IAAIe,EAAEqlB,YAAYrlB,EAAEslB,aAAa5mB,EAAEmlB,MAAM7jB,EAAEulB,eAAe7mB,EAAEolB,QAAQ9jB,EAAEwlB,YAAYvmB,EAAE4kB,MAAM7jB,EAAEylB,cAAcxmB,EAAE6kB,WAAUnlB,EAAEA,EAAE+mB,eAAgBC,SAASjnB,EAAEmlB,KAAKnlB,EAAEolB,QAAQ9jB,EAAE4lB,kBAAkB5mB,EAAED,GAAGiB,EAAE6lB,SAASlnB,GAAGqB,EAAEolB,OAAOnmB,EAAE4kB,KAAK5kB,EAAE6kB,UAAUnlB,EAAEmnB,OAAO7mB,EAAE4kB,KAAK5kB,EAAE6kB,QAAQ9jB,EAAE6lB,SAASlnB,IAAI,CAAM,IAALA,EAAE,GAAOqB,EAAElB,EAAEkB,EAAEA,EAAE8P,YAAY,IAAI9P,EAAE+K,UAAUpM,EAAE4R,KAAK,CAACwV,QAAQ/lB,EAAEgmB,KAAKhmB,EAAEimB,WAAWC,IAAIlmB,EAAEmmB,YAAmD,IAAvC,oBAAoBrnB,EAAEsnB,OAAOtnB,EAAEsnB,QAAYtnB,EAAE,EAAEA,EAAEH,EAAErC,OAAOwC,KAAIkB,EAAErB,EAAEG,IAAKinB,QAAQE,WAAWjmB,EAAEgmB,KAAKhmB,EAAE+lB,QAAQI,UAAUnmB,EAAEkmB,GAAG,CAAC,CACzf,IAAIG,GAAG/jB,GAAI,iBAAiBE,UAAU,IAAIA,SAASie,aAAa6F,GAAG,KAAKC,GAAG,KAAKC,GAAG,KAAKC,IAAG,EAC3F,SAASC,GAAG1mB,EAAErB,EAAEG,GAAG,IAAIC,EAAED,EAAEyD,SAASzD,EAAEA,EAAE0D,SAAS,IAAI1D,EAAEiM,SAASjM,EAAEA,EAAEkK,cAAcyd,IAAI,MAAMH,IAAIA,KAAKre,EAAGlJ,KAAU,mBAALA,EAAEunB,KAAyB/B,GAAGxlB,GAAGA,EAAE,CAAC8lB,MAAM9lB,EAAEgmB,eAAeD,IAAI/lB,EAAEimB,cAAuFjmB,EAAE,CAACumB,YAA3EvmB,GAAGA,EAAEiK,eAAejK,EAAEiK,cAAckc,aAAa3iB,QAAQ4iB,gBAA+BG,WAAWC,aAAaxmB,EAAEwmB,aAAaC,UAAUzmB,EAAEymB,UAAUC,YAAY1mB,EAAE0mB,aAAce,IAAI9C,GAAG8C,GAAGznB,KAAKynB,GAAGznB,EAAsB,GAApBA,EAAEmjB,GAAGqE,GAAG,aAAgBjqB,SAASqC,EAAE,IAAIgc,GAAG,WAAW,SAAS,KAAKhc,EAAEG,GAAGkB,EAAEuQ,KAAK,CAAC4R,MAAMxjB,EAAEyjB,UAAUrjB,IAAIJ,EAAEgR,OAAO2W,KAAK,CACtf,SAASK,GAAG3mB,EAAErB,GAAG,IAAIG,EAAE,CAAC,EAAiF,OAA/EA,EAAEkB,EAAEyD,eAAe9E,EAAE8E,cAAc3E,EAAE,SAASkB,GAAG,SAASrB,EAAEG,EAAE,MAAMkB,GAAG,MAAMrB,EAASG,CAAC,CAAC,IAAI8nB,GAAG,CAACC,aAAaF,GAAG,YAAY,gBAAgBG,mBAAmBH,GAAG,YAAY,sBAAsBI,eAAeJ,GAAG,YAAY,kBAAkBK,cAAcL,GAAG,aAAa,kBAAkBM,GAAG,CAAC,EAAEC,GAAG,CAAC,EACpF,SAASC,GAAGnnB,GAAG,GAAGinB,GAAGjnB,GAAG,OAAOinB,GAAGjnB,GAAG,IAAI4mB,GAAG5mB,GAAG,OAAOA,EAAE,IAAYlB,EAARH,EAAEioB,GAAG5mB,GAAK,IAAIlB,KAAKH,EAAE,GAAGA,EAAEgE,eAAe7D,IAAIA,KAAKooB,GAAG,OAAOD,GAAGjnB,GAAGrB,EAAEG,GAAG,OAAOkB,CAAC,CAA/XsC,IAAK4kB,GAAG1kB,SAASC,cAAc,OAAOuL,MAAM,mBAAmBzL,gBAAgBqkB,GAAGC,aAAaO,iBAAiBR,GAAGE,mBAAmBM,iBAAiBR,GAAGG,eAAeK,WAAW,oBAAoB7kB,eAAeqkB,GAAGI,cAAc7O,YAAwJ,IAAIkP,GAAGF,GAAG,gBAAgBG,GAAGH,GAAG,sBAAsBI,GAAGJ,GAAG,kBAAkBK,GAAGL,GAAG,iBAAiBM,GAAG,IAAIpR,IAAIqR,GAAG,smBAAsmBnkB,MAAM,KAC/lC,SAASokB,GAAG3nB,EAAErB,GAAG8oB,GAAGnhB,IAAItG,EAAErB,GAAGwD,EAAGxD,EAAE,CAACqB,GAAG,CAAC,IAAI,IAAI4nB,GAAG,EAAEA,GAAGF,GAAGprB,OAAOsrB,KAAK,CAAC,IAAIC,GAAGH,GAAGE,IAA2DD,GAApDE,GAAGpkB,cAAuD,MAAtCokB,GAAG,GAAGjkB,cAAcikB,GAAG/jB,MAAM,IAAiB,CAAC6jB,GAAGN,GAAG,kBAAkBM,GAAGL,GAAG,wBAAwBK,GAAGJ,GAAG,oBAAoBI,GAAG,WAAW,iBAAiBA,GAAG,UAAU,WAAWA,GAAG,WAAW,UAAUA,GAAGH,GAAG,mBAAmBplB,EAAG,eAAe,CAAC,WAAW,cAAcA,EAAG,eAAe,CAAC,WAAW,cAAcA,EAAG,iBAAiB,CAAC,aAAa,gBAC7cA,EAAG,iBAAiB,CAAC,aAAa,gBAAgBD,EAAG,WAAW,oEAAoEoB,MAAM,MAAMpB,EAAG,WAAW,uFAAuFoB,MAAM,MAAMpB,EAAG,gBAAgB,CAAC,iBAAiB,WAAW,YAAY,UAAUA,EAAG,mBAAmB,2DAA2DoB,MAAM,MAAMpB,EAAG,qBAAqB,6DAA6DoB,MAAM,MAC/fpB,EAAG,sBAAsB,8DAA8DoB,MAAM,MAAM,IAAIukB,GAAG,6NAA6NvkB,MAAM,KAAKwkB,GAAG,IAAI9lB,IAAI,0CAA0CsB,MAAM,KAAKnF,OAAO0pB,KACzZ,SAASE,GAAGhoB,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAE7D,MAAM,gBAAgB6D,EAAEuZ,cAAcza,EAlDjE,SAAYkB,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,EAAEC,EAAEC,GAA4B,GAAzBuS,GAAGP,MAAMpO,KAAKrG,WAAc2U,GAAG,CAAC,IAAGA,GAAgC,MAAMtL,MAAMxG,EAAE,MAA1C,IAAIH,EAAEkS,GAAGD,IAAG,EAAGC,GAAG,KAA8BC,KAAKA,IAAG,EAAGC,GAAGpS,EAAE,CAAC,CAkDpE6oB,CAAGlpB,EAAEJ,OAAE,EAAOqB,GAAGA,EAAEuZ,cAAc,IAAI,CACxG,SAASiJ,GAAGxiB,EAAErB,GAAGA,EAAE,KAAO,EAAFA,GAAK,IAAI,IAAIG,EAAE,EAAEA,EAAEkB,EAAE1D,OAAOwC,IAAI,CAAC,IAAIC,EAAEiB,EAAElB,GAAGJ,EAAEK,EAAEojB,MAAMpjB,EAAEA,EAAEqjB,UAAUpiB,EAAE,CAAC,IAAIhB,OAAE,EAAO,GAAGL,EAAE,IAAI,IAAIM,EAAEF,EAAEzC,OAAO,EAAE,GAAG2C,EAAEA,IAAI,CAAC,IAAIC,EAAEH,EAAEE,GAAGE,EAAED,EAAEgpB,SAAS9oB,EAAEF,EAAEqa,cAA2B,GAAbra,EAAEA,EAAEipB,SAAYhpB,IAAIH,GAAGN,EAAEib,uBAAuB,MAAM3Z,EAAEgoB,GAAGtpB,EAAEQ,EAAEE,GAAGJ,EAAEG,CAAC,MAAM,IAAIF,EAAE,EAAEA,EAAEF,EAAEzC,OAAO2C,IAAI,CAAoD,GAA5CE,GAAPD,EAAEH,EAAEE,IAAOipB,SAAS9oB,EAAEF,EAAEqa,cAAcra,EAAEA,EAAEipB,SAAYhpB,IAAIH,GAAGN,EAAEib,uBAAuB,MAAM3Z,EAAEgoB,GAAGtpB,EAAEQ,EAAEE,GAAGJ,EAAEG,CAAC,CAAC,CAAC,CAAC,GAAGoS,GAAG,MAAMvR,EAAEwR,GAAGD,IAAG,EAAGC,GAAG,KAAKxR,CAAE,CAC5a,SAASooB,GAAEpoB,EAAErB,GAAG,IAAIG,EAAEH,EAAE0pB,SAAI,IAASvpB,IAAIA,EAAEH,EAAE0pB,IAAI,IAAIpmB,KAAK,IAAIlD,EAAEiB,EAAE,WAAWlB,EAAEwpB,IAAIvpB,KAAKwpB,GAAG5pB,EAAEqB,EAAE,GAAE,GAAIlB,EAAEuD,IAAItD,GAAG,CAAC,SAASypB,GAAGxoB,EAAErB,EAAEG,GAAG,IAAIC,EAAE,EAAEJ,IAAII,GAAG,GAAGwpB,GAAGzpB,EAAEkB,EAAEjB,EAAEJ,EAAE,CAAC,IAAI8pB,GAAG,kBAAkBvU,KAAKwU,SAASne,SAAS,IAAIzG,MAAM,GAAG,SAAS6kB,GAAG3oB,GAAG,IAAIA,EAAEyoB,IAAI,CAACzoB,EAAEyoB,KAAI,EAAGzmB,EAAGwB,SAAQ,SAAS7E,GAAG,oBAAoBA,IAAIopB,GAAGO,IAAI3pB,IAAI6pB,GAAG7pB,GAAE,EAAGqB,GAAGwoB,GAAG7pB,GAAE,EAAGqB,GAAG,IAAG,IAAIrB,EAAE,IAAIqB,EAAE+K,SAAS/K,EAAEA,EAAEgJ,cAAc,OAAOrK,GAAGA,EAAE8pB,MAAM9pB,EAAE8pB,KAAI,EAAGD,GAAG,mBAAkB,EAAG7pB,GAAG,CAAC,CACjb,SAAS4pB,GAAGvoB,EAAErB,EAAEG,EAAEC,GAAG,OAAO2Z,GAAG/Z,IAAI,KAAK,EAAE,IAAID,EAAEwZ,GAAG,MAAM,KAAK,EAAExZ,EAAE2Z,GAAG,MAAM,QAAQ3Z,EAAE0Z,GAAGtZ,EAAEJ,EAAEkqB,KAAK,KAAKjqB,EAAEG,EAAEkB,GAAGtB,OAAE,GAAQoS,IAAI,eAAenS,GAAG,cAAcA,GAAG,UAAUA,IAAID,GAAE,GAAIK,OAAE,IAASL,EAAEsB,EAAEgR,iBAAiBrS,EAAEG,EAAE,CAAC+pB,SAAQ,EAAGC,QAAQpqB,IAAIsB,EAAEgR,iBAAiBrS,EAAEG,GAAE,QAAI,IAASJ,EAAEsB,EAAEgR,iBAAiBrS,EAAEG,EAAE,CAACgqB,QAAQpqB,IAAIsB,EAAEgR,iBAAiBrS,EAAEG,GAAE,EAAG,CAClV,SAASwZ,GAAGtY,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,IAAIM,EAAED,EAAE,GAAG,KAAO,EAAFJ,IAAM,KAAO,EAAFA,IAAM,OAAOI,EAAEiB,EAAE,OAAO,CAAC,GAAG,OAAOjB,EAAE,OAAO,IAAIE,EAAEF,EAAE4H,IAAI,GAAG,IAAI1H,GAAG,IAAIA,EAAE,CAAC,IAAIC,EAAEH,EAAEqR,UAAUkH,cAAc,GAAGpY,IAAIR,GAAG,IAAIQ,EAAE6L,UAAU7L,EAAE4Q,aAAapR,EAAE,MAAM,GAAG,IAAIO,EAAE,IAAIA,EAAEF,EAAE8S,OAAO,OAAO5S,GAAG,CAAC,IAAIE,EAAEF,EAAE0H,IAAI,IAAG,IAAIxH,GAAG,IAAIA,MAAKA,EAAEF,EAAEmR,UAAUkH,iBAAkB5Y,GAAG,IAAIS,EAAE4L,UAAU5L,EAAE2Q,aAAapR,GAAE,OAAOO,EAAEA,EAAE4S,MAAM,CAAC,KAAK,OAAO3S,GAAG,CAAS,GAAG,QAAXD,EAAEkY,GAAGjY,IAAe,OAAe,GAAG,KAAXC,EAAEF,EAAE0H,MAAc,IAAIxH,EAAE,CAACJ,EAAEC,EAAEC,EAAE,SAASe,CAAC,CAACd,EAAEA,EAAE4Q,UAAU,CAAC,CAAC/Q,EAAEA,EAAE8S,MAAM,CAACjB,IAAG,WAAW,IAAI7R,EAAEC,EAAEN,EAAEgR,GAAG5Q,GAAGG,EAAE,GACpfe,EAAE,CAAC,IAAId,EAAEuoB,GAAGlgB,IAAIvH,GAAG,QAAG,IAASd,EAAE,CAAC,IAAIC,EAAEwb,GAAGrb,EAAEU,EAAE,OAAOA,GAAG,IAAK,WAAW,GAAG,IAAI+Y,GAAGja,GAAG,MAAMkB,EAAE,IAAK,UAAU,IAAK,QAAQb,EAAE0f,GAAG,MAAM,IAAK,UAAUvf,EAAE,QAAQH,EAAEod,GAAG,MAAM,IAAK,WAAWjd,EAAE,OAAOH,EAAEod,GAAG,MAAM,IAAK,aAAa,IAAK,YAAYpd,EAAEod,GAAG,MAAM,IAAK,QAAQ,GAAG,IAAIzd,EAAE+c,OAAO,MAAM7b,EAAE,IAAK,WAAW,IAAK,WAAW,IAAK,YAAY,IAAK,YAAY,IAAK,UAAU,IAAK,WAAW,IAAK,YAAY,IAAK,cAAcb,EAAEid,GAAG,MAAM,IAAK,OAAO,IAAK,UAAU,IAAK,YAAY,IAAK,WAAW,IAAK,YAAY,IAAK,WAAW,IAAK,YAAY,IAAK,OAAOjd,EAC1iBkd,GAAG,MAAM,IAAK,cAAc,IAAK,WAAW,IAAK,YAAY,IAAK,aAAald,EAAEqgB,GAAG,MAAM,KAAK6H,GAAG,KAAKC,GAAG,KAAKC,GAAGpoB,EAAEqd,GAAG,MAAM,KAAKgL,GAAGroB,EAAEygB,GAAG,MAAM,IAAK,SAASzgB,EAAE4b,GAAG,MAAM,IAAK,QAAQ5b,EAAEkhB,GAAG,MAAM,IAAK,OAAO,IAAK,MAAM,IAAK,QAAQlhB,EAAE2d,GAAG,MAAM,IAAK,oBAAoB,IAAK,qBAAqB,IAAK,gBAAgB,IAAK,cAAc,IAAK,cAAc,IAAK,aAAa,IAAK,cAAc,IAAK,YAAY3d,EAAE2f,GAAG,IAAIpf,EAAE,KAAO,EAAFf,GAAKoqB,GAAGrpB,GAAG,WAAWM,EAAEH,EAAEH,EAAE,OAAOR,EAAEA,EAAE,UAAU,KAAKA,EAAEQ,EAAE,GAAG,IAAI,IAAQO,EAAJL,EAAEb,EAAI,OAC/ea,GAAG,CAAK,IAAIopB,GAAR/oB,EAAEL,GAAUwQ,UAAsF,GAA5E,IAAInQ,EAAE0G,KAAK,OAAOqiB,IAAI/oB,EAAE+oB,EAAE,OAAOnpB,IAAc,OAAVmpB,EAAEnY,GAAGjR,EAAEC,KAAYH,EAAE6Q,KAAK0Y,GAAGrpB,EAAEopB,EAAE/oB,MAAS8oB,EAAE,MAAMnpB,EAAEA,EAAEiS,MAAM,CAAC,EAAEnS,EAAEpD,SAAS4C,EAAE,IAAIC,EAAED,EAAEI,EAAE,KAAKR,EAAEJ,GAAGO,EAAEsR,KAAK,CAAC4R,MAAMjjB,EAAEkjB,UAAU1iB,IAAI,CAAC,CAAC,GAAG,KAAO,EAAFf,GAAK,CAA4E,GAAnCQ,EAAE,aAAaa,GAAG,eAAeA,KAAtEd,EAAE,cAAcc,GAAG,gBAAgBA,IAA2ClB,IAAI2Q,MAAKnQ,EAAER,EAAEid,eAAejd,EAAEkd,eAAe7E,GAAG7X,KAAIA,EAAE4pB,OAAgB/pB,GAAGD,KAAGA,EAAER,EAAE6D,SAAS7D,EAAEA,GAAGQ,EAAER,EAAEsK,eAAe9J,EAAEgmB,aAAahmB,EAAEiqB,aAAa5mB,OAAUpD,GAAqCA,EAAEJ,EAAiB,QAAfO,GAAnCA,EAAER,EAAEid,eAAejd,EAAEmd,WAAkB9E,GAAG7X,GAAG,QAC9dA,KAARypB,EAAEpX,GAAGrS,KAAU,IAAIA,EAAEqH,KAAK,IAAIrH,EAAEqH,OAAKrH,EAAE,QAAUH,EAAE,KAAKG,EAAEP,GAAKI,IAAIG,GAAE,CAAgU,GAA/TI,EAAE0c,GAAG4M,EAAE,eAAenpB,EAAE,eAAeD,EAAE,QAAW,eAAeI,GAAG,gBAAgBA,IAAEN,EAAEof,GAAGkK,EAAE,iBAAiBnpB,EAAE,iBAAiBD,EAAE,WAAUmpB,EAAE,MAAM5pB,EAAED,EAAEwjB,GAAGvjB,GAAGc,EAAE,MAAMX,EAAEJ,EAAEwjB,GAAGpjB,IAAGJ,EAAE,IAAIQ,EAAEspB,EAAEppB,EAAE,QAAQT,EAAEL,EAAEJ,IAAKiR,OAAOoZ,EAAE7pB,EAAE6c,cAAc9b,EAAE+oB,EAAE,KAAK7R,GAAGzY,KAAKK,KAAIW,EAAE,IAAIA,EAAEG,EAAED,EAAE,QAAQN,EAAER,EAAEJ,IAAKiR,OAAO1P,EAAEP,EAAEqc,cAAcgN,EAAEC,EAAEtpB,GAAGqpB,EAAEC,EAAK7pB,GAAGG,EAAEX,EAAE,CAAa,IAARkB,EAAEP,EAAEM,EAAE,EAAMK,EAAhBP,EAAEP,EAAkBc,EAAEA,EAAEmpB,GAAGnpB,GAAGL,IAAQ,IAAJK,EAAE,EAAM+oB,EAAEnpB,EAAEmpB,EAAEA,EAAEI,GAAGJ,GAAG/oB,IAAI,KAAK,EAAEL,EAAEK,GAAGP,EAAE0pB,GAAG1pB,GAAGE,IAAI,KAAK,EAAEK,EAAEL,GAAGC,EACpfupB,GAAGvpB,GAAGI,IAAI,KAAKL,KAAK,CAAC,GAAGF,IAAIG,GAAG,OAAOA,GAAGH,IAAIG,EAAE+R,UAAU,MAAMjT,EAAEe,EAAE0pB,GAAG1pB,GAAGG,EAAEupB,GAAGvpB,EAAE,CAACH,EAAE,IAAI,MAAMA,EAAE,KAAK,OAAOP,GAAGkqB,GAAGpqB,EAAEC,EAAEC,EAAEO,GAAE,GAAI,OAAOJ,GAAG,OAAOypB,GAAGM,GAAGpqB,EAAE8pB,EAAEzpB,EAAEI,GAAE,EAAG,CAA8D,GAAG,YAA1CP,GAAjBD,EAAEH,EAAE2jB,GAAG3jB,GAAGwD,QAAW4E,UAAUjI,EAAEiI,SAAS1D,gBAA+B,UAAUtE,GAAG,SAASD,EAAE/C,KAAK,IAAImtB,EAAG3G,QAAQ,GAAGX,GAAG9iB,GAAG,GAAG0jB,GAAG0G,EAAG9F,OAAO,CAAC8F,EAAGhG,GAAG,IAAIiG,EAAGnG,EAAE,MAAMjkB,EAAED,EAAEiI,WAAW,UAAUhI,EAAEsE,gBAAgB,aAAavE,EAAE/C,MAAM,UAAU+C,EAAE/C,QAAQmtB,EAAG/F,IACrV,OAD4V+F,IAAKA,EAAGA,EAAGtpB,EAAEjB,IAAKkjB,GAAGhjB,EAAEqqB,EAAGxqB,EAAEJ,IAAW6qB,GAAIA,EAAGvpB,EAAEd,EAAEH,GAAG,aAAaiB,IAAIupB,EAAGrqB,EAAEqJ,gBAClfghB,EAAG5gB,YAAY,WAAWzJ,EAAE/C,MAAM2M,GAAG5J,EAAE,SAASA,EAAE8I,QAAOuhB,EAAGxqB,EAAE2jB,GAAG3jB,GAAGwD,OAAcvC,GAAG,IAAK,WAAagiB,GAAGuH,IAAK,SAASA,EAAG/E,mBAAgB8B,GAAGiD,EAAGhD,GAAGxnB,EAAEynB,GAAG,MAAK,MAAM,IAAK,WAAWA,GAAGD,GAAGD,GAAG,KAAK,MAAM,IAAK,YAAYG,IAAG,EAAG,MAAM,IAAK,cAAc,IAAK,UAAU,IAAK,UAAUA,IAAG,EAAGC,GAAGznB,EAAEH,EAAEJ,GAAG,MAAM,IAAK,kBAAkB,GAAG2nB,GAAG,MAAM,IAAK,UAAU,IAAK,QAAQK,GAAGznB,EAAEH,EAAEJ,GAAG,IAAI8qB,EAAG,GAAGjJ,GAAG5hB,EAAE,CAAC,OAAOqB,GAAG,IAAK,mBAAmB,IAAIypB,EAAG,qBAAqB,MAAM9qB,EAAE,IAAK,iBAAiB8qB,EAAG,mBACpe,MAAM9qB,EAAE,IAAK,oBAAoB8qB,EAAG,sBAAsB,MAAM9qB,EAAE8qB,OAAG,CAAM,MAAMzI,GAAGF,GAAG9gB,EAAElB,KAAK2qB,EAAG,oBAAoB,YAAYzpB,GAAG,MAAMlB,EAAEka,UAAUyQ,EAAG,sBAAsBA,IAAK9I,IAAI,OAAO7hB,EAAE6f,SAASqC,IAAI,uBAAuByI,EAAG,qBAAqBA,GAAIzI,KAAKwI,EAAG1Q,OAAYF,GAAG,UAARD,GAAGja,GAAkBia,GAAG3Q,MAAM2Q,GAAG5O,YAAYiX,IAAG,IAAiB,GAAZuI,EAAGrH,GAAGnjB,EAAE0qB,IAASntB,SAASmtB,EAAG,IAAI1M,GAAG0M,EAAGzpB,EAAE,KAAKlB,EAAEJ,GAAGO,EAAEsR,KAAK,CAAC4R,MAAMsH,EAAGrH,UAAUmH,IAAKC,EAAGC,EAAGzM,KAAKwM,EAAa,QAATA,EAAGzI,GAAGjiB,MAAe2qB,EAAGzM,KAAKwM,MAAUA,EAAG9I,GA5BhM,SAAY1gB,EAAErB,GAAG,OAAOqB,GAAG,IAAK,iBAAiB,OAAO+gB,GAAGpiB,GAAG,IAAK,WAAW,OAAG,KAAKA,EAAEigB,MAAa,MAAKiC,IAAG,EAAUD,IAAG,IAAK,YAAY,OAAO5gB,EAAErB,EAAEqe,QAAS4D,IAAIC,GAAG,KAAK7gB,EAAE,QAAQ,OAAO,KAAK,CA4BE0pB,CAAG1pB,EAAElB,GA3Bzd,SAAYkB,EAAErB,GAAG,GAAGqiB,GAAG,MAAM,mBAAmBhhB,IAAIugB,IAAIO,GAAG9gB,EAAErB,IAAIqB,EAAE8Y,KAAKD,GAAGD,GAAGD,GAAG,KAAKqI,IAAG,EAAGhhB,GAAG,KAAK,OAAOA,GAAG,IAAK,QAAgQ,QAAQ,OAAO,KAA3P,IAAK,WAAW,KAAKrB,EAAE4c,SAAS5c,EAAE8c,QAAQ9c,EAAE+c,UAAU/c,EAAE4c,SAAS5c,EAAE8c,OAAO,CAAC,GAAG9c,EAAEgrB,MAAM,EAAEhrB,EAAEgrB,KAAKrtB,OAAO,OAAOqC,EAAEgrB,KAAK,GAAGhrB,EAAEigB,MAAM,OAAON,OAAOC,aAAa5f,EAAEigB,MAAM,CAAC,OAAO,KAAK,IAAK,iBAAiB,OAAO+B,IAAI,OAAOhiB,EAAEggB,OAAO,KAAKhgB,EAAEqe,KAAyB,CA2BqF4M,CAAG5pB,EAAElB,MACje,GADoeC,EAAEmjB,GAAGnjB,EAAE,kBACvezC,SAASoC,EAAE,IAAIqe,GAAG,gBAAgB,cAAc,KAAKje,EAAEJ,GAAGO,EAAEsR,KAAK,CAAC4R,MAAMzjB,EAAE0jB,UAAUrjB,IAAIL,EAAEse,KAAKwM,GAAG,CAAChH,GAAGvjB,EAAEN,EAAE,GAAE,CAAC,SAASsqB,GAAGjpB,EAAErB,EAAEG,GAAG,MAAM,CAACopB,SAASloB,EAAEmoB,SAASxpB,EAAE4a,cAAcza,EAAE,CAAC,SAASojB,GAAGliB,EAAErB,GAAG,IAAI,IAAIG,EAAEH,EAAE,UAAUI,EAAE,GAAG,OAAOiB,GAAG,CAAC,IAAItB,EAAEsB,EAAEhB,EAAEN,EAAE0R,UAAU,IAAI1R,EAAEiI,KAAK,OAAO3H,IAAIN,EAAEM,EAAY,OAAVA,EAAE6R,GAAG7Q,EAAElB,KAAYC,EAAE8qB,QAAQZ,GAAGjpB,EAAEhB,EAAEN,IAAc,OAAVM,EAAE6R,GAAG7Q,EAAErB,KAAYI,EAAEwR,KAAK0Y,GAAGjpB,EAAEhB,EAAEN,KAAKsB,EAAEA,EAAE6R,MAAM,CAAC,OAAO9S,CAAC,CAAC,SAASqqB,GAAGppB,GAAG,GAAG,OAAOA,EAAE,OAAO,KAAK,GAAGA,EAAEA,EAAE6R,aAAa7R,GAAG,IAAIA,EAAE2G,KAAK,OAAO3G,GAAI,IAAI,CACnd,SAASqpB,GAAGrpB,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,IAAI,IAAIM,EAAEL,EAAE0a,WAAWpa,EAAE,GAAG,OAAOH,GAAGA,IAAIC,GAAG,CAAC,IAAIG,EAAEJ,EAAEK,EAAED,EAAE0S,UAAUxS,EAAEF,EAAEkR,UAAU,GAAG,OAAOjR,GAAGA,IAAIJ,EAAE,MAAM,IAAIG,EAAEyH,KAAK,OAAOvH,IAAIF,EAAEE,EAAEV,EAAa,OAAVS,EAAE0R,GAAG/R,EAAEE,KAAYC,EAAE4qB,QAAQZ,GAAGnqB,EAAEK,EAAED,IAAKR,GAAc,OAAVS,EAAE0R,GAAG/R,EAAEE,KAAYC,EAAEsR,KAAK0Y,GAAGnqB,EAAEK,EAAED,KAAMJ,EAAEA,EAAE+S,MAAM,CAAC,IAAI5S,EAAE3C,QAAQ0D,EAAEuQ,KAAK,CAAC4R,MAAMxjB,EAAEyjB,UAAUnjB,GAAG,CAAC,IAAI6qB,GAAG,SAASC,GAAG,iBAAiB,SAASC,GAAGhqB,GAAG,OAAO,kBAAkBA,EAAEA,EAAE,GAAGA,GAAGwE,QAAQslB,GAAG,MAAMtlB,QAAQulB,GAAG,GAAG,CAAC,SAASE,GAAGjqB,EAAErB,EAAEG,GAAW,GAARH,EAAEqrB,GAAGrrB,GAAMqrB,GAAGhqB,KAAKrB,GAAGG,EAAE,MAAMiH,MAAMxG,EAAE,KAAM,CAAC,SAAS2qB,KAAK,CAC9e,IAAIC,GAAG,KAAKC,GAAG,KAAK,SAASC,GAAGrqB,EAAErB,GAAG,MAAM,aAAaqB,GAAG,aAAaA,GAAG,kBAAkBrB,EAAEgL,UAAU,kBAAkBhL,EAAEgL,UAAU,kBAAkBhL,EAAE+K,yBAAyB,OAAO/K,EAAE+K,yBAAyB,MAAM/K,EAAE+K,wBAAwB4gB,MAAM,CAC5P,IAAIC,GAAG,oBAAoBC,WAAWA,gBAAW,EAAOC,GAAG,oBAAoBC,aAAaA,kBAAa,EAAOC,GAAG,oBAAoBC,QAAQA,aAAQ,EAAOC,GAAG,oBAAoBC,eAAeA,eAAe,qBAAqBH,GAAG,SAAS3qB,GAAG,OAAO2qB,GAAGI,QAAQ,MAAMC,KAAKhrB,GAAGirB,MAAMC,GAAG,EAAEX,GAAG,SAASW,GAAGlrB,GAAGwqB,YAAW,WAAW,MAAMxqB,CAAE,GAAE,CACpV,SAASmrB,GAAGnrB,EAAErB,GAAG,IAAIG,EAAEH,EAAEI,EAAE,EAAE,EAAE,CAAC,IAAIL,EAAEI,EAAEilB,YAA6B,GAAjB/jB,EAAEyK,YAAY3L,GAAMJ,GAAG,IAAIA,EAAEqM,SAAS,GAAY,QAATjM,EAAEJ,EAAEse,MAAc,CAAC,GAAG,IAAIje,EAA0B,OAAvBiB,EAAEyK,YAAY/L,QAAGoZ,GAAGnZ,GAAUI,GAAG,KAAK,MAAMD,GAAG,OAAOA,GAAG,OAAOA,GAAGC,IAAID,EAAEJ,CAAC,OAAOI,GAAGgZ,GAAGnZ,EAAE,CAAC,SAASysB,GAAGprB,GAAG,KAAK,MAAMA,EAAEA,EAAEA,EAAE+jB,YAAY,CAAC,IAAIplB,EAAEqB,EAAE+K,SAAS,GAAG,IAAIpM,GAAG,IAAIA,EAAE,MAAM,GAAG,IAAIA,EAAE,CAAU,GAAG,OAAZA,EAAEqB,EAAEgd,OAAiB,OAAOre,GAAG,OAAOA,EAAE,MAAM,GAAG,OAAOA,EAAE,OAAO,IAAI,CAAC,CAAC,OAAOqB,CAAC,CACjY,SAASqrB,GAAGrrB,GAAGA,EAAEA,EAAEsrB,gBAAgB,IAAI,IAAI3sB,EAAE,EAAEqB,GAAG,CAAC,GAAG,IAAIA,EAAE+K,SAAS,CAAC,IAAIjM,EAAEkB,EAAEgd,KAAK,GAAG,MAAMle,GAAG,OAAOA,GAAG,OAAOA,EAAE,CAAC,GAAG,IAAIH,EAAE,OAAOqB,EAAErB,GAAG,KAAK,OAAOG,GAAGH,GAAG,CAACqB,EAAEA,EAAEsrB,eAAe,CAAC,OAAO,IAAI,CAAC,IAAIC,GAAGrX,KAAKwU,SAASne,SAAS,IAAIzG,MAAM,GAAG0nB,GAAG,gBAAgBD,GAAGE,GAAG,gBAAgBF,GAAGrC,GAAG,oBAAoBqC,GAAGlD,GAAG,iBAAiBkD,GAAGG,GAAG,oBAAoBH,GAAGI,GAAG,kBAAkBJ,GAClX,SAASpU,GAAGnX,GAAG,IAAIrB,EAAEqB,EAAEwrB,IAAI,GAAG7sB,EAAE,OAAOA,EAAE,IAAI,IAAIG,EAAEkB,EAAE8P,WAAWhR,GAAG,CAAC,GAAGH,EAAEG,EAAEoqB,KAAKpqB,EAAE0sB,IAAI,CAAe,GAAd1sB,EAAEH,EAAEiT,UAAa,OAAOjT,EAAEyT,OAAO,OAAOtT,GAAG,OAAOA,EAAEsT,MAAM,IAAIpS,EAAEqrB,GAAGrrB,GAAG,OAAOA,GAAG,CAAC,GAAGlB,EAAEkB,EAAEwrB,IAAI,OAAO1sB,EAAEkB,EAAEqrB,GAAGrrB,EAAE,CAAC,OAAOrB,CAAC,CAAKG,GAAJkB,EAAElB,GAAMgR,UAAU,CAAC,OAAO,IAAI,CAAC,SAASK,GAAGnQ,GAAkB,QAAfA,EAAEA,EAAEwrB,KAAKxrB,EAAEkpB,MAAc,IAAIlpB,EAAE2G,KAAK,IAAI3G,EAAE2G,KAAK,KAAK3G,EAAE2G,KAAK,IAAI3G,EAAE2G,IAAI,KAAK3G,CAAC,CAAC,SAAS0iB,GAAG1iB,GAAG,GAAG,IAAIA,EAAE2G,KAAK,IAAI3G,EAAE2G,IAAI,OAAO3G,EAAEoQ,UAAU,MAAMrK,MAAMxG,EAAE,IAAK,CAAC,SAAS8Q,GAAGrQ,GAAG,OAAOA,EAAEyrB,KAAK,IAAI,CAAC,IAAIG,GAAG,GAAGC,IAAI,EAAE,SAASC,GAAG9rB,GAAG,MAAM,CAACsS,QAAQtS,EAAE,CACve,SAAS+rB,GAAE/rB,GAAG,EAAE6rB,KAAK7rB,EAAEsS,QAAQsZ,GAAGC,IAAID,GAAGC,IAAI,KAAKA,KAAK,CAAC,SAASG,GAAEhsB,EAAErB,GAAGktB,KAAKD,GAAGC,IAAI7rB,EAAEsS,QAAQtS,EAAEsS,QAAQ3T,CAAC,CAAC,IAAIstB,GAAG,CAAC,EAAEC,GAAEJ,GAAGG,IAAIE,GAAGL,IAAG,GAAIM,GAAGH,GAAG,SAASI,GAAGrsB,EAAErB,GAAG,IAAIG,EAAEkB,EAAE7D,KAAKR,aAAa,IAAImD,EAAE,OAAOmtB,GAAG,IAAIltB,EAAEiB,EAAEoQ,UAAU,GAAGrR,GAAGA,EAAEutB,8CAA8C3tB,EAAE,OAAOI,EAAEwtB,0CAA0C,IAASvtB,EAALN,EAAE,CAAC,EAAI,IAAIM,KAAKF,EAAEJ,EAAEM,GAAGL,EAAEK,GAAoH,OAAjHD,KAAIiB,EAAEA,EAAEoQ,WAAYkc,4CAA4C3tB,EAAEqB,EAAEusB,0CAA0C7tB,GAAUA,CAAC,CAC9d,SAAS8tB,GAAGxsB,GAAyB,OAAO,QAA7BA,EAAEA,EAAEvE,yBAAmC,IAASuE,CAAC,CAAC,SAASysB,KAAKV,GAAEI,IAAIJ,GAAEG,GAAE,CAAC,SAASQ,GAAG1sB,EAAErB,EAAEG,GAAG,GAAGotB,GAAE5Z,UAAU2Z,GAAG,MAAMlmB,MAAMxG,EAAE,MAAMysB,GAAEE,GAAEvtB,GAAGqtB,GAAEG,GAAGrtB,EAAE,CAAC,SAAS6tB,GAAG3sB,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAEoQ,UAAgC,GAAtBzR,EAAEA,EAAElD,kBAAqB,oBAAoBsD,EAAE6tB,gBAAgB,OAAO9tB,EAAwB,IAAI,IAAIJ,KAA9BK,EAAEA,EAAE6tB,kBAAiC,KAAKluB,KAAKC,GAAG,MAAMoH,MAAMxG,EAAE,IAAIyH,EAAGhH,IAAI,UAAUtB,IAAI,OAAOyB,EAAE,CAAC,EAAErB,EAAEC,EAAE,CACxX,SAAS8tB,GAAG7sB,GAA2G,OAAxGA,GAAGA,EAAEA,EAAEoQ,YAAYpQ,EAAE8sB,2CAA2Cb,GAAGG,GAAGF,GAAE5Z,QAAQ0Z,GAAEE,GAAElsB,GAAGgsB,GAAEG,GAAGA,GAAG7Z,UAAe,CAAE,CAAC,SAASya,GAAG/sB,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAEoQ,UAAU,IAAIrR,EAAE,MAAMgH,MAAMxG,EAAE,MAAMT,GAAGkB,EAAE2sB,GAAG3sB,EAAErB,EAAEytB,IAAIrtB,EAAE+tB,0CAA0C9sB,EAAE+rB,GAAEI,IAAIJ,GAAEG,IAAGF,GAAEE,GAAElsB,IAAI+rB,GAAEI,IAAIH,GAAEG,GAAGrtB,EAAE,CAAC,IAAIkuB,GAAG,KAAKC,IAAG,EAAGC,IAAG,EAAG,SAASC,GAAGntB,GAAG,OAAOgtB,GAAGA,GAAG,CAAChtB,GAAGgtB,GAAGzc,KAAKvQ,EAAE,CAChW,SAASotB,KAAK,IAAIF,IAAI,OAAOF,GAAG,CAACE,IAAG,EAAG,IAAIltB,EAAE,EAAErB,EAAE6W,GAAE,IAAI,IAAI1W,EAAEkuB,GAAG,IAAIxX,GAAE,EAAExV,EAAElB,EAAExC,OAAO0D,IAAI,CAAC,IAAIjB,EAAED,EAAEkB,GAAG,GAAGjB,EAAEA,GAAE,SAAU,OAAOA,EAAE,CAACiuB,GAAG,KAAKC,IAAG,CAAE,CAAC,MAAMvuB,GAAG,MAAM,OAAOsuB,KAAKA,GAAGA,GAAGlpB,MAAM9D,EAAE,IAAIyS,GAAGY,GAAG+Z,IAAI1uB,CAAE,CAAC,QAAQ8W,GAAE7W,EAAEuuB,IAAG,CAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAIG,GAAG,GAAGC,GAAG,EAAEC,GAAG,KAAKC,GAAG,EAAEC,GAAG,GAAGC,GAAG,EAAEC,GAAG,KAAKC,GAAG,EAAEC,GAAG,GAAG,SAASC,GAAG9tB,EAAErB,GAAG0uB,GAAGC,MAAME,GAAGH,GAAGC,MAAMC,GAAGA,GAAGvtB,EAAEwtB,GAAG7uB,CAAC,CACjV,SAASovB,GAAG/tB,EAAErB,EAAEG,GAAG2uB,GAAGC,MAAME,GAAGH,GAAGC,MAAMG,GAAGJ,GAAGC,MAAMC,GAAGA,GAAG3tB,EAAE,IAAIjB,EAAE6uB,GAAG5tB,EAAE6tB,GAAG,IAAInvB,EAAE,GAAGuV,GAAGlV,GAAG,EAAEA,KAAK,GAAGL,GAAGI,GAAG,EAAE,IAAIE,EAAE,GAAGiV,GAAGtV,GAAGD,EAAE,GAAG,GAAGM,EAAE,CAAC,IAAIC,EAAEP,EAAEA,EAAE,EAAEM,GAAGD,GAAG,GAAGE,GAAG,GAAGsL,SAAS,IAAIxL,IAAIE,EAAEP,GAAGO,EAAE2uB,GAAG,GAAG,GAAG3Z,GAAGtV,GAAGD,EAAEI,GAAGJ,EAAEK,EAAE8uB,GAAG7uB,EAAEgB,CAAC,MAAM4tB,GAAG,GAAG5uB,EAAEF,GAAGJ,EAAEK,EAAE8uB,GAAG7tB,CAAC,CAAC,SAASguB,GAAGhuB,GAAG,OAAOA,EAAE6R,SAASic,GAAG9tB,EAAE,GAAG+tB,GAAG/tB,EAAE,EAAE,GAAG,CAAC,SAASiuB,GAAGjuB,GAAG,KAAKA,IAAIutB,IAAIA,GAAGF,KAAKC,IAAID,GAAGC,IAAI,KAAKE,GAAGH,KAAKC,IAAID,GAAGC,IAAI,KAAK,KAAKttB,IAAI2tB,IAAIA,GAAGF,KAAKC,IAAID,GAAGC,IAAI,KAAKG,GAAGJ,KAAKC,IAAID,GAAGC,IAAI,KAAKE,GAAGH,KAAKC,IAAID,GAAGC,IAAI,IAAI,CAAC,IAAIQ,GAAG,KAAKC,GAAG,KAAKC,IAAE,EAAGC,GAAG,KACje,SAASC,GAAGtuB,EAAErB,GAAG,IAAIG,EAAEyvB,GAAG,EAAE,KAAK,KAAK,GAAGzvB,EAAE0vB,YAAY,UAAU1vB,EAAEsR,UAAUzR,EAAEG,EAAE+S,OAAO7R,EAAgB,QAAdrB,EAAEqB,EAAEyuB,YAAoBzuB,EAAEyuB,UAAU,CAAC3vB,GAAGkB,EAAE8R,OAAO,IAAInT,EAAE4R,KAAKzR,EAAE,CACxJ,SAAS4vB,GAAG1uB,EAAErB,GAAG,OAAOqB,EAAE2G,KAAK,KAAK,EAAE,IAAI7H,EAAEkB,EAAE7D,KAAyE,OAAO,QAA3EwC,EAAE,IAAIA,EAAEoM,UAAUjM,EAAE2E,gBAAgB9E,EAAEwI,SAAS1D,cAAc,KAAK9E,KAAmBqB,EAAEoQ,UAAUzR,EAAEuvB,GAAGluB,EAAEmuB,GAAG/C,GAAGzsB,EAAE6L,aAAY,GAAO,KAAK,EAAE,OAAoD,QAA7C7L,EAAE,KAAKqB,EAAE2uB,cAAc,IAAIhwB,EAAEoM,SAAS,KAAKpM,KAAYqB,EAAEoQ,UAAUzR,EAAEuvB,GAAGluB,EAAEmuB,GAAG,MAAK,GAAO,KAAK,GAAG,OAA+B,QAAxBxvB,EAAE,IAAIA,EAAEoM,SAAS,KAAKpM,KAAYG,EAAE,OAAO6uB,GAAG,CAACpV,GAAGqV,GAAGgB,SAASf,IAAI,KAAK7tB,EAAEgS,cAAc,CAACC,WAAWtT,EAAEkwB,YAAY/vB,EAAEgwB,UAAU,aAAYhwB,EAAEyvB,GAAG,GAAG,KAAK,KAAK,IAAKne,UAAUzR,EAAEG,EAAE+S,OAAO7R,EAAEA,EAAEoS,MAAMtT,EAAEovB,GAAGluB,EAAEmuB,GAClf,MAAK,GAAO,QAAQ,OAAM,EAAG,CAAC,SAASY,GAAG/uB,GAAG,OAAO,KAAY,EAAPA,EAAEgvB,OAAS,KAAa,IAARhvB,EAAE8R,MAAU,CAAC,SAASmd,GAAGjvB,GAAG,GAAGouB,GAAE,CAAC,IAAIzvB,EAAEwvB,GAAG,GAAGxvB,EAAE,CAAC,IAAIG,EAAEH,EAAE,IAAI+vB,GAAG1uB,EAAErB,GAAG,CAAC,GAAGowB,GAAG/uB,GAAG,MAAM+F,MAAMxG,EAAE,MAAMZ,EAAEysB,GAAGtsB,EAAEilB,aAAa,IAAIhlB,EAAEmvB,GAAGvvB,GAAG+vB,GAAG1uB,EAAErB,GAAG2vB,GAAGvvB,EAAED,IAAIkB,EAAE8R,OAAe,KAAT9R,EAAE8R,MAAY,EAAEsc,IAAE,EAAGF,GAAGluB,EAAE,CAAC,KAAK,CAAC,GAAG+uB,GAAG/uB,GAAG,MAAM+F,MAAMxG,EAAE,MAAMS,EAAE8R,OAAe,KAAT9R,EAAE8R,MAAY,EAAEsc,IAAE,EAAGF,GAAGluB,CAAC,CAAC,CAAC,CAAC,SAASkvB,GAAGlvB,GAAG,IAAIA,EAAEA,EAAE6R,OAAO,OAAO7R,GAAG,IAAIA,EAAE2G,KAAK,IAAI3G,EAAE2G,KAAK,KAAK3G,EAAE2G,KAAK3G,EAAEA,EAAE6R,OAAOqc,GAAGluB,CAAC,CACha,SAASmvB,GAAGnvB,GAAG,GAAGA,IAAIkuB,GAAG,OAAM,EAAG,IAAIE,GAAE,OAAOc,GAAGlvB,GAAGouB,IAAE,GAAG,EAAG,IAAIzvB,EAAkG,IAA/FA,EAAE,IAAIqB,EAAE2G,QAAQhI,EAAE,IAAIqB,EAAE2G,OAAgBhI,EAAE,UAAXA,EAAEqB,EAAE7D,OAAmB,SAASwC,IAAI0rB,GAAGrqB,EAAE7D,KAAK6D,EAAEovB,gBAAmBzwB,IAAIA,EAAEwvB,IAAI,CAAC,GAAGY,GAAG/uB,GAAG,MAAMqvB,KAAKtpB,MAAMxG,EAAE,MAAM,KAAKZ,GAAG2vB,GAAGtuB,EAAErB,GAAGA,EAAEysB,GAAGzsB,EAAEolB,YAAY,CAAO,GAANmL,GAAGlvB,GAAM,KAAKA,EAAE2G,IAAI,CAAgD,KAA7B3G,EAAE,QAApBA,EAAEA,EAAEgS,eAAyBhS,EAAEiS,WAAW,MAAW,MAAMlM,MAAMxG,EAAE,MAAMS,EAAE,CAAiB,IAAhBA,EAAEA,EAAE+jB,YAAgBplB,EAAE,EAAEqB,GAAG,CAAC,GAAG,IAAIA,EAAE+K,SAAS,CAAC,IAAIjM,EAAEkB,EAAEgd,KAAK,GAAG,OAAOle,EAAE,CAAC,GAAG,IAAIH,EAAE,CAACwvB,GAAG/C,GAAGprB,EAAE+jB,aAAa,MAAM/jB,CAAC,CAACrB,GAAG,KAAK,MAAMG,GAAG,OAAOA,GAAG,OAAOA,GAAGH,GAAG,CAACqB,EAAEA,EAAE+jB,WAAW,CAACoK,GACjgB,IAAI,CAAC,MAAMA,GAAGD,GAAG9C,GAAGprB,EAAEoQ,UAAU2T,aAAa,KAAK,OAAM,CAAE,CAAC,SAASsL,KAAK,IAAI,IAAIrvB,EAAEmuB,GAAGnuB,GAAGA,EAAEorB,GAAGprB,EAAE+jB,YAAY,CAAC,SAASuL,KAAKnB,GAAGD,GAAG,KAAKE,IAAE,CAAE,CAAC,SAASmB,GAAGvvB,GAAG,OAAOquB,GAAGA,GAAG,CAACruB,GAAGquB,GAAG9d,KAAKvQ,EAAE,CAAC,IAAIwvB,GAAG9qB,EAAGsT,wBAAwB,SAASyX,GAAGzvB,EAAErB,GAAG,GAAGqB,GAAGA,EAAEpE,aAAa,CAA4B,IAAI,IAAIkD,KAAnCH,EAAEwB,EAAE,CAAC,EAAExB,GAAGqB,EAAEA,EAAEpE,kBAA4B,IAAS+C,EAAEG,KAAKH,EAAEG,GAAGkB,EAAElB,IAAI,OAAOH,CAAC,CAAC,OAAOA,CAAC,CAAC,IAAI+wB,GAAG5D,GAAG,MAAM6D,GAAG,KAAKC,GAAG,KAAKC,GAAG,KAAK,SAASC,KAAKD,GAAGD,GAAGD,GAAG,IAAI,CAAC,SAASI,GAAG/vB,GAAG,IAAIrB,EAAE+wB,GAAGpd,QAAQyZ,GAAE2D,IAAI1vB,EAAEgwB,cAAcrxB,CAAC,CACjd,SAASsxB,GAAGjwB,EAAErB,EAAEG,GAAG,KAAK,OAAOkB,GAAG,CAAC,IAAIjB,EAAEiB,EAAE4R,UAA+H,IAApH5R,EAAEkwB,WAAWvxB,KAAKA,GAAGqB,EAAEkwB,YAAYvxB,EAAE,OAAOI,IAAIA,EAAEmxB,YAAYvxB,IAAI,OAAOI,IAAIA,EAAEmxB,WAAWvxB,KAAKA,IAAII,EAAEmxB,YAAYvxB,GAAMqB,IAAIlB,EAAE,MAAMkB,EAAEA,EAAE6R,MAAM,CAAC,CAAC,SAASse,GAAGnwB,EAAErB,GAAGgxB,GAAG3vB,EAAE6vB,GAAGD,GAAG,KAAsB,QAAjB5vB,EAAEA,EAAEowB,eAAuB,OAAOpwB,EAAEqwB,eAAe,KAAKrwB,EAAEswB,MAAM3xB,KAAK4xB,IAAG,GAAIvwB,EAAEqwB,aAAa,KAAK,CACtU,SAASG,GAAGxwB,GAAG,IAAIrB,EAAEqB,EAAEgwB,cAAc,GAAGH,KAAK7vB,EAAE,GAAGA,EAAE,CAACywB,QAAQzwB,EAAE0wB,cAAc/xB,EAAEgyB,KAAK,MAAM,OAAOf,GAAG,CAAC,GAAG,OAAOD,GAAG,MAAM5pB,MAAMxG,EAAE,MAAMqwB,GAAG5vB,EAAE2vB,GAAGS,aAAa,CAACE,MAAM,EAAED,aAAarwB,EAAE,MAAM4vB,GAAGA,GAAGe,KAAK3wB,EAAE,OAAOrB,CAAC,CAAC,IAAIiyB,GAAG,KAAK,SAASC,GAAG7wB,GAAG,OAAO4wB,GAAGA,GAAG,CAAC5wB,GAAG4wB,GAAGrgB,KAAKvQ,EAAE,CAAC,SAAS8wB,GAAG9wB,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEC,EAAEoyB,YAA+E,OAAnE,OAAOryB,GAAGI,EAAE6xB,KAAK7xB,EAAE+xB,GAAGlyB,KAAKG,EAAE6xB,KAAKjyB,EAAEiyB,KAAKjyB,EAAEiyB,KAAK7xB,GAAGH,EAAEoyB,YAAYjyB,EAASkyB,GAAGhxB,EAAEjB,EAAE,CAChY,SAASiyB,GAAGhxB,EAAErB,GAAGqB,EAAEswB,OAAO3xB,EAAE,IAAIG,EAAEkB,EAAE4R,UAAqC,IAA3B,OAAO9S,IAAIA,EAAEwxB,OAAO3xB,GAAGG,EAAEkB,EAAMA,EAAEA,EAAE6R,OAAO,OAAO7R,GAAGA,EAAEkwB,YAAYvxB,EAAgB,QAAdG,EAAEkB,EAAE4R,aAAqB9S,EAAEoxB,YAAYvxB,GAAGG,EAAEkB,EAAEA,EAAEA,EAAE6R,OAAO,OAAO,IAAI/S,EAAE6H,IAAI7H,EAAEsR,UAAU,IAAI,CAAC,IAAI6gB,IAAG,EAAG,SAASC,GAAGlxB,GAAGA,EAAEmxB,YAAY,CAACC,UAAUpxB,EAAEgS,cAAcqf,gBAAgB,KAAKC,eAAe,KAAKC,OAAO,CAACC,QAAQ,KAAKT,YAAY,KAAKT,MAAM,GAAGmB,QAAQ,KAAK,CACpX,SAASC,GAAG1xB,EAAErB,GAAGqB,EAAEA,EAAEmxB,YAAYxyB,EAAEwyB,cAAcnxB,IAAIrB,EAAEwyB,YAAY,CAACC,UAAUpxB,EAAEoxB,UAAUC,gBAAgBrxB,EAAEqxB,gBAAgBC,eAAetxB,EAAEsxB,eAAeC,OAAOvxB,EAAEuxB,OAAOE,QAAQzxB,EAAEyxB,SAAS,CAAC,SAASE,GAAG3xB,EAAErB,GAAG,MAAM,CAACizB,UAAU5xB,EAAE6xB,KAAKlzB,EAAEgI,IAAI,EAAEmrB,QAAQ,KAAKC,SAAS,KAAKpB,KAAK,KAAK,CACtR,SAASqB,GAAGhyB,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAEmxB,YAAY,GAAG,OAAOpyB,EAAE,OAAO,KAAgB,GAAXA,EAAEA,EAAEwyB,OAAU,KAAO,EAAFU,IAAK,CAAC,IAAIvzB,EAAEK,EAAEyyB,QAA+D,OAAvD,OAAO9yB,EAAEC,EAAEgyB,KAAKhyB,GAAGA,EAAEgyB,KAAKjyB,EAAEiyB,KAAKjyB,EAAEiyB,KAAKhyB,GAAGI,EAAEyyB,QAAQ7yB,EAASqyB,GAAGhxB,EAAElB,EAAE,CAAoF,OAAnE,QAAhBJ,EAAEK,EAAEgyB,cAAsBpyB,EAAEgyB,KAAKhyB,EAAEkyB,GAAG9xB,KAAKJ,EAAEgyB,KAAKjyB,EAAEiyB,KAAKjyB,EAAEiyB,KAAKhyB,GAAGI,EAAEgyB,YAAYpyB,EAASqyB,GAAGhxB,EAAElB,EAAE,CAAC,SAASozB,GAAGlyB,EAAErB,EAAEG,GAAmB,GAAG,QAAnBH,EAAEA,EAAEwyB,eAA0BxyB,EAAEA,EAAE4yB,OAAO,KAAO,QAAFzyB,IAAY,CAAC,IAAIC,EAAEJ,EAAE2xB,MAAwBxxB,GAAlBC,GAAGiB,EAAE4U,aAAkBjW,EAAE2xB,MAAMxxB,EAAEyW,GAAGvV,EAAElB,EAAE,CAAC,CACrZ,SAASqzB,GAAGnyB,EAAErB,GAAG,IAAIG,EAAEkB,EAAEmxB,YAAYpyB,EAAEiB,EAAE4R,UAAU,GAAG,OAAO7S,GAAoBD,KAAhBC,EAAEA,EAAEoyB,aAAmB,CAAC,IAAIzyB,EAAE,KAAKM,EAAE,KAAyB,GAAG,QAAvBF,EAAEA,EAAEuyB,iBAA4B,CAAC,EAAE,CAAC,IAAIpyB,EAAE,CAAC2yB,UAAU9yB,EAAE8yB,UAAUC,KAAK/yB,EAAE+yB,KAAKlrB,IAAI7H,EAAE6H,IAAImrB,QAAQhzB,EAAEgzB,QAAQC,SAASjzB,EAAEizB,SAASpB,KAAK,MAAM,OAAO3xB,EAAEN,EAAEM,EAAEC,EAAED,EAAEA,EAAE2xB,KAAK1xB,EAAEH,EAAEA,EAAE6xB,IAAI,OAAO,OAAO7xB,GAAG,OAAOE,EAAEN,EAAEM,EAAEL,EAAEK,EAAEA,EAAE2xB,KAAKhyB,CAAC,MAAMD,EAAEM,EAAEL,EAAiH,OAA/GG,EAAE,CAACsyB,UAAUryB,EAAEqyB,UAAUC,gBAAgB3yB,EAAE4yB,eAAetyB,EAAEuyB,OAAOxyB,EAAEwyB,OAAOE,QAAQ1yB,EAAE0yB,cAASzxB,EAAEmxB,YAAYryB,EAAQ,CAAoB,QAAnBkB,EAAElB,EAAEwyB,gBAAwBxyB,EAAEuyB,gBAAgB1yB,EAAEqB,EAAE2wB,KACnfhyB,EAAEG,EAAEwyB,eAAe3yB,CAAC,CACpB,SAASyzB,GAAGpyB,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEsB,EAAEmxB,YAAYF,IAAG,EAAG,IAAIjyB,EAAEN,EAAE2yB,gBAAgBpyB,EAAEP,EAAE4yB,eAAepyB,EAAER,EAAE6yB,OAAOC,QAAQ,GAAG,OAAOtyB,EAAE,CAACR,EAAE6yB,OAAOC,QAAQ,KAAK,IAAIryB,EAAED,EAAEE,EAAED,EAAEwxB,KAAKxxB,EAAEwxB,KAAK,KAAK,OAAO1xB,EAAED,EAAEI,EAAEH,EAAE0xB,KAAKvxB,EAAEH,EAAEE,EAAE,IAAIE,EAAEW,EAAE4R,UAAU,OAAOvS,KAAoBH,GAAhBG,EAAEA,EAAE8xB,aAAgBG,kBAAmBryB,IAAI,OAAOC,EAAEG,EAAEgyB,gBAAgBjyB,EAAEF,EAAEyxB,KAAKvxB,EAAEC,EAAEiyB,eAAenyB,GAAG,CAAC,GAAG,OAAOH,EAAE,CAAC,IAAIQ,EAAEd,EAAE0yB,UAA6B,IAAnBnyB,EAAE,EAAEI,EAAED,EAAED,EAAE,KAAKD,EAAEF,IAAI,CAAC,IAAIS,EAAEP,EAAE2yB,KAAK/xB,EAAEZ,EAAE0yB,UAAU,IAAI7yB,EAAEU,KAAKA,EAAE,CAAC,OAAOJ,IAAIA,EAAEA,EAAEsxB,KAAK,CAACiB,UAAU9xB,EAAE+xB,KAAK,EAAElrB,IAAIzH,EAAEyH,IAAImrB,QAAQ5yB,EAAE4yB,QAAQC,SAAS7yB,EAAE6yB,SACvfpB,KAAK,OAAO3wB,EAAE,CAAC,IAAIV,EAAEU,EAAEN,EAAER,EAAU,OAARO,EAAEd,EAAEmB,EAAEhB,EAASY,EAAEiH,KAAK,KAAK,EAAc,GAAG,oBAAfrH,EAAEI,EAAEoyB,SAAiC,CAACtyB,EAAEF,EAAE4E,KAAKpE,EAAEN,EAAEC,GAAG,MAAMO,CAAC,CAACR,EAAEF,EAAE,MAAMU,EAAE,KAAK,EAAEV,EAAEwS,OAAe,MAATxS,EAAEwS,MAAa,IAAI,KAAK,EAAsD,GAAG,QAA3CrS,EAAE,oBAAdH,EAAEI,EAAEoyB,SAAgCxyB,EAAE4E,KAAKpE,EAAEN,EAAEC,GAAGH,SAAe,IAASG,EAAE,MAAMO,EAAER,EAAEW,EAAE,CAAC,EAAEX,EAAEC,GAAG,MAAMO,EAAE,KAAK,EAAEixB,IAAG,EAAG,CAAC,OAAO/xB,EAAE6yB,UAAU,IAAI7yB,EAAE2yB,OAAO7xB,EAAE8R,OAAO,GAAe,QAAZrS,EAAEf,EAAE+yB,SAAiB/yB,EAAE+yB,QAAQ,CAACvyB,GAAGO,EAAE8Q,KAAKrR,GAAG,MAAMY,EAAE,CAAC8xB,UAAU9xB,EAAE+xB,KAAKpyB,EAAEkH,IAAIzH,EAAEyH,IAAImrB,QAAQ5yB,EAAE4yB,QAAQC,SAAS7yB,EAAE6yB,SAASpB,KAAK,MAAM,OAAOtxB,GAAGD,EAAEC,EAAES,EAAEX,EAAEK,GAAGH,EAAEA,EAAEsxB,KAAK7wB,EAAEb,GAAGQ,EAC3e,GAAG,QAAZP,EAAEA,EAAEyxB,MAAiB,IAAsB,QAAnBzxB,EAAER,EAAE6yB,OAAOC,SAAiB,MAAetyB,GAAJO,EAAEP,GAAMyxB,KAAKlxB,EAAEkxB,KAAK,KAAKjyB,EAAE4yB,eAAe7xB,EAAEf,EAAE6yB,OAAOC,QAAQ,IAAI,EAAsG,GAA5F,OAAOnyB,IAAIF,EAAEK,GAAGd,EAAE0yB,UAAUjyB,EAAET,EAAE2yB,gBAAgBjyB,EAAEV,EAAE4yB,eAAejyB,EAA4B,QAA1BV,EAAED,EAAE6yB,OAAOR,aAAwB,CAACryB,EAAEC,EAAE,GAAGM,GAAGP,EAAEmzB,KAAKnzB,EAAEA,EAAEiyB,WAAWjyB,IAAIC,EAAE,MAAM,OAAOK,IAAIN,EAAE6yB,OAAOjB,MAAM,GAAG+B,IAAIpzB,EAAEe,EAAEswB,MAAMrxB,EAAEe,EAAEgS,cAAcxS,CAAC,CAAC,CAC9V,SAAS8yB,GAAGtyB,EAAErB,EAAEG,GAA8B,GAA3BkB,EAAErB,EAAE8yB,QAAQ9yB,EAAE8yB,QAAQ,KAAQ,OAAOzxB,EAAE,IAAIrB,EAAE,EAAEA,EAAEqB,EAAE1D,OAAOqC,IAAI,CAAC,IAAII,EAAEiB,EAAErB,GAAGD,EAAEK,EAAEgzB,SAAS,GAAG,OAAOrzB,EAAE,CAAqB,GAApBK,EAAEgzB,SAAS,KAAKhzB,EAAED,EAAK,oBAAoBJ,EAAE,MAAMqH,MAAMxG,EAAE,IAAIb,IAAIA,EAAEwF,KAAKnF,EAAE,CAAC,CAAC,CAAC,IAAIwzB,IAAI,IAAI1wB,EAAG2wB,WAAWC,KAAK,SAASC,GAAG1yB,EAAErB,EAAEG,EAAEC,GAA8BD,EAAE,QAAXA,EAAEA,EAAEC,EAAtBJ,EAAEqB,EAAEgS,sBAAmC,IAASlT,EAAEH,EAAEwB,EAAE,CAAC,EAAExB,EAAEG,GAAGkB,EAAEgS,cAAclT,EAAE,IAAIkB,EAAEswB,QAAQtwB,EAAEmxB,YAAYC,UAAUtyB,EAAE,CAClX,IAAI6zB,GAAG,CAACC,UAAU,SAAS5yB,GAAG,SAAOA,EAAEA,EAAE6yB,kBAAiBlhB,GAAG3R,KAAKA,CAAI,EAAE8yB,gBAAgB,SAAS9yB,EAAErB,EAAEG,GAAGkB,EAAEA,EAAE6yB,gBAAgB,IAAI9zB,EAAEg0B,KAAIr0B,EAAEs0B,GAAGhzB,GAAGhB,EAAE2yB,GAAG5yB,EAAEL,GAAGM,EAAE8yB,QAAQnzB,OAAE,IAASG,GAAG,OAAOA,IAAIE,EAAE+yB,SAASjzB,GAAe,QAAZH,EAAEqzB,GAAGhyB,EAAEhB,EAAEN,MAAcu0B,GAAGt0B,EAAEqB,EAAEtB,EAAEK,GAAGmzB,GAAGvzB,EAAEqB,EAAEtB,GAAG,EAAEw0B,oBAAoB,SAASlzB,EAAErB,EAAEG,GAAGkB,EAAEA,EAAE6yB,gBAAgB,IAAI9zB,EAAEg0B,KAAIr0B,EAAEs0B,GAAGhzB,GAAGhB,EAAE2yB,GAAG5yB,EAAEL,GAAGM,EAAE2H,IAAI,EAAE3H,EAAE8yB,QAAQnzB,OAAE,IAASG,GAAG,OAAOA,IAAIE,EAAE+yB,SAASjzB,GAAe,QAAZH,EAAEqzB,GAAGhyB,EAAEhB,EAAEN,MAAcu0B,GAAGt0B,EAAEqB,EAAEtB,EAAEK,GAAGmzB,GAAGvzB,EAAEqB,EAAEtB,GAAG,EAAEy0B,mBAAmB,SAASnzB,EAAErB,GAAGqB,EAAEA,EAAE6yB,gBAAgB,IAAI/zB,EAAEi0B,KAAIh0B,EACnfi0B,GAAGhzB,GAAGtB,EAAEizB,GAAG7yB,EAAEC,GAAGL,EAAEiI,IAAI,OAAE,IAAShI,GAAG,OAAOA,IAAID,EAAEqzB,SAASpzB,GAAe,QAAZA,EAAEqzB,GAAGhyB,EAAEtB,EAAEK,MAAck0B,GAAGt0B,EAAEqB,EAAEjB,EAAED,GAAGozB,GAAGvzB,EAAEqB,EAAEjB,GAAG,GAAG,SAASq0B,GAAGpzB,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,GAAiB,MAAM,oBAApBe,EAAEA,EAAEoQ,WAAsCijB,sBAAsBrzB,EAAEqzB,sBAAsBt0B,EAAEC,EAAEC,IAAGN,EAAEpC,YAAWoC,EAAEpC,UAAU+2B,wBAAsB5P,GAAG5kB,EAAEC,KAAK2kB,GAAGhlB,EAAEM,GAAK,CAC1S,SAASu0B,GAAGvzB,EAAErB,EAAEG,GAAG,IAAIC,GAAE,EAAGL,EAAEutB,GAAOjtB,EAAEL,EAAEjD,YAA2W,MAA/V,kBAAkBsD,GAAG,OAAOA,EAAEA,EAAEwxB,GAAGxxB,IAAIN,EAAE8tB,GAAG7tB,GAAGytB,GAAGF,GAAE5Z,QAAyBtT,GAAGD,EAAE,QAAtBA,EAAEJ,EAAEhD,oBAA4B,IAASoD,GAAGstB,GAAGrsB,EAAEtB,GAAGutB,IAAIttB,EAAE,IAAIA,EAAEG,EAAEE,GAAGgB,EAAEgS,cAAc,OAAOrT,EAAE60B,YAAO,IAAS70B,EAAE60B,MAAM70B,EAAE60B,MAAM,KAAK70B,EAAE80B,QAAQd,GAAG3yB,EAAEoQ,UAAUzR,EAAEA,EAAEk0B,gBAAgB7yB,EAAEjB,KAAIiB,EAAEA,EAAEoQ,WAAYkc,4CAA4C5tB,EAAEsB,EAAEusB,0CAA0CvtB,GAAUL,CAAC,CAC5Z,SAAS+0B,GAAG1zB,EAAErB,EAAEG,EAAEC,GAAGiB,EAAErB,EAAE60B,MAAM,oBAAoB70B,EAAEg1B,2BAA2Bh1B,EAAEg1B,0BAA0B70B,EAAEC,GAAG,oBAAoBJ,EAAEi1B,kCAAkCj1B,EAAEi1B,iCAAiC90B,EAAEC,GAAGJ,EAAE60B,QAAQxzB,GAAG2yB,GAAGO,oBAAoBv0B,EAAEA,EAAE60B,MAAM,KAAK,CACpQ,SAASK,GAAG7zB,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEsB,EAAEoQ,UAAU1R,EAAEo1B,MAAMh1B,EAAEJ,EAAE80B,MAAMxzB,EAAEgS,cAActT,EAAE+zB,KAAKF,GAAGrB,GAAGlxB,GAAG,IAAIhB,EAAEL,EAAEjD,YAAY,kBAAkBsD,GAAG,OAAOA,EAAEN,EAAE+xB,QAAQD,GAAGxxB,IAAIA,EAAEwtB,GAAG7tB,GAAGytB,GAAGF,GAAE5Z,QAAQ5T,EAAE+xB,QAAQpE,GAAGrsB,EAAEhB,IAAIN,EAAE80B,MAAMxzB,EAAEgS,cAA2C,oBAA7BhT,EAAEL,EAAE3C,4BAAiD02B,GAAG1yB,EAAErB,EAAEK,EAAEF,GAAGJ,EAAE80B,MAAMxzB,EAAEgS,eAAe,oBAAoBrT,EAAE3C,0BAA0B,oBAAoB0C,EAAEq1B,yBAAyB,oBAAoBr1B,EAAEs1B,2BAA2B,oBAAoBt1B,EAAEu1B,qBAAqBt1B,EAAED,EAAE80B,MACrf,oBAAoB90B,EAAEu1B,oBAAoBv1B,EAAEu1B,qBAAqB,oBAAoBv1B,EAAEs1B,2BAA2Bt1B,EAAEs1B,4BAA4Br1B,IAAID,EAAE80B,OAAOb,GAAGO,oBAAoBx0B,EAAEA,EAAE80B,MAAM,MAAMpB,GAAGpyB,EAAElB,EAAEJ,EAAEK,GAAGL,EAAE80B,MAAMxzB,EAAEgS,eAAe,oBAAoBtT,EAAEw1B,oBAAoBl0B,EAAE8R,OAAO,QAAQ,CACpS,SAASqiB,GAAGn0B,EAAErB,EAAEG,GAAW,GAAG,QAAXkB,EAAElB,EAAEs1B,MAAiB,oBAAoBp0B,GAAG,kBAAkBA,EAAE,CAAC,GAAGlB,EAAEu1B,OAAO,CAAY,GAAXv1B,EAAEA,EAAEu1B,OAAY,CAAC,GAAG,IAAIv1B,EAAE6H,IAAI,MAAMZ,MAAMxG,EAAE,MAAM,IAAIR,EAAED,EAAEsR,SAAS,CAAC,IAAIrR,EAAE,MAAMgH,MAAMxG,EAAE,IAAIS,IAAI,IAAItB,EAAEK,EAAEC,EAAE,GAAGgB,EAAE,OAAG,OAAOrB,GAAG,OAAOA,EAAEy1B,KAAK,oBAAoBz1B,EAAEy1B,KAAKz1B,EAAEy1B,IAAIE,aAAat1B,EAASL,EAAEy1B,KAAIz1B,EAAE,SAASqB,GAAG,IAAIrB,EAAED,EAAE+zB,KAAK9zB,IAAI4zB,KAAK5zB,EAAED,EAAE+zB,KAAK,CAAC,GAAG,OAAOzyB,SAASrB,EAAEK,GAAGL,EAAEK,GAAGgB,CAAC,EAAErB,EAAE21B,WAAWt1B,EAASL,EAAC,CAAC,GAAG,kBAAkBqB,EAAE,MAAM+F,MAAMxG,EAAE,MAAM,IAAIT,EAAEu1B,OAAO,MAAMtuB,MAAMxG,EAAE,IAAIS,GAAI,CAAC,OAAOA,CAAC,CACre,SAASu0B,GAAGv0B,EAAErB,GAAuC,MAApCqB,EAAE1C,OAAOf,UAAUgO,SAASrG,KAAKvF,GAASoH,MAAMxG,EAAE,GAAG,oBAAoBS,EAAE,qBAAqB1C,OAAOa,KAAKQ,GAAG61B,KAAK,MAAM,IAAIx0B,GAAI,CAAC,SAASy0B,GAAGz0B,GAAiB,OAAOrB,EAAfqB,EAAE+G,OAAe/G,EAAE8G,SAAS,CACrM,SAAS4tB,GAAG10B,GAAG,SAASrB,EAAEA,EAAEG,GAAG,GAAGkB,EAAE,CAAC,IAAIjB,EAAEJ,EAAE8vB,UAAU,OAAO1vB,GAAGJ,EAAE8vB,UAAU,CAAC3vB,GAAGH,EAAEmT,OAAO,IAAI/S,EAAEwR,KAAKzR,EAAE,CAAC,CAAC,SAASA,EAAEA,EAAEC,GAAG,IAAIiB,EAAE,OAAO,KAAK,KAAK,OAAOjB,GAAGJ,EAAEG,EAAEC,GAAGA,EAAEA,EAAEsT,QAAQ,OAAO,IAAI,CAAC,SAAStT,EAAEiB,EAAErB,GAAG,IAAIqB,EAAE,IAAIqW,IAAI,OAAO1X,GAAG,OAAOA,EAAEH,IAAIwB,EAAEsG,IAAI3H,EAAEH,IAAIG,GAAGqB,EAAEsG,IAAI3H,EAAEg2B,MAAMh2B,GAAGA,EAAEA,EAAE0T,QAAQ,OAAOrS,CAAC,CAAC,SAAStB,EAAEsB,EAAErB,GAAsC,OAAnCqB,EAAE40B,GAAG50B,EAAErB,IAAKg2B,MAAM,EAAE30B,EAAEqS,QAAQ,KAAYrS,CAAC,CAAC,SAAShB,EAAEL,EAAEG,EAAEC,GAAa,OAAVJ,EAAEg2B,MAAM51B,EAAMiB,EAA6C,QAAjBjB,EAAEJ,EAAEiT,YAA6B7S,EAAEA,EAAE41B,OAAQ71B,GAAGH,EAAEmT,OAAO,EAAEhT,GAAGC,GAAEJ,EAAEmT,OAAO,EAAShT,IAArGH,EAAEmT,OAAO,QAAQhT,EAAqF,CAAC,SAASG,EAAEN,GACzd,OAD4dqB,GAC7f,OAAOrB,EAAEiT,YAAYjT,EAAEmT,OAAO,GAAUnT,CAAC,CAAC,SAASO,EAAEc,EAAErB,EAAEG,EAAEC,GAAG,OAAG,OAAOJ,GAAG,IAAIA,EAAEgI,MAAWhI,EAAEk2B,GAAG/1B,EAAEkB,EAAEgvB,KAAKjwB,IAAK8S,OAAO7R,EAAErB,KAAEA,EAAED,EAAEC,EAAEG,IAAK+S,OAAO7R,EAASrB,EAAC,CAAC,SAASQ,EAAEa,EAAErB,EAAEG,EAAEC,GAAG,IAAIC,EAAEF,EAAE3C,KAAK,OAAG6C,IAAI8F,EAAUzF,EAAEW,EAAErB,EAAEG,EAAEg1B,MAAMnqB,SAAS5K,EAAED,EAAEN,KAAQ,OAAOG,IAAIA,EAAE6vB,cAAcxvB,GAAG,kBAAkBA,GAAG,OAAOA,GAAGA,EAAEkB,WAAWqF,GAAIkvB,GAAGz1B,KAAKL,EAAExC,QAAa4C,EAAEL,EAAEC,EAAEG,EAAEg1B,QAASM,IAAID,GAAGn0B,EAAErB,EAAEG,GAAGC,EAAE8S,OAAO7R,EAAEjB,KAAEA,EAAE+1B,GAAGh2B,EAAE3C,KAAK2C,EAAEN,IAAIM,EAAEg1B,MAAM,KAAK9zB,EAAEgvB,KAAKjwB,IAAKq1B,IAAID,GAAGn0B,EAAErB,EAAEG,GAAGC,EAAE8S,OAAO7R,EAASjB,EAAC,CAAC,SAASK,EAAEY,EAAErB,EAAEG,EAAEC,GAAG,OAAG,OAAOJ,GAAG,IAAIA,EAAEgI,KACjfhI,EAAEyR,UAAUkH,gBAAgBxY,EAAEwY,eAAe3Y,EAAEyR,UAAU2kB,iBAAiBj2B,EAAEi2B,iBAAsBp2B,EAAEq2B,GAAGl2B,EAAEkB,EAAEgvB,KAAKjwB,IAAK8S,OAAO7R,EAAErB,KAAEA,EAAED,EAAEC,EAAEG,EAAE6K,UAAU,KAAMkI,OAAO7R,EAASrB,EAAC,CAAC,SAASU,EAAEW,EAAErB,EAAEG,EAAEC,EAAEC,GAAG,OAAG,OAAOL,GAAG,IAAIA,EAAEgI,MAAWhI,EAAEs2B,GAAGn2B,EAAEkB,EAAEgvB,KAAKjwB,EAAEC,IAAK6S,OAAO7R,EAAErB,KAAEA,EAAED,EAAEC,EAAEG,IAAK+S,OAAO7R,EAASrB,EAAC,CAAC,SAASa,EAAEQ,EAAErB,EAAEG,GAAG,GAAG,kBAAkBH,GAAG,KAAKA,GAAG,kBAAkBA,EAAE,OAAOA,EAAEk2B,GAAG,GAAGl2B,EAAEqB,EAAEgvB,KAAKlwB,IAAK+S,OAAO7R,EAAErB,EAAE,GAAG,kBAAkBA,GAAG,OAAOA,EAAE,CAAC,OAAOA,EAAEuB,UAAU,KAAK0E,EAAG,OAAO9F,EAAEg2B,GAAGn2B,EAAExC,KAAKwC,EAAEH,IAAIG,EAAEm1B,MAAM,KAAK9zB,EAAEgvB,KAAKlwB,IACjfs1B,IAAID,GAAGn0B,EAAE,KAAKrB,GAAGG,EAAE+S,OAAO7R,EAAElB,EAAE,KAAK+F,EAAG,OAAOlG,EAAEq2B,GAAGr2B,EAAEqB,EAAEgvB,KAAKlwB,IAAK+S,OAAO7R,EAAErB,EAAE,KAAK4G,EAAiB,OAAO/F,EAAEQ,GAAEjB,EAAnBJ,EAAEoI,OAAmBpI,EAAEmI,UAAUhI,GAAG,GAAGmK,GAAGtK,IAAIgH,EAAGhH,GAAG,OAAOA,EAAEs2B,GAAGt2B,EAAEqB,EAAEgvB,KAAKlwB,EAAE,OAAQ+S,OAAO7R,EAAErB,EAAE41B,GAAGv0B,EAAErB,EAAE,CAAC,OAAO,IAAI,CAAC,SAASc,EAAEO,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAE,OAAOC,EAAEA,EAAEH,IAAI,KAAK,GAAG,kBAAkBM,GAAG,KAAKA,GAAG,kBAAkBA,EAAE,OAAO,OAAOJ,EAAE,KAAKQ,EAAEc,EAAErB,EAAE,GAAGG,EAAEC,GAAG,GAAG,kBAAkBD,GAAG,OAAOA,EAAE,CAAC,OAAOA,EAAEoB,UAAU,KAAK0E,EAAG,OAAO9F,EAAEN,MAAME,EAAES,EAAEa,EAAErB,EAAEG,EAAEC,GAAG,KAAK,KAAK8F,EAAG,OAAO/F,EAAEN,MAAME,EAAEU,EAAEY,EAAErB,EAAEG,EAAEC,GAAG,KAAK,KAAKwG,EAAG,OAAiB9F,EAAEO,EACpfrB,GADweD,EAAEI,EAAEiI,OACxejI,EAAEgI,UAAU/H,GAAG,GAAGkK,GAAGnK,IAAI6G,EAAG7G,GAAG,OAAO,OAAOJ,EAAE,KAAKW,EAAEW,EAAErB,EAAEG,EAAEC,EAAE,MAAMw1B,GAAGv0B,EAAElB,EAAE,CAAC,OAAO,IAAI,CAAC,SAASgB,EAAEE,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,GAAG,kBAAkBK,GAAG,KAAKA,GAAG,kBAAkBA,EAAE,OAAwBG,EAAEP,EAAnBqB,EAAEA,EAAEuH,IAAIzI,IAAI,KAAW,GAAGC,EAAEL,GAAG,GAAG,kBAAkBK,GAAG,OAAOA,EAAE,CAAC,OAAOA,EAAEmB,UAAU,KAAK0E,EAAG,OAA2CzF,EAAER,EAAtCqB,EAAEA,EAAEuH,IAAI,OAAOxI,EAAEP,IAAIM,EAAEC,EAAEP,MAAM,KAAWO,EAAEL,GAAG,KAAKmG,EAAG,OAA2CzF,EAAET,EAAtCqB,EAAEA,EAAEuH,IAAI,OAAOxI,EAAEP,IAAIM,EAAEC,EAAEP,MAAM,KAAWO,EAAEL,GAAG,KAAK6G,EAAiB,OAAOzF,EAAEE,EAAErB,EAAEG,GAAEE,EAAvBD,EAAEgI,OAAuBhI,EAAE+H,UAAUpI,GAAG,GAAGuK,GAAGlK,IAAI4G,EAAG5G,GAAG,OAAwBM,EAAEV,EAAnBqB,EAAEA,EAAEuH,IAAIzI,IAAI,KAAWC,EAAEL,EAAE,MAAM61B,GAAG51B,EAAEI,EAAE,CAAC,OAAO,IAAI,CAC9f,SAASO,EAAEZ,EAAEO,EAAEC,EAAEC,GAAG,IAAI,IAAIC,EAAE,KAAKC,EAAE,KAAKY,EAAEhB,EAAEW,EAAEX,EAAE,EAAEY,EAAE,KAAK,OAAOI,GAAGL,EAAEV,EAAE5C,OAAOsD,IAAI,CAACK,EAAE00B,MAAM/0B,GAAGC,EAAEI,EAAEA,EAAE,MAAMJ,EAAEI,EAAEoS,QAAQ,IAAI/S,EAAEG,EAAEf,EAAEuB,EAAEf,EAAEU,GAAGT,GAAG,GAAG,OAAOG,EAAE,CAAC,OAAOW,IAAIA,EAAEJ,GAAG,KAAK,CAACG,GAAGC,GAAG,OAAOX,EAAEsS,WAAWjT,EAAED,EAAEuB,GAAGhB,EAAED,EAAEM,EAAEL,EAAEW,GAAG,OAAOP,EAAED,EAAEE,EAAED,EAAEgT,QAAQ/S,EAAED,EAAEC,EAAEW,EAAEJ,CAAC,CAAC,GAAGD,IAAIV,EAAE5C,OAAO,OAAOwC,EAAEJ,EAAEuB,GAAGmuB,IAAGN,GAAGpvB,EAAEkB,GAAGR,EAAE,GAAG,OAAOa,EAAE,CAAC,KAAKL,EAAEV,EAAE5C,OAAOsD,IAAkB,QAAdK,EAAET,EAAEd,EAAEQ,EAAEU,GAAGT,MAAcF,EAAED,EAAEiB,EAAEhB,EAAEW,GAAG,OAAOP,EAAED,EAAEa,EAAEZ,EAAEgT,QAAQpS,EAAEZ,EAAEY,GAAc,OAAXmuB,IAAGN,GAAGpvB,EAAEkB,GAAUR,CAAC,CAAC,IAAIa,EAAElB,EAAEL,EAAEuB,GAAGL,EAAEV,EAAE5C,OAAOsD,IAAsB,QAAlBC,EAAEC,EAAEG,EAAEvB,EAAEkB,EAAEV,EAAEU,GAAGT,MAAca,GAAG,OAAOH,EAAE+R,WAAW3R,EAAEyW,OAAO,OACvf7W,EAAErB,IAAIoB,EAAEC,EAAErB,KAAKS,EAAED,EAAEa,EAAEZ,EAAEW,GAAG,OAAOP,EAAED,EAAES,EAAER,EAAEgT,QAAQxS,EAAER,EAAEQ,GAAuD,OAApDG,GAAGC,EAAEuD,SAAQ,SAASxD,GAAG,OAAOrB,EAAED,EAAEsB,EAAE,IAAGouB,IAAGN,GAAGpvB,EAAEkB,GAAUR,CAAC,CAAC,SAASM,EAAEhB,EAAEO,EAAEC,EAAEC,GAAG,IAAIC,EAAEuG,EAAGzG,GAAG,GAAG,oBAAoBE,EAAE,MAAM2G,MAAMxG,EAAE,MAAkB,GAAG,OAAfL,EAAEE,EAAE8E,KAAKhF,IAAc,MAAM6G,MAAMxG,EAAE,MAAM,IAAI,IAAIU,EAAEb,EAAE,KAAKC,EAAEJ,EAAEW,EAAEX,EAAE,EAAEY,EAAE,KAAKP,EAAEJ,EAAEyxB,OAAO,OAAOtxB,IAAIC,EAAE41B,KAAKt1B,IAAIN,EAAEJ,EAAEyxB,OAAO,CAACtxB,EAAEs1B,MAAM/0B,GAAGC,EAAER,EAAEA,EAAE,MAAMQ,EAAER,EAAEgT,QAAQ,IAAI3S,EAAED,EAAEf,EAAEW,EAAEC,EAAE0I,MAAM7I,GAAG,GAAG,OAAOO,EAAE,CAAC,OAAOL,IAAIA,EAAEQ,GAAG,KAAK,CAACG,GAAGX,GAAG,OAAOK,EAAEkS,WAAWjT,EAAED,EAAEW,GAAGJ,EAAED,EAAEU,EAAET,EAAEW,GAAG,OAAOK,EAAEb,EAAEM,EAAEO,EAAEoS,QAAQ3S,EAAEO,EAAEP,EAAEL,EAAEQ,CAAC,CAAC,GAAGP,EAAE41B,KAAK,OAAOp2B,EAAEJ,EACzfW,GAAG+uB,IAAGN,GAAGpvB,EAAEkB,GAAGR,EAAE,GAAG,OAAOC,EAAE,CAAC,MAAMC,EAAE41B,KAAKt1B,IAAIN,EAAEJ,EAAEyxB,OAAwB,QAAjBrxB,EAAEE,EAAEd,EAAEY,EAAE0I,MAAM7I,MAAcF,EAAED,EAAEM,EAAEL,EAAEW,GAAG,OAAOK,EAAEb,EAAEE,EAAEW,EAAEoS,QAAQ/S,EAAEW,EAAEX,GAAc,OAAX8uB,IAAGN,GAAGpvB,EAAEkB,GAAUR,CAAC,CAAC,IAAIC,EAAEN,EAAEL,EAAEW,IAAIC,EAAE41B,KAAKt1B,IAAIN,EAAEJ,EAAEyxB,OAA4B,QAArBrxB,EAAEQ,EAAET,EAAEX,EAAEkB,EAAEN,EAAE0I,MAAM7I,MAAca,GAAG,OAAOV,EAAEsS,WAAWvS,EAAEqX,OAAO,OAAOpX,EAAEd,IAAIoB,EAAEN,EAAEd,KAAKS,EAAED,EAAEM,EAAEL,EAAEW,GAAG,OAAOK,EAAEb,EAAEE,EAAEW,EAAEoS,QAAQ/S,EAAEW,EAAEX,GAAuD,OAApDU,GAAGX,EAAEmE,SAAQ,SAASxD,GAAG,OAAOrB,EAAED,EAAEsB,EAAE,IAAGouB,IAAGN,GAAGpvB,EAAEkB,GAAUR,CAAC,CAG3T,OAH4T,SAAS2pB,EAAE/oB,EAAEjB,EAAEC,EAAEE,GAAkF,GAA/E,kBAAkBF,GAAG,OAAOA,GAAGA,EAAE7C,OAAO2I,GAAI,OAAO9F,EAAER,MAAMQ,EAAEA,EAAE80B,MAAMnqB,UAAa,kBAAkB3K,GAAG,OAAOA,EAAE,CAAC,OAAOA,EAAEkB,UAAU,KAAK0E,EAAG5E,EAAE,CAAC,IAAI,IAAIb,EAC7hBH,EAAER,IAAIY,EAAEL,EAAE,OAAOK,GAAG,CAAC,GAAGA,EAAEZ,MAAMW,EAAE,CAAU,IAATA,EAAEH,EAAE7C,QAAY2I,GAAI,GAAG,IAAI1F,EAAEuH,IAAI,CAAC7H,EAAEkB,EAAEZ,EAAEiT,UAAStT,EAAEL,EAAEU,EAAEJ,EAAE80B,MAAMnqB,WAAYkI,OAAO7R,EAAEA,EAAEjB,EAAE,MAAMiB,CAAC,OAAO,GAAGZ,EAAEovB,cAAcrvB,GAAG,kBAAkBA,GAAG,OAAOA,GAAGA,EAAEe,WAAWqF,GAAIkvB,GAAGt1B,KAAKC,EAAEjD,KAAK,CAAC2C,EAAEkB,EAAEZ,EAAEiT,UAAStT,EAAEL,EAAEU,EAAEJ,EAAE80B,QAASM,IAAID,GAAGn0B,EAAEZ,EAAEJ,GAAGD,EAAE8S,OAAO7R,EAAEA,EAAEjB,EAAE,MAAMiB,CAAC,CAAClB,EAAEkB,EAAEZ,GAAG,KAAK,CAAMT,EAAEqB,EAAEZ,GAAGA,EAAEA,EAAEiT,OAAO,CAACrT,EAAE7C,OAAO2I,IAAI/F,EAAEk2B,GAAGj2B,EAAE80B,MAAMnqB,SAAS3J,EAAEgvB,KAAK9vB,EAAEF,EAAER,MAAOqT,OAAO7R,EAAEA,EAAEjB,KAAIG,EAAE41B,GAAG91B,EAAE7C,KAAK6C,EAAER,IAAIQ,EAAE80B,MAAM,KAAK9zB,EAAEgvB,KAAK9vB,IAAKk1B,IAAID,GAAGn0B,EAAEjB,EAAEC,GAAGE,EAAE2S,OAAO7R,EAAEA,EAAEd,EAAE,CAAC,OAAOD,EAAEe,GAAG,KAAK6E,EAAG7E,EAAE,CAAC,IAAIZ,EAAEJ,EAAER,IAAI,OACzfO,GAAG,CAAC,GAAGA,EAAEP,MAAMY,EAAC,CAAC,GAAG,IAAIL,EAAE4H,KAAK5H,EAAEqR,UAAUkH,gBAAgBtY,EAAEsY,eAAevY,EAAEqR,UAAU2kB,iBAAiB/1B,EAAE+1B,eAAe,CAACj2B,EAAEkB,EAAEjB,EAAEsT,UAAStT,EAAEL,EAAEK,EAAEC,EAAE2K,UAAU,KAAMkI,OAAO7R,EAAEA,EAAEjB,EAAE,MAAMiB,CAAC,CAAMlB,EAAEkB,EAAEjB,GAAG,KAAM,CAAKJ,EAAEqB,EAAEjB,GAAGA,EAAEA,EAAEsT,OAAO,EAACtT,EAAEi2B,GAAGh2B,EAAEgB,EAAEgvB,KAAK9vB,IAAK2S,OAAO7R,EAAEA,EAAEjB,CAAC,CAAC,OAAOE,EAAEe,GAAG,KAAKuF,EAAG,OAAiBwjB,EAAE/oB,EAAEjB,GAAdK,EAAEJ,EAAE+H,OAAc/H,EAAE8H,UAAU5H,GAAG,GAAG+J,GAAGjK,GAAG,OAAOM,EAAEU,EAAEjB,EAAEC,EAAEE,GAAG,GAAGyG,EAAG3G,GAAG,OAAOU,EAAEM,EAAEjB,EAAEC,EAAEE,GAAGq1B,GAAGv0B,EAAEhB,EAAE,CAAC,MAAM,kBAAkBA,GAAG,KAAKA,GAAG,kBAAkBA,GAAGA,EAAE,GAAGA,EAAE,OAAOD,GAAG,IAAIA,EAAE4H,KAAK7H,EAAEkB,EAAEjB,EAAEsT,UAAStT,EAAEL,EAAEK,EAAEC,IAAK6S,OAAO7R,EAAEA,EAAEjB,IACnfD,EAAEkB,EAAEjB,IAAGA,EAAE81B,GAAG71B,EAAEgB,EAAEgvB,KAAK9vB,IAAK2S,OAAO7R,EAAEA,EAAEjB,GAAGE,EAAEe,IAAIlB,EAAEkB,EAAEjB,EAAE,CAAS,CAAC,IAAIo2B,GAAGT,IAAG,GAAIU,GAAGV,IAAG,GAAIW,GAAG,CAAC,EAAEC,GAAGxJ,GAAGuJ,IAAIE,GAAGzJ,GAAGuJ,IAAIG,GAAG1J,GAAGuJ,IAAI,SAASI,GAAGz1B,GAAG,GAAGA,IAAIq1B,GAAG,MAAMtvB,MAAMxG,EAAE,MAAM,OAAOS,CAAC,CAAC,SAAS01B,GAAG11B,EAAErB,GAAyC,OAAtCqtB,GAAEwJ,GAAG72B,GAAGqtB,GAAEuJ,GAAGv1B,GAAGgsB,GAAEsJ,GAAGD,IAAIr1B,EAAErB,EAAEoM,UAAmB,KAAK,EAAE,KAAK,GAAGpM,GAAGA,EAAEA,EAAEimB,iBAAiBjmB,EAAEyL,aAAaH,GAAG,KAAK,IAAI,MAAM,QAAkEtL,EAAEsL,GAArCtL,GAAvBqB,EAAE,IAAIA,EAAErB,EAAEmR,WAAWnR,GAAMyL,cAAc,KAAKpK,EAAEA,EAAE21B,SAAkB5J,GAAEuJ,IAAItJ,GAAEsJ,GAAG32B,EAAE,CAAC,SAASi3B,KAAK7J,GAAEuJ,IAAIvJ,GAAEwJ,IAAIxJ,GAAEyJ,GAAG,CACnb,SAASK,GAAG71B,GAAGy1B,GAAGD,GAAGljB,SAAS,IAAI3T,EAAE82B,GAAGH,GAAGhjB,SAAaxT,EAAEmL,GAAGtL,EAAEqB,EAAE7D,MAAMwC,IAAIG,IAAIktB,GAAEuJ,GAAGv1B,GAAGgsB,GAAEsJ,GAAGx2B,GAAG,CAAC,SAASg3B,GAAG91B,GAAGu1B,GAAGjjB,UAAUtS,IAAI+rB,GAAEuJ,IAAIvJ,GAAEwJ,IAAI,CAAC,IAAIQ,GAAEjK,GAAG,GACrJ,SAASkK,GAAGh2B,GAAG,IAAI,IAAIrB,EAAEqB,EAAE,OAAOrB,GAAG,CAAC,GAAG,KAAKA,EAAEgI,IAAI,CAAC,IAAI7H,EAAEH,EAAEqT,cAAc,GAAG,OAAOlT,IAAmB,QAAfA,EAAEA,EAAEmT,aAAqB,OAAOnT,EAAEke,MAAM,OAAOle,EAAEke,MAAM,OAAOre,CAAC,MAAM,GAAG,KAAKA,EAAEgI,UAAK,IAAShI,EAAEywB,cAAc6G,aAAa,GAAG,KAAa,IAARt3B,EAAEmT,OAAW,OAAOnT,OAAO,GAAG,OAAOA,EAAEyT,MAAM,CAACzT,EAAEyT,MAAMP,OAAOlT,EAAEA,EAAEA,EAAEyT,MAAM,QAAQ,CAAC,GAAGzT,IAAIqB,EAAE,MAAM,KAAK,OAAOrB,EAAE0T,SAAS,CAAC,GAAG,OAAO1T,EAAEkT,QAAQlT,EAAEkT,SAAS7R,EAAE,OAAO,KAAKrB,EAAEA,EAAEkT,MAAM,CAAClT,EAAE0T,QAAQR,OAAOlT,EAAEkT,OAAOlT,EAAEA,EAAE0T,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI6jB,GAAG,GACrc,SAASC,KAAK,IAAI,IAAIn2B,EAAE,EAAEA,EAAEk2B,GAAG55B,OAAO0D,IAAIk2B,GAAGl2B,GAAGo2B,8BAA8B,KAAKF,GAAG55B,OAAO,CAAC,CAAC,IAAI+5B,GAAG3xB,EAAG4xB,uBAAuBC,GAAG7xB,EAAGsT,wBAAwBwe,GAAG,EAAEC,GAAE,KAAKC,GAAE,KAAKC,GAAE,KAAKC,IAAG,EAAGC,IAAG,EAAGC,GAAG,EAAEC,GAAG,EAAE,SAASC,KAAI,MAAMjxB,MAAMxG,EAAE,KAAM,CAAC,SAAS03B,GAAGj3B,EAAErB,GAAG,GAAG,OAAOA,EAAE,OAAM,EAAG,IAAI,IAAIG,EAAE,EAAEA,EAAEH,EAAErC,QAAQwC,EAAEkB,EAAE1D,OAAOwC,IAAI,IAAI2kB,GAAGzjB,EAAElB,GAAGH,EAAEG,IAAI,OAAM,EAAG,OAAM,CAAE,CAChW,SAASo4B,GAAGl3B,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,GAAyH,GAAtHw3B,GAAGx3B,EAAEy3B,GAAE93B,EAAEA,EAAEqT,cAAc,KAAKrT,EAAEwyB,YAAY,KAAKxyB,EAAE2xB,MAAM,EAAE+F,GAAG/jB,QAAQ,OAAOtS,GAAG,OAAOA,EAAEgS,cAAcmlB,GAAGC,GAAGp3B,EAAElB,EAAEC,EAAEL,GAAMm4B,GAAG,CAAC73B,EAAE,EAAE,EAAE,CAAY,GAAX63B,IAAG,EAAGC,GAAG,EAAK,IAAI93B,EAAE,MAAM+G,MAAMxG,EAAE,MAAMP,GAAG,EAAE23B,GAAED,GAAE,KAAK/3B,EAAEwyB,YAAY,KAAKkF,GAAG/jB,QAAQ+kB,GAAGr3B,EAAElB,EAAEC,EAAEL,EAAE,OAAOm4B,GAAG,CAA+D,GAA9DR,GAAG/jB,QAAQglB,GAAG34B,EAAE,OAAO+3B,IAAG,OAAOA,GAAE/F,KAAK6F,GAAG,EAAEG,GAAED,GAAED,GAAE,KAAKG,IAAG,EAAMj4B,EAAE,MAAMoH,MAAMxG,EAAE,MAAM,OAAOS,CAAC,CAAC,SAASu3B,KAAK,IAAIv3B,EAAE,IAAI82B,GAAQ,OAALA,GAAG,EAAS92B,CAAC,CAC/Y,SAASw3B,KAAK,IAAIx3B,EAAE,CAACgS,cAAc,KAAKof,UAAU,KAAKqG,UAAU,KAAKC,MAAM,KAAK/G,KAAK,MAA8C,OAAxC,OAAOgG,GAAEF,GAAEzkB,cAAc2kB,GAAE32B,EAAE22B,GAAEA,GAAEhG,KAAK3wB,EAAS22B,EAAC,CAAC,SAASgB,KAAK,GAAG,OAAOjB,GAAE,CAAC,IAAI12B,EAAEy2B,GAAE7kB,UAAU5R,EAAE,OAAOA,EAAEA,EAAEgS,cAAc,IAAI,MAAMhS,EAAE02B,GAAE/F,KAAK,IAAIhyB,EAAE,OAAOg4B,GAAEF,GAAEzkB,cAAc2kB,GAAEhG,KAAK,GAAG,OAAOhyB,EAAEg4B,GAAEh4B,EAAE+3B,GAAE12B,MAAM,CAAC,GAAG,OAAOA,EAAE,MAAM+F,MAAMxG,EAAE,MAAUS,EAAE,CAACgS,eAAP0kB,GAAE12B,GAAqBgS,cAAcof,UAAUsF,GAAEtF,UAAUqG,UAAUf,GAAEe,UAAUC,MAAMhB,GAAEgB,MAAM/G,KAAK,MAAM,OAAOgG,GAAEF,GAAEzkB,cAAc2kB,GAAE32B,EAAE22B,GAAEA,GAAEhG,KAAK3wB,CAAC,CAAC,OAAO22B,EAAC,CACje,SAASiB,GAAG53B,EAAErB,GAAG,MAAM,oBAAoBA,EAAEA,EAAEqB,GAAGrB,CAAC,CACnD,SAASk5B,GAAG73B,GAAG,IAAIrB,EAAEg5B,KAAK74B,EAAEH,EAAE+4B,MAAM,GAAG,OAAO54B,EAAE,MAAMiH,MAAMxG,EAAE,MAAMT,EAAEg5B,oBAAoB93B,EAAE,IAAIjB,EAAE23B,GAAEh4B,EAAEK,EAAE04B,UAAUz4B,EAAEF,EAAE0yB,QAAQ,GAAG,OAAOxyB,EAAE,CAAC,GAAG,OAAON,EAAE,CAAC,IAAIO,EAAEP,EAAEiyB,KAAKjyB,EAAEiyB,KAAK3xB,EAAE2xB,KAAK3xB,EAAE2xB,KAAK1xB,CAAC,CAACF,EAAE04B,UAAU/4B,EAAEM,EAAEF,EAAE0yB,QAAQ,IAAI,CAAC,GAAG,OAAO9yB,EAAE,CAACM,EAAEN,EAAEiyB,KAAK5xB,EAAEA,EAAEqyB,UAAU,IAAIlyB,EAAED,EAAE,KAAKE,EAAE,KAAKC,EAAEJ,EAAE,EAAE,CAAC,IAAIK,EAAED,EAAEyyB,KAAK,IAAI2E,GAAGn3B,KAAKA,EAAE,OAAOF,IAAIA,EAAEA,EAAEwxB,KAAK,CAACkB,KAAK,EAAEkG,OAAO34B,EAAE24B,OAAOC,cAAc54B,EAAE44B,cAAcC,WAAW74B,EAAE64B,WAAWtH,KAAK,OAAO5xB,EAAEK,EAAE44B,cAAc54B,EAAE64B,WAAWj4B,EAAEjB,EAAEK,EAAE24B,YAAY,CAAC,IAAIv4B,EAAE,CAACqyB,KAAKxyB,EAAE04B,OAAO34B,EAAE24B,OAAOC,cAAc54B,EAAE44B,cACngBC,WAAW74B,EAAE64B,WAAWtH,KAAK,MAAM,OAAOxxB,GAAGD,EAAEC,EAAEK,EAAEP,EAAEF,GAAGI,EAAEA,EAAEwxB,KAAKnxB,EAAEi3B,GAAEnG,OAAOjxB,EAAEgzB,IAAIhzB,CAAC,CAACD,EAAEA,EAAEuxB,IAAI,OAAO,OAAOvxB,GAAGA,IAAIJ,GAAG,OAAOG,EAAEF,EAAEF,EAAEI,EAAEwxB,KAAKzxB,EAAEukB,GAAG1kB,EAAEJ,EAAEqT,iBAAiBue,IAAG,GAAI5xB,EAAEqT,cAAcjT,EAAEJ,EAAEyyB,UAAUnyB,EAAEN,EAAE84B,UAAUt4B,EAAEL,EAAEo5B,kBAAkBn5B,CAAC,CAAiB,GAAG,QAAnBiB,EAAElB,EAAEiyB,aAAwB,CAACryB,EAAEsB,EAAE,GAAGhB,EAAEN,EAAEmzB,KAAK4E,GAAEnG,OAAOtxB,EAAEqzB,IAAIrzB,EAAEN,EAAEA,EAAEiyB,WAAWjyB,IAAIsB,EAAE,MAAM,OAAOtB,IAAII,EAAEwxB,MAAM,GAAG,MAAM,CAAC3xB,EAAEqT,cAAclT,EAAEq5B,SAAS,CAC9X,SAASC,GAAGp4B,GAAG,IAAIrB,EAAEg5B,KAAK74B,EAAEH,EAAE+4B,MAAM,GAAG,OAAO54B,EAAE,MAAMiH,MAAMxG,EAAE,MAAMT,EAAEg5B,oBAAoB93B,EAAE,IAAIjB,EAAED,EAAEq5B,SAASz5B,EAAEI,EAAE0yB,QAAQxyB,EAAEL,EAAEqT,cAAc,GAAG,OAAOtT,EAAE,CAACI,EAAE0yB,QAAQ,KAAK,IAAIvyB,EAAEP,EAAEA,EAAEiyB,KAAK,GAAG3xB,EAAEgB,EAAEhB,EAAEC,EAAE84B,QAAQ94B,EAAEA,EAAE0xB,WAAW1xB,IAAIP,GAAG+kB,GAAGzkB,EAAEL,EAAEqT,iBAAiBue,IAAG,GAAI5xB,EAAEqT,cAAchT,EAAE,OAAOL,EAAE84B,YAAY94B,EAAEyyB,UAAUpyB,GAAGF,EAAEo5B,kBAAkBl5B,CAAC,CAAC,MAAM,CAACA,EAAED,EAAE,CAAC,SAASs5B,KAAK,CACpW,SAASC,GAAGt4B,EAAErB,GAAG,IAAIG,EAAE23B,GAAE13B,EAAE44B,KAAKj5B,EAAEC,IAAIK,GAAGykB,GAAG1kB,EAAEiT,cAActT,GAAsE,GAAnEM,IAAID,EAAEiT,cAActT,EAAE6xB,IAAG,GAAIxxB,EAAEA,EAAE24B,MAAMa,GAAGC,GAAG5P,KAAK,KAAK9pB,EAAEC,EAAEiB,GAAG,CAACA,IAAOjB,EAAE05B,cAAc95B,GAAGK,GAAG,OAAO23B,IAAuB,EAApBA,GAAE3kB,cAAcrL,IAAM,CAAuD,GAAtD7H,EAAEgT,OAAO,KAAK4mB,GAAG,EAAEC,GAAG/P,KAAK,KAAK9pB,EAAEC,EAAEL,EAAEC,QAAG,EAAO,MAAS,OAAOi6B,GAAE,MAAM7yB,MAAMxG,EAAE,MAAM,KAAQ,GAAHi3B,KAAQqC,GAAG/5B,EAAEH,EAAED,EAAE,CAAC,OAAOA,CAAC,CAAC,SAASm6B,GAAG74B,EAAErB,EAAEG,GAAGkB,EAAE8R,OAAO,MAAM9R,EAAE,CAACy4B,YAAY95B,EAAEqJ,MAAMlJ,GAAmB,QAAhBH,EAAE83B,GAAEtF,cAAsBxyB,EAAE,CAACm6B,WAAW,KAAKC,OAAO,MAAMtC,GAAEtF,YAAYxyB,EAAEA,EAAEo6B,OAAO,CAAC/4B,IAAgB,QAAXlB,EAAEH,EAAEo6B,QAAgBp6B,EAAEo6B,OAAO,CAAC/4B,GAAGlB,EAAEyR,KAAKvQ,EAAG,CAClf,SAAS24B,GAAG34B,EAAErB,EAAEG,EAAEC,GAAGJ,EAAEqJ,MAAMlJ,EAAEH,EAAE85B,YAAY15B,EAAEi6B,GAAGr6B,IAAIs6B,GAAGj5B,EAAE,CAAC,SAASw4B,GAAGx4B,EAAErB,EAAEG,GAAG,OAAOA,GAAE,WAAWk6B,GAAGr6B,IAAIs6B,GAAGj5B,EAAE,GAAE,CAAC,SAASg5B,GAAGh5B,GAAG,IAAIrB,EAAEqB,EAAEy4B,YAAYz4B,EAAEA,EAAEgI,MAAM,IAAI,IAAIlJ,EAAEH,IAAI,OAAO8kB,GAAGzjB,EAAElB,EAAE,CAAC,MAAMC,GAAG,OAAM,CAAE,CAAC,CAAC,SAASk6B,GAAGj5B,GAAG,IAAIrB,EAAEqyB,GAAGhxB,EAAE,GAAG,OAAOrB,GAAGs0B,GAAGt0B,EAAEqB,EAAE,GAAG,EAAE,CAClQ,SAASk5B,GAAGl5B,GAAG,IAAIrB,EAAE64B,KAA8M,MAAzM,oBAAoBx3B,IAAIA,EAAEA,KAAKrB,EAAEqT,cAAcrT,EAAEyyB,UAAUpxB,EAAEA,EAAE,CAACwxB,QAAQ,KAAKT,YAAY,KAAKT,MAAM,EAAE6H,SAAS,KAAKL,oBAAoBF,GAAGM,kBAAkBl4B,GAAGrB,EAAE+4B,MAAM13B,EAAEA,EAAEA,EAAEm4B,SAASgB,GAAGvQ,KAAK,KAAK6N,GAAEz2B,GAAS,CAACrB,EAAEqT,cAAchS,EAAE,CAC5P,SAAS04B,GAAG14B,EAAErB,EAAEG,EAAEC,GAA8O,OAA3OiB,EAAE,CAAC2G,IAAI3G,EAAEo5B,OAAOz6B,EAAE06B,QAAQv6B,EAAEw6B,KAAKv6B,EAAE4xB,KAAK,MAAsB,QAAhBhyB,EAAE83B,GAAEtF,cAAsBxyB,EAAE,CAACm6B,WAAW,KAAKC,OAAO,MAAMtC,GAAEtF,YAAYxyB,EAAEA,EAAEm6B,WAAW94B,EAAE2wB,KAAK3wB,GAAmB,QAAflB,EAAEH,EAAEm6B,YAAoBn6B,EAAEm6B,WAAW94B,EAAE2wB,KAAK3wB,GAAGjB,EAAED,EAAE6xB,KAAK7xB,EAAE6xB,KAAK3wB,EAAEA,EAAE2wB,KAAK5xB,EAAEJ,EAAEm6B,WAAW94B,GAAWA,CAAC,CAAC,SAASu5B,KAAK,OAAO5B,KAAK3lB,aAAa,CAAC,SAASwnB,GAAGx5B,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAE84B,KAAKf,GAAE3kB,OAAO9R,EAAEtB,EAAEsT,cAAc0mB,GAAG,EAAE/5B,EAAEG,OAAE,OAAO,IAASC,EAAE,KAAKA,EAAE,CAC9Y,SAAS06B,GAAGz5B,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEi5B,KAAK54B,OAAE,IAASA,EAAE,KAAKA,EAAE,IAAIC,OAAE,EAAO,GAAG,OAAO03B,GAAE,CAAC,IAAIz3B,EAAEy3B,GAAE1kB,cAA0B,GAAZhT,EAAEC,EAAEo6B,QAAW,OAAOt6B,GAAGk4B,GAAGl4B,EAAEE,EAAEq6B,MAAmC,YAA5B56B,EAAEsT,cAAc0mB,GAAG/5B,EAAEG,EAAEE,EAAED,GAAU,CAAC03B,GAAE3kB,OAAO9R,EAAEtB,EAAEsT,cAAc0mB,GAAG,EAAE/5B,EAAEG,EAAEE,EAAED,EAAE,CAAC,SAAS26B,GAAG15B,EAAErB,GAAG,OAAO66B,GAAG,QAAQ,EAAEx5B,EAAErB,EAAE,CAAC,SAAS45B,GAAGv4B,EAAErB,GAAG,OAAO86B,GAAG,KAAK,EAAEz5B,EAAErB,EAAE,CAAC,SAASg7B,GAAG35B,EAAErB,GAAG,OAAO86B,GAAG,EAAE,EAAEz5B,EAAErB,EAAE,CAAC,SAASi7B,GAAG55B,EAAErB,GAAG,OAAO86B,GAAG,EAAE,EAAEz5B,EAAErB,EAAE,CAChX,SAASk7B,GAAG75B,EAAErB,GAAG,MAAG,oBAAoBA,GAASqB,EAAEA,IAAIrB,EAAEqB,GAAG,WAAWrB,EAAE,KAAK,GAAK,OAAOA,QAAG,IAASA,GAASqB,EAAEA,IAAIrB,EAAE2T,QAAQtS,EAAE,WAAWrB,EAAE2T,QAAQ,IAAI,QAA1E,CAA2E,CAAC,SAASwnB,GAAG95B,EAAErB,EAAEG,GAA6C,OAA1CA,EAAE,OAAOA,QAAG,IAASA,EAAEA,EAAEV,OAAO,CAAC4B,IAAI,KAAYy5B,GAAG,EAAE,EAAEI,GAAGjR,KAAK,KAAKjqB,EAAEqB,GAAGlB,EAAE,CAAC,SAASi7B,KAAK,CAAC,SAASC,GAAGh6B,EAAErB,GAAG,IAAIG,EAAE64B,KAAKh5B,OAAE,IAASA,EAAE,KAAKA,EAAE,IAAII,EAAED,EAAEkT,cAAc,OAAG,OAAOjT,GAAG,OAAOJ,GAAGs4B,GAAGt4B,EAAEI,EAAE,IAAWA,EAAE,IAAGD,EAAEkT,cAAc,CAAChS,EAAErB,GAAUqB,EAAC,CAC7Z,SAASi6B,GAAGj6B,EAAErB,GAAG,IAAIG,EAAE64B,KAAKh5B,OAAE,IAASA,EAAE,KAAKA,EAAE,IAAII,EAAED,EAAEkT,cAAc,OAAG,OAAOjT,GAAG,OAAOJ,GAAGs4B,GAAGt4B,EAAEI,EAAE,IAAWA,EAAE,IAAGiB,EAAEA,IAAIlB,EAAEkT,cAAc,CAAChS,EAAErB,GAAUqB,EAAC,CAAC,SAASk6B,GAAGl6B,EAAErB,EAAEG,GAAG,OAAG,KAAQ,GAAH03B,KAAcx2B,EAAEoxB,YAAYpxB,EAAEoxB,WAAU,EAAGb,IAAG,GAAIvwB,EAAEgS,cAAclT,IAAE2kB,GAAG3kB,EAAEH,KAAKG,EAAEqW,KAAKshB,GAAEnG,OAAOxxB,EAAEuzB,IAAIvzB,EAAEkB,EAAEoxB,WAAU,GAAWzyB,EAAC,CAAC,SAASw7B,GAAGn6B,EAAErB,GAAG,IAAIG,EAAE0W,GAAEA,GAAE,IAAI1W,GAAG,EAAEA,EAAEA,EAAE,EAAEkB,GAAE,GAAI,IAAIjB,EAAEw3B,GAAGpe,WAAWoe,GAAGpe,WAAW,CAAC,EAAE,IAAInY,GAAE,GAAIrB,GAAG,CAAC,QAAQ6W,GAAE1W,EAAEy3B,GAAGpe,WAAWpZ,CAAC,CAAC,CAAC,SAASq7B,KAAK,OAAOzC,KAAK3lB,aAAa,CAC1d,SAASqoB,GAAGr6B,EAAErB,EAAEG,GAAG,IAAIC,EAAEi0B,GAAGhzB,GAAkE,GAA/DlB,EAAE,CAAC+yB,KAAK9yB,EAAEg5B,OAAOj5B,EAAEk5B,eAAc,EAAGC,WAAW,KAAKtH,KAAK,MAAS2J,GAAGt6B,GAAGu6B,GAAG57B,EAAEG,QAAQ,GAAiB,QAAdA,EAAEgyB,GAAG9wB,EAAErB,EAAEG,EAAEC,IAAY,CAAWk0B,GAAGn0B,EAAEkB,EAAEjB,EAAXg0B,MAAgByH,GAAG17B,EAAEH,EAAEI,EAAE,CAAC,CAC/K,SAASo6B,GAAGn5B,EAAErB,EAAEG,GAAG,IAAIC,EAAEi0B,GAAGhzB,GAAGtB,EAAE,CAACmzB,KAAK9yB,EAAEg5B,OAAOj5B,EAAEk5B,eAAc,EAAGC,WAAW,KAAKtH,KAAK,MAAM,GAAG2J,GAAGt6B,GAAGu6B,GAAG57B,EAAED,OAAO,CAAC,IAAIM,EAAEgB,EAAE4R,UAAU,GAAG,IAAI5R,EAAEswB,QAAQ,OAAOtxB,GAAG,IAAIA,EAAEsxB,QAAiC,QAAxBtxB,EAAEL,EAAEm5B,qBAA8B,IAAI,IAAI74B,EAAEN,EAAEu5B,kBAAkBh5B,EAAEF,EAAEC,EAAEH,GAAqC,GAAlCJ,EAAEs5B,eAAc,EAAGt5B,EAAEu5B,WAAW/4B,EAAKukB,GAAGvkB,EAAED,GAAG,CAAC,IAAIE,EAAER,EAAEoyB,YAA+E,OAAnE,OAAO5xB,GAAGT,EAAEiyB,KAAKjyB,EAAEmyB,GAAGlyB,KAAKD,EAAEiyB,KAAKxxB,EAAEwxB,KAAKxxB,EAAEwxB,KAAKjyB,QAAGC,EAAEoyB,YAAYryB,EAAQ,CAAC,CAAC,MAAMU,GAAG,CAAwB,QAAdN,EAAEgyB,GAAG9wB,EAAErB,EAAED,EAAEK,MAAoBk0B,GAAGn0B,EAAEkB,EAAEjB,EAAbL,EAAEq0B,MAAgByH,GAAG17B,EAAEH,EAAEI,GAAG,CAAC,CAC/c,SAASu7B,GAAGt6B,GAAG,IAAIrB,EAAEqB,EAAE4R,UAAU,OAAO5R,IAAIy2B,IAAG,OAAO93B,GAAGA,IAAI83B,EAAC,CAAC,SAAS8D,GAAGv6B,EAAErB,GAAGk4B,GAAGD,IAAG,EAAG,IAAI93B,EAAEkB,EAAEwxB,QAAQ,OAAO1yB,EAAEH,EAAEgyB,KAAKhyB,GAAGA,EAAEgyB,KAAK7xB,EAAE6xB,KAAK7xB,EAAE6xB,KAAKhyB,GAAGqB,EAAEwxB,QAAQ7yB,CAAC,CAAC,SAAS67B,GAAGx6B,EAAErB,EAAEG,GAAG,GAAG,KAAO,QAAFA,GAAW,CAAC,IAAIC,EAAEJ,EAAE2xB,MAAwBxxB,GAAlBC,GAAGiB,EAAE4U,aAAkBjW,EAAE2xB,MAAMxxB,EAAEyW,GAAGvV,EAAElB,EAAE,CAAC,CAC9P,IAAIw4B,GAAG,CAACmD,YAAYjK,GAAGkK,YAAY1D,GAAE2D,WAAW3D,GAAE4D,UAAU5D,GAAE6D,oBAAoB7D,GAAE8D,mBAAmB9D,GAAE+D,gBAAgB/D,GAAEgE,QAAQhE,GAAEiE,WAAWjE,GAAEkE,OAAOlE,GAAEmE,SAASnE,GAAEoE,cAAcpE,GAAEqE,iBAAiBrE,GAAEsE,cAActE,GAAEuE,iBAAiBvE,GAAEwE,qBAAqBxE,GAAEyE,MAAMzE,GAAE0E,0BAAyB,GAAIvE,GAAG,CAACsD,YAAYjK,GAAGkK,YAAY,SAAS16B,EAAErB,GAA4C,OAAzC64B,KAAKxlB,cAAc,CAAChS,OAAE,IAASrB,EAAE,KAAKA,GAAUqB,CAAC,EAAE26B,WAAWnK,GAAGoK,UAAUlB,GAAGmB,oBAAoB,SAAS76B,EAAErB,EAAEG,GAA6C,OAA1CA,EAAE,OAAOA,QAAG,IAASA,EAAEA,EAAEV,OAAO,CAAC4B,IAAI,KAAYw5B,GAAG,QAC3f,EAAEK,GAAGjR,KAAK,KAAKjqB,EAAEqB,GAAGlB,EAAE,EAAEi8B,gBAAgB,SAAS/6B,EAAErB,GAAG,OAAO66B,GAAG,QAAQ,EAAEx5B,EAAErB,EAAE,EAAEm8B,mBAAmB,SAAS96B,EAAErB,GAAG,OAAO66B,GAAG,EAAE,EAAEx5B,EAAErB,EAAE,EAAEq8B,QAAQ,SAASh7B,EAAErB,GAAG,IAAIG,EAAE04B,KAAqD,OAAhD74B,OAAE,IAASA,EAAE,KAAKA,EAAEqB,EAAEA,IAAIlB,EAAEkT,cAAc,CAAChS,EAAErB,GAAUqB,CAAC,EAAEi7B,WAAW,SAASj7B,EAAErB,EAAEG,GAAG,IAAIC,EAAEy4B,KAAkM,OAA7L74B,OAAE,IAASG,EAAEA,EAAEH,GAAGA,EAAEI,EAAEiT,cAAcjT,EAAEqyB,UAAUzyB,EAAEqB,EAAE,CAACwxB,QAAQ,KAAKT,YAAY,KAAKT,MAAM,EAAE6H,SAAS,KAAKL,oBAAoB93B,EAAEk4B,kBAAkBv5B,GAAGI,EAAE24B,MAAM13B,EAAEA,EAAEA,EAAEm4B,SAASkC,GAAGzR,KAAK,KAAK6N,GAAEz2B,GAAS,CAACjB,EAAEiT,cAAchS,EAAE,EAAEk7B,OAAO,SAASl7B,GAC3d,OAAdA,EAAE,CAACsS,QAAQtS,GAAhBw3B,KAA4BxlB,cAAchS,CAAC,EAAEm7B,SAASjC,GAAGkC,cAAcrB,GAAGsB,iBAAiB,SAASr7B,GAAG,OAAOw3B,KAAKxlB,cAAchS,CAAC,EAAEs7B,cAAc,WAAW,IAAIt7B,EAAEk5B,IAAG,GAAIv6B,EAAEqB,EAAE,GAA6C,OAA1CA,EAAEm6B,GAAGvR,KAAK,KAAK5oB,EAAE,IAAIw3B,KAAKxlB,cAAchS,EAAQ,CAACrB,EAAEqB,EAAE,EAAEu7B,iBAAiB,WAAW,EAAEC,qBAAqB,SAASx7B,EAAErB,EAAEG,GAAG,IAAIC,EAAE03B,GAAE/3B,EAAE84B,KAAK,GAAGpJ,GAAE,CAAC,QAAG,IAAStvB,EAAE,MAAMiH,MAAMxG,EAAE,MAAMT,EAAEA,GAAG,KAAK,CAAO,GAANA,EAAEH,IAAO,OAAOi6B,GAAE,MAAM7yB,MAAMxG,EAAE,MAAM,KAAQ,GAAHi3B,KAAQqC,GAAG95B,EAAEJ,EAAEG,EAAE,CAACJ,EAAEsT,cAAclT,EAAE,IAAIE,EAAE,CAACgJ,MAAMlJ,EAAE25B,YAAY95B,GACvZ,OAD0ZD,EAAEg5B,MAAM14B,EAAE06B,GAAGlB,GAAG5P,KAAK,KAAK7pB,EACpfC,EAAEgB,GAAG,CAACA,IAAIjB,EAAE+S,OAAO,KAAK4mB,GAAG,EAAEC,GAAG/P,KAAK,KAAK7pB,EAAEC,EAAEF,EAAEH,QAAG,EAAO,MAAaG,CAAC,EAAE28B,MAAM,WAAW,IAAIz7B,EAAEw3B,KAAK74B,EAAEi6B,GAAE+C,iBAAiB,GAAGvN,GAAE,CAAC,IAAItvB,EAAE+uB,GAAkDlvB,EAAE,IAAIA,EAAE,KAA9CG,GAAH8uB,KAAU,GAAG,GAAG3Z,GAAhB2Z,IAAsB,IAAIrjB,SAAS,IAAIzL,GAAuB,GAAPA,EAAEg4B,QAAWn4B,GAAG,IAAIG,EAAEyL,SAAS,KAAK5L,GAAG,GAAG,MAAaA,EAAE,IAAIA,EAAE,KAAfG,EAAEi4B,MAAmBxsB,SAAS,IAAI,IAAI,OAAOvK,EAAEgS,cAAcrT,CAAC,EAAE+8B,0BAAyB,GAAItE,GAAG,CAACqD,YAAYjK,GAAGkK,YAAYV,GAAGW,WAAWnK,GAAGoK,UAAUrC,GAAGsC,oBAAoBf,GAAGgB,mBAAmBnB,GAAGoB,gBAAgBnB,GAAGoB,QAAQf,GAAGgB,WAAWpD,GAAGqD,OAAO3B,GAAG4B,SAAS,WAAW,OAAOtD,GAAGD,GAAG,EACrhBwD,cAAcrB,GAAGsB,iBAAiB,SAASr7B,GAAc,OAAOk6B,GAAZvC,KAAiBjB,GAAE1kB,cAAchS,EAAE,EAAEs7B,cAAc,WAAgD,MAAM,CAArCzD,GAAGD,IAAI,GAAKD,KAAK3lB,cAAyB,EAAEupB,iBAAiBlD,GAAGmD,qBAAqBlD,GAAGmD,MAAMrB,GAAGsB,0BAAyB,GAAIrE,GAAG,CAACoD,YAAYjK,GAAGkK,YAAYV,GAAGW,WAAWnK,GAAGoK,UAAUrC,GAAGsC,oBAAoBf,GAAGgB,mBAAmBnB,GAAGoB,gBAAgBnB,GAAGoB,QAAQf,GAAGgB,WAAW7C,GAAG8C,OAAO3B,GAAG4B,SAAS,WAAW,OAAO/C,GAAGR,GAAG,EAAEwD,cAAcrB,GAAGsB,iBAAiB,SAASr7B,GAAG,IAAIrB,EAAEg5B,KAAK,OAAO,OACzfjB,GAAE/3B,EAAEqT,cAAchS,EAAEk6B,GAAGv7B,EAAE+3B,GAAE1kB,cAAchS,EAAE,EAAEs7B,cAAc,WAAgD,MAAM,CAArClD,GAAGR,IAAI,GAAKD,KAAK3lB,cAAyB,EAAEupB,iBAAiBlD,GAAGmD,qBAAqBlD,GAAGmD,MAAMrB,GAAGsB,0BAAyB,GAAI,SAASE,GAAG57B,EAAErB,GAAG,IAAI,IAAIG,EAAE,GAAGC,EAAEJ,EAAE,GAAGG,GAAG4H,EAAG3H,GAAGA,EAAEA,EAAE8S,aAAa9S,GAAG,IAAIL,EAAEI,CAAC,CAAC,MAAME,GAAGN,EAAE,6BAA6BM,EAAE68B,QAAQ,KAAK78B,EAAEgH,KAAK,CAAC,MAAM,CAACgC,MAAMhI,EAAEmP,OAAOxQ,EAAEqH,MAAMtH,EAAEo9B,OAAO,KAAK,CAAC,SAASC,GAAG/7B,EAAErB,EAAEG,GAAG,MAAM,CAACkJ,MAAMhI,EAAEmP,OAAO,KAAKnJ,MAAM,MAAMlH,EAAEA,EAAE,KAAKg9B,OAAO,MAAMn9B,EAAEA,EAAE,KAAK,CACzd,SAASq9B,GAAGh8B,EAAErB,GAAG,IAAIs9B,QAAQC,MAAMv9B,EAAEqJ,MAAM,CAAC,MAAMlJ,GAAG0rB,YAAW,WAAW,MAAM1rB,CAAE,GAAE,CAAC,CAAC,IAAIq9B,GAAG,oBAAoBC,QAAQA,QAAQ/lB,IAAI,SAASgmB,GAAGr8B,EAAErB,EAAEG,IAAGA,EAAE6yB,IAAI,EAAE7yB,IAAK6H,IAAI,EAAE7H,EAAEgzB,QAAQ,CAAC/L,QAAQ,MAAM,IAAIhnB,EAAEJ,EAAEqJ,MAAsD,OAAhDlJ,EAAEizB,SAAS,WAAWuK,KAAKA,IAAG,EAAGC,GAAGx9B,GAAGi9B,GAAGh8B,EAAErB,EAAE,EAASG,CAAC,CAC3Q,SAAS09B,GAAGx8B,EAAErB,EAAEG,IAAGA,EAAE6yB,IAAI,EAAE7yB,IAAK6H,IAAI,EAAE,IAAI5H,EAAEiB,EAAE7D,KAAKJ,yBAAyB,GAAG,oBAAoBgD,EAAE,CAAC,IAAIL,EAAEC,EAAEqJ,MAAMlJ,EAAEgzB,QAAQ,WAAW,OAAO/yB,EAAEL,EAAE,EAAEI,EAAEizB,SAAS,WAAWiK,GAAGh8B,EAAErB,EAAE,CAAC,CAAC,IAAIK,EAAEgB,EAAEoQ,UAA8O,OAApO,OAAOpR,GAAG,oBAAoBA,EAAEy9B,oBAAoB39B,EAAEizB,SAAS,WAAWiK,GAAGh8B,EAAErB,GAAG,oBAAoBI,IAAI,OAAO29B,GAAGA,GAAG,IAAIz6B,IAAI,CAACc,OAAO25B,GAAGr6B,IAAIU,OAAO,IAAIjE,EAAEH,EAAEqH,MAAMjD,KAAK05B,kBAAkB99B,EAAEqJ,MAAM,CAAC20B,eAAe,OAAO79B,EAAEA,EAAE,IAAI,GAAUA,CAAC,CACnb,SAAS89B,GAAG58B,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAE68B,UAAU,GAAG,OAAO99B,EAAE,CAACA,EAAEiB,EAAE68B,UAAU,IAAIV,GAAG,IAAIz9B,EAAE,IAAIuD,IAAIlD,EAAEuH,IAAI3H,EAAED,EAAE,WAAiB,KAAXA,EAAEK,EAAEwI,IAAI5I,MAAgBD,EAAE,IAAIuD,IAAIlD,EAAEuH,IAAI3H,EAAED,IAAIA,EAAE4pB,IAAIxpB,KAAKJ,EAAE2D,IAAIvD,GAAGkB,EAAE88B,GAAGlU,KAAK,KAAK5oB,EAAErB,EAAEG,GAAGH,EAAEqsB,KAAKhrB,EAAEA,GAAG,CAAC,SAAS+8B,GAAG/8B,GAAG,EAAE,CAAC,IAAIrB,EAA4E,IAAvEA,EAAE,KAAKqB,EAAE2G,OAAsBhI,EAAE,QAApBA,EAAEqB,EAAEgS,gBAAyB,OAAOrT,EAAEsT,YAAuBtT,EAAE,OAAOqB,EAAEA,EAAEA,EAAE6R,MAAM,OAAO,OAAO7R,GAAG,OAAO,IAAI,CAChW,SAASg9B,GAAGh9B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,OAAG,KAAY,EAAPsB,EAAEgvB,OAAehvB,IAAIrB,EAAEqB,EAAE8R,OAAO,OAAO9R,EAAE8R,OAAO,IAAIhT,EAAEgT,OAAO,OAAOhT,EAAEgT,QAAQ,MAAM,IAAIhT,EAAE6H,MAAM,OAAO7H,EAAE8S,UAAU9S,EAAE6H,IAAI,KAAIhI,EAAEgzB,IAAI,EAAE,IAAKhrB,IAAI,EAAEqrB,GAAGlzB,EAAEH,EAAE,KAAKG,EAAEwxB,OAAO,GAAGtwB,IAAEA,EAAE8R,OAAO,MAAM9R,EAAEswB,MAAM5xB,EAASsB,EAAC,CAAC,IAAIi9B,GAAGv4B,EAAGw4B,kBAAkB3M,IAAG,EAAG,SAAS4M,GAAGn9B,EAAErB,EAAEG,EAAEC,GAAGJ,EAAEyT,MAAM,OAAOpS,EAAEo1B,GAAGz2B,EAAE,KAAKG,EAAEC,GAAGo2B,GAAGx2B,EAAEqB,EAAEoS,MAAMtT,EAAEC,EAAE,CACnV,SAASq+B,GAAGp9B,EAAErB,EAAEG,EAAEC,EAAEL,GAAGI,EAAEA,EAAE3B,OAAO,IAAI6B,EAAEL,EAAEy1B,IAAqC,OAAjCjE,GAAGxxB,EAAED,GAAGK,EAAEm4B,GAAGl3B,EAAErB,EAAEG,EAAEC,EAAEC,EAAEN,GAAGI,EAAEy4B,KAAQ,OAAOv3B,GAAIuwB,IAA2EnC,IAAGtvB,GAAGkvB,GAAGrvB,GAAGA,EAAEmT,OAAO,EAAEqrB,GAAGn9B,EAAErB,EAAEI,EAAEL,GAAUC,EAAEyT,QAA7GzT,EAAEwyB,YAAYnxB,EAAEmxB,YAAYxyB,EAAEmT,QAAQ,KAAK9R,EAAEswB,QAAQ5xB,EAAE2+B,GAAGr9B,EAAErB,EAAED,GAAoD,CACzN,SAAS4+B,GAAGt9B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,GAAG,OAAOsB,EAAE,CAAC,IAAIhB,EAAEF,EAAE3C,KAAK,MAAG,oBAAoB6C,GAAIu+B,GAAGv+B,SAAI,IAASA,EAAEpD,cAAc,OAAOkD,EAAEjC,cAAS,IAASiC,EAAElD,eAAoDoE,EAAE80B,GAAGh2B,EAAE3C,KAAK,KAAK4C,EAAEJ,EAAEA,EAAEqwB,KAAKtwB,IAAK01B,IAAIz1B,EAAEy1B,IAAIp0B,EAAE6R,OAAOlT,EAASA,EAAEyT,MAAMpS,IAArGrB,EAAEgI,IAAI,GAAGhI,EAAExC,KAAK6C,EAAEw+B,GAAGx9B,EAAErB,EAAEK,EAAED,EAAEL,GAAyE,CAAW,GAAVM,EAAEgB,EAAEoS,MAAS,KAAKpS,EAAEswB,MAAM5xB,GAAG,CAAC,IAAIO,EAAED,EAAEowB,cAA0C,IAAhBtwB,EAAE,QAAdA,EAAEA,EAAEjC,SAAmBiC,EAAE4kB,IAAQzkB,EAAEF,IAAIiB,EAAEo0B,MAAMz1B,EAAEy1B,IAAI,OAAOiJ,GAAGr9B,EAAErB,EAAED,EAAE,CAA6C,OAA5CC,EAAEmT,OAAO,GAAE9R,EAAE40B,GAAG51B,EAAED,IAAKq1B,IAAIz1B,EAAEy1B,IAAIp0B,EAAE6R,OAAOlT,EAASA,EAAEyT,MAAMpS,CAAC,CAC1b,SAASw9B,GAAGx9B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,GAAG,OAAOsB,EAAE,CAAC,IAAIhB,EAAEgB,EAAEovB,cAAc,GAAG1L,GAAG1kB,EAAED,IAAIiB,EAAEo0B,MAAMz1B,EAAEy1B,IAAI,IAAG7D,IAAG,EAAG5xB,EAAEgwB,aAAa5vB,EAAEC,EAAE,KAAKgB,EAAEswB,MAAM5xB,GAAsC,OAAOC,EAAE2xB,MAAMtwB,EAAEswB,MAAM+M,GAAGr9B,EAAErB,EAAED,GAAjE,KAAa,OAARsB,EAAE8R,SAAgBye,IAAG,EAAyC,EAAC,OAAOkN,GAAGz9B,EAAErB,EAAEG,EAAEC,EAAEL,EAAE,CACxN,SAASg/B,GAAG19B,EAAErB,EAAEG,GAAG,IAAIC,EAAEJ,EAAEgwB,aAAajwB,EAAEK,EAAE4K,SAAS3K,EAAE,OAAOgB,EAAEA,EAAEgS,cAAc,KAAK,GAAG,WAAWjT,EAAEiwB,KAAK,GAAG,KAAY,EAAPrwB,EAAEqwB,MAAQrwB,EAAEqT,cAAc,CAAC2rB,UAAU,EAAEC,UAAU,KAAKC,YAAY,MAAM7R,GAAE8R,GAAGC,IAAIA,IAAIj/B,MAAM,CAAC,GAAG,KAAO,WAAFA,GAAc,OAAOkB,EAAE,OAAOhB,EAAEA,EAAE2+B,UAAU7+B,EAAEA,EAAEH,EAAE2xB,MAAM3xB,EAAEuxB,WAAW,WAAWvxB,EAAEqT,cAAc,CAAC2rB,UAAU39B,EAAE49B,UAAU,KAAKC,YAAY,MAAMl/B,EAAEwyB,YAAY,KAAKnF,GAAE8R,GAAGC,IAAIA,IAAI/9B,EAAE,KAAKrB,EAAEqT,cAAc,CAAC2rB,UAAU,EAAEC,UAAU,KAAKC,YAAY,MAAM9+B,EAAE,OAAOC,EAAEA,EAAE2+B,UAAU7+B,EAAEktB,GAAE8R,GAAGC,IAAIA,IAAIh/B,CAAC,MAAM,OACtfC,GAAGD,EAAEC,EAAE2+B,UAAU7+B,EAAEH,EAAEqT,cAAc,MAAMjT,EAAED,EAAEktB,GAAE8R,GAAGC,IAAIA,IAAIh/B,EAAc,OAAZo+B,GAAGn9B,EAAErB,EAAED,EAAEI,GAAUH,EAAEyT,KAAK,CAAC,SAAS4rB,GAAGh+B,EAAErB,GAAG,IAAIG,EAAEH,EAAEy1B,KAAO,OAAOp0B,GAAG,OAAOlB,GAAG,OAAOkB,GAAGA,EAAEo0B,MAAMt1B,KAAEH,EAAEmT,OAAO,IAAInT,EAAEmT,OAAO,QAAO,CAAC,SAAS2rB,GAAGz9B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,IAAIM,EAAEwtB,GAAG1tB,GAAGstB,GAAGF,GAAE5Z,QAAmD,OAA3CtT,EAAEqtB,GAAG1tB,EAAEK,GAAGmxB,GAAGxxB,EAAED,GAAGI,EAAEo4B,GAAGl3B,EAAErB,EAAEG,EAAEC,EAAEC,EAAEN,GAAGK,EAAEw4B,KAAQ,OAAOv3B,GAAIuwB,IAA2EnC,IAAGrvB,GAAGivB,GAAGrvB,GAAGA,EAAEmT,OAAO,EAAEqrB,GAAGn9B,EAAErB,EAAEG,EAAEJ,GAAUC,EAAEyT,QAA7GzT,EAAEwyB,YAAYnxB,EAAEmxB,YAAYxyB,EAAEmT,QAAQ,KAAK9R,EAAEswB,QAAQ5xB,EAAE2+B,GAAGr9B,EAAErB,EAAED,GAAoD,CACla,SAASu/B,GAAGj+B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,GAAG8tB,GAAG1tB,GAAG,CAAC,IAAIE,GAAE,EAAG6tB,GAAGluB,EAAE,MAAMK,GAAE,EAAW,GAARmxB,GAAGxxB,EAAED,GAAM,OAAOC,EAAEyR,UAAU8tB,GAAGl+B,EAAErB,GAAG40B,GAAG50B,EAAEG,EAAEC,GAAG80B,GAAGl1B,EAAEG,EAAEC,EAAEL,GAAGK,GAAE,OAAQ,GAAG,OAAOiB,EAAE,CAAC,IAAIf,EAAEN,EAAEyR,UAAUlR,EAAEP,EAAEywB,cAAcnwB,EAAE60B,MAAM50B,EAAE,IAAIC,EAAEF,EAAEwxB,QAAQrxB,EAAEN,EAAEpD,YAAY,kBAAkB0D,GAAG,OAAOA,EAAEA,EAAEoxB,GAAGpxB,GAAyBA,EAAEitB,GAAG1tB,EAA1BS,EAAEotB,GAAG1tB,GAAGstB,GAAGF,GAAE5Z,SAAmB,IAAIjT,EAAEP,EAAE9C,yBAAyBwD,EAAE,oBAAoBH,GAAG,oBAAoBJ,EAAE80B,wBAAwBv0B,GAAG,oBAAoBP,EAAE20B,kCAAkC,oBAAoB30B,EAAE00B,4BAC1dz0B,IAAIH,GAAGI,IAAIC,IAAIs0B,GAAG/0B,EAAEM,EAAEF,EAAEK,GAAG6xB,IAAG,EAAG,IAAIxxB,EAAEd,EAAEqT,cAAc/S,EAAEu0B,MAAM/zB,EAAE2yB,GAAGzzB,EAAEI,EAAEE,EAAEP,GAAGS,EAAER,EAAEqT,cAAc9S,IAAIH,GAAGU,IAAIN,GAAGgtB,GAAG7Z,SAAS2e,IAAI,oBAAoB5xB,IAAIqzB,GAAG/zB,EAAEG,EAAEO,EAAEN,GAAGI,EAAER,EAAEqT,gBAAgB9S,EAAE+xB,IAAImC,GAAGz0B,EAAEG,EAAEI,EAAEH,EAAEU,EAAEN,EAAEC,KAAKI,GAAG,oBAAoBP,EAAE+0B,2BAA2B,oBAAoB/0B,EAAEg1B,qBAAqB,oBAAoBh1B,EAAEg1B,oBAAoBh1B,EAAEg1B,qBAAqB,oBAAoBh1B,EAAE+0B,2BAA2B/0B,EAAE+0B,6BAA6B,oBAAoB/0B,EAAEi1B,oBAAoBv1B,EAAEmT,OAAO,WAClf,oBAAoB7S,EAAEi1B,oBAAoBv1B,EAAEmT,OAAO,SAASnT,EAAEywB,cAAcrwB,EAAEJ,EAAEqT,cAAc7S,GAAGF,EAAE60B,MAAM/0B,EAAEE,EAAEu0B,MAAMr0B,EAAEF,EAAEwxB,QAAQrxB,EAAEL,EAAEG,IAAI,oBAAoBD,EAAEi1B,oBAAoBv1B,EAAEmT,OAAO,SAAS/S,GAAE,EAAG,KAAK,CAACE,EAAEN,EAAEyR,UAAUshB,GAAG1xB,EAAErB,GAAGO,EAAEP,EAAEywB,cAAchwB,EAAET,EAAExC,OAAOwC,EAAE6vB,YAAYtvB,EAAEuwB,GAAG9wB,EAAExC,KAAK+C,GAAGD,EAAE60B,MAAM10B,EAAEI,EAAEb,EAAEgwB,aAAalvB,EAAER,EAAEwxB,QAAwB,kBAAhBtxB,EAAEL,EAAEpD,cAAiC,OAAOyD,EAAEA,EAAEqxB,GAAGrxB,GAAyBA,EAAEktB,GAAG1tB,EAA1BQ,EAAEqtB,GAAG1tB,GAAGstB,GAAGF,GAAE5Z,SAAmB,IAAIxS,EAAEhB,EAAE9C,0BAA0BqD,EAAE,oBAAoBS,GAAG,oBAAoBb,EAAE80B,0BAC9e,oBAAoB90B,EAAE20B,kCAAkC,oBAAoB30B,EAAE00B,4BAA4Bz0B,IAAIM,GAAGC,IAAIN,IAAIu0B,GAAG/0B,EAAEM,EAAEF,EAAEI,GAAG8xB,IAAG,EAAGxxB,EAAEd,EAAEqT,cAAc/S,EAAEu0B,MAAM/zB,EAAE2yB,GAAGzzB,EAAEI,EAAEE,EAAEP,GAAG,IAAIY,EAAEX,EAAEqT,cAAc9S,IAAIM,GAAGC,IAAIH,GAAG6sB,GAAG7Z,SAAS2e,IAAI,oBAAoBnxB,IAAI4yB,GAAG/zB,EAAEG,EAAEgB,EAAEf,GAAGO,EAAEX,EAAEqT,gBAAgB5S,EAAE6xB,IAAImC,GAAGz0B,EAAEG,EAAEM,EAAEL,EAAEU,EAAEH,EAAEH,KAAI,IAAKE,GAAG,oBAAoBJ,EAAEk/B,4BAA4B,oBAAoBl/B,EAAEm/B,sBAAsB,oBAAoBn/B,EAAEm/B,qBAAqBn/B,EAAEm/B,oBAAoBr/B,EAAEO,EAAEH,GAAG,oBAAoBF,EAAEk/B,4BAC5fl/B,EAAEk/B,2BAA2Bp/B,EAAEO,EAAEH,IAAI,oBAAoBF,EAAEo/B,qBAAqB1/B,EAAEmT,OAAO,GAAG,oBAAoB7S,EAAE80B,0BAA0Bp1B,EAAEmT,OAAO,QAAQ,oBAAoB7S,EAAEo/B,oBAAoBn/B,IAAIc,EAAEovB,eAAe3vB,IAAIO,EAAEgS,gBAAgBrT,EAAEmT,OAAO,GAAG,oBAAoB7S,EAAE80B,yBAAyB70B,IAAIc,EAAEovB,eAAe3vB,IAAIO,EAAEgS,gBAAgBrT,EAAEmT,OAAO,MAAMnT,EAAEywB,cAAcrwB,EAAEJ,EAAEqT,cAAc1S,GAAGL,EAAE60B,MAAM/0B,EAAEE,EAAEu0B,MAAMl0B,EAAEL,EAAEwxB,QAAQtxB,EAAEJ,EAAEK,IAAI,oBAAoBH,EAAEo/B,oBAAoBn/B,IAAIc,EAAEovB,eAAe3vB,IACjfO,EAAEgS,gBAAgBrT,EAAEmT,OAAO,GAAG,oBAAoB7S,EAAE80B,yBAAyB70B,IAAIc,EAAEovB,eAAe3vB,IAAIO,EAAEgS,gBAAgBrT,EAAEmT,OAAO,MAAM/S,GAAE,EAAG,CAAC,OAAOu/B,GAAGt+B,EAAErB,EAAEG,EAAEC,EAAEC,EAAEN,EAAE,CACnK,SAAS4/B,GAAGt+B,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,GAAGg/B,GAAGh+B,EAAErB,GAAG,IAAIM,EAAE,KAAa,IAARN,EAAEmT,OAAW,IAAI/S,IAAIE,EAAE,OAAOP,GAAGquB,GAAGpuB,EAAEG,GAAE,GAAIu+B,GAAGr9B,EAAErB,EAAEK,GAAGD,EAAEJ,EAAEyR,UAAU6sB,GAAG3qB,QAAQ3T,EAAE,IAAIO,EAAED,GAAG,oBAAoBH,EAAE/C,yBAAyB,KAAKgD,EAAE5B,SAAwI,OAA/HwB,EAAEmT,OAAO,EAAE,OAAO9R,GAAGf,GAAGN,EAAEyT,MAAM+iB,GAAGx2B,EAAEqB,EAAEoS,MAAM,KAAKpT,GAAGL,EAAEyT,MAAM+iB,GAAGx2B,EAAE,KAAKO,EAAEF,IAAIm+B,GAAGn9B,EAAErB,EAAEO,EAAEF,GAAGL,EAAEqT,cAAcjT,EAAEy0B,MAAM90B,GAAGquB,GAAGpuB,EAAEG,GAAE,GAAWH,EAAEyT,KAAK,CAAC,SAASmsB,GAAGv+B,GAAG,IAAIrB,EAAEqB,EAAEoQ,UAAUzR,EAAE6/B,eAAe9R,GAAG1sB,EAAErB,EAAE6/B,eAAe7/B,EAAE6/B,iBAAiB7/B,EAAE8xB,SAAS9xB,EAAE8xB,SAAS/D,GAAG1sB,EAAErB,EAAE8xB,SAAQ,GAAIiF,GAAG11B,EAAErB,EAAE2Y,cAAc,CAC5e,SAASmnB,GAAGz+B,EAAErB,EAAEG,EAAEC,EAAEL,GAAuC,OAApC4wB,KAAKC,GAAG7wB,GAAGC,EAAEmT,OAAO,IAAIqrB,GAAGn9B,EAAErB,EAAEG,EAAEC,GAAUJ,EAAEyT,KAAK,CAAC,IAaqLssB,GAAGC,GAAGC,GAAGC,GAb1LC,GAAG,CAAC7sB,WAAW,KAAK4c,YAAY,KAAKC,UAAU,GAAG,SAASiQ,GAAG/+B,GAAG,MAAM,CAAC29B,UAAU39B,EAAE49B,UAAU,KAAKC,YAAY,KAAK,CAClM,SAASmB,GAAGh/B,EAAErB,EAAEG,GAAG,IAA0DI,EAAtDH,EAAEJ,EAAEgwB,aAAajwB,EAAEq3B,GAAEzjB,QAAQtT,GAAE,EAAGC,EAAE,KAAa,IAARN,EAAEmT,OAAqJ,IAAvI5S,EAAED,KAAKC,GAAE,OAAOc,GAAG,OAAOA,EAAEgS,gBAAiB,KAAO,EAAFtT,IAASQ,GAAEF,GAAE,EAAGL,EAAEmT,QAAQ,KAAY,OAAO9R,GAAG,OAAOA,EAAEgS,gBAActT,GAAG,GAAEstB,GAAE+J,GAAI,EAAFr3B,GAAQ,OAAOsB,EAA2B,OAAxBivB,GAAGtwB,GAAwB,QAArBqB,EAAErB,EAAEqT,gBAA2C,QAAfhS,EAAEA,EAAEiS,aAA4B,KAAY,EAAPtT,EAAEqwB,MAAQrwB,EAAE2xB,MAAM,EAAE,OAAOtwB,EAAEgd,KAAKre,EAAE2xB,MAAM,EAAE3xB,EAAE2xB,MAAM,WAAW,OAAKrxB,EAAEF,EAAE4K,SAAS3J,EAAEjB,EAAEkgC,SAAgBjgC,GAAGD,EAAEJ,EAAEqwB,KAAKhwB,EAAEL,EAAEyT,MAAMnT,EAAE,CAAC+vB,KAAK,SAASrlB,SAAS1K,GAAG,KAAO,EAAFF,IAAM,OAAOC,GAAGA,EAAEkxB,WAAW,EAAElxB,EAAE2vB,aAC7e1vB,GAAGD,EAAEkgC,GAAGjgC,EAAEF,EAAE,EAAE,MAAMiB,EAAEi1B,GAAGj1B,EAAEjB,EAAED,EAAE,MAAME,EAAE6S,OAAOlT,EAAEqB,EAAE6R,OAAOlT,EAAEK,EAAEqT,QAAQrS,EAAErB,EAAEyT,MAAMpT,EAAEL,EAAEyT,MAAMJ,cAAc+sB,GAAGjgC,GAAGH,EAAEqT,cAAc8sB,GAAG9+B,GAAGm/B,GAAGxgC,EAAEM,IAAqB,GAAG,QAArBP,EAAEsB,EAAEgS,gBAA2C,QAAf9S,EAAER,EAAEuT,YAAqB,OAGpM,SAAYjS,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,GAAG,GAAGH,EAAG,OAAW,IAARH,EAAEmT,OAAiBnT,EAAEmT,QAAQ,IAAwBstB,GAAGp/B,EAAErB,EAAEM,EAA3BF,EAAEg9B,GAAGh2B,MAAMxG,EAAE,SAAsB,OAAOZ,EAAEqT,eAAqBrT,EAAEyT,MAAMpS,EAAEoS,MAAMzT,EAAEmT,OAAO,IAAI,OAAK9S,EAAED,EAAEkgC,SAASvgC,EAAEC,EAAEqwB,KAAKjwB,EAAEmgC,GAAG,CAAClQ,KAAK,UAAUrlB,SAAS5K,EAAE4K,UAAUjL,EAAE,EAAE,OAAMM,EAAEi2B,GAAGj2B,EAAEN,EAAEO,EAAE,OAAQ6S,OAAO,EAAE/S,EAAE8S,OAAOlT,EAAEK,EAAE6S,OAAOlT,EAAEI,EAAEsT,QAAQrT,EAAEL,EAAEyT,MAAMrT,EAAE,KAAY,EAAPJ,EAAEqwB,OAASmG,GAAGx2B,EAAEqB,EAAEoS,MAAM,KAAKnT,GAAGN,EAAEyT,MAAMJ,cAAc+sB,GAAG9/B,GAAGN,EAAEqT,cAAc8sB,GAAU9/B,GAAE,GAAG,KAAY,EAAPL,EAAEqwB,MAAQ,OAAOoQ,GAAGp/B,EAAErB,EAAEM,EAAE,MAAM,GAAG,OAAOP,EAAEse,KAAK,CAChd,GADidje,EAAEL,EAAEqlB,aAAarlB,EAAEqlB,YAAYsb,QAC3e,IAAIngC,EAAEH,EAAEugC,KAA0C,OAArCvgC,EAAEG,EAA0CkgC,GAAGp/B,EAAErB,EAAEM,EAA/BF,EAAEg9B,GAAlB/8B,EAAE+G,MAAMxG,EAAE,MAAaR,OAAE,GAA0B,CAAwB,GAAvBG,EAAE,KAAKD,EAAEe,EAAEkwB,YAAeK,IAAIrxB,EAAE,CAAK,GAAG,QAAPH,EAAE65B,IAAc,CAAC,OAAO35B,GAAGA,GAAG,KAAK,EAAEP,EAAE,EAAE,MAAM,KAAK,GAAGA,EAAE,EAAE,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,SAASA,EAAE,GAAG,MAAM,KAAK,UAAUA,EAAE,UAAU,MAAM,QAAQA,EAAE,EAChd,KADkdA,EAAE,KAAKA,GAAGK,EAAE8V,eAAe5V,IAAI,EAAEP,IAC5eA,IAAIM,EAAE8vB,YAAY9vB,EAAE8vB,UAAUpwB,EAAEsyB,GAAGhxB,EAAEtB,GAAGu0B,GAAGl0B,EAAEiB,EAAEtB,GAAG,GAAG,CAA0B,OAAzB6gC,KAAgCH,GAAGp/B,EAAErB,EAAEM,EAAlCF,EAAEg9B,GAAGh2B,MAAMxG,EAAE,OAAyB,CAAC,MAAG,OAAOb,EAAEse,MAAYre,EAAEmT,OAAO,IAAInT,EAAEyT,MAAMpS,EAAEoS,MAAMzT,EAAE6gC,GAAG5W,KAAK,KAAK5oB,GAAGtB,EAAE+gC,YAAY9gC,EAAE,OAAKqB,EAAEhB,EAAE6vB,YAAYV,GAAG/C,GAAG1sB,EAAEqlB,aAAamK,GAAGvvB,EAAEyvB,IAAE,EAAGC,GAAG,KAAK,OAAOruB,IAAIytB,GAAGC,MAAME,GAAGH,GAAGC,MAAMG,GAAGJ,GAAGC,MAAMC,GAAGC,GAAG5tB,EAAEuY,GAAGsV,GAAG7tB,EAAE4uB,SAASjB,GAAGhvB,GAAGA,EAAEwgC,GAAGxgC,EAAEI,EAAE4K,UAAUhL,EAAEmT,OAAO,KAAYnT,EAAC,CALrK+gC,CAAG1/B,EAAErB,EAAEM,EAAEF,EAAEG,EAAER,EAAEI,GAAG,GAAGE,EAAE,CAACA,EAAED,EAAEkgC,SAAShgC,EAAEN,EAAEqwB,KAAe9vB,GAAVR,EAAEsB,EAAEoS,OAAUC,QAAQ,IAAIlT,EAAE,CAAC6vB,KAAK,SAASrlB,SAAS5K,EAAE4K,UAChF,OAD0F,KAAO,EAAF1K,IAAMN,EAAEyT,QAAQ1T,IAAGK,EAAEJ,EAAEyT,OAAQ8d,WAAW,EAAEnxB,EAAE4vB,aAAaxvB,EAAER,EAAE8vB,UAAU,OAAO1vB,EAAE61B,GAAGl2B,EAAES,IAAKwgC,aAA4B,SAAfjhC,EAAEihC,aAAuB,OAAOzgC,EAAEF,EAAE41B,GAAG11B,EAAEF,IAAIA,EAAEi2B,GAAGj2B,EAAEC,EAAEH,EAAE,OAAQgT,OAAO,EAAG9S,EAAE6S,OACnflT,EAAEI,EAAE8S,OAAOlT,EAAEI,EAAEsT,QAAQrT,EAAEL,EAAEyT,MAAMrT,EAAEA,EAAEC,EAAEA,EAAEL,EAAEyT,MAA8BnT,EAAE,QAA1BA,EAAEe,EAAEoS,MAAMJ,eAAyB+sB,GAAGjgC,GAAG,CAAC6+B,UAAU1+B,EAAE0+B,UAAU7+B,EAAE8+B,UAAU,KAAKC,YAAY5+B,EAAE4+B,aAAa7+B,EAAEgT,cAAc/S,EAAED,EAAEkxB,WAAWlwB,EAAEkwB,YAAYpxB,EAAEH,EAAEqT,cAAc8sB,GAAU//B,CAAC,CAAoO,OAAzNiB,GAAVhB,EAAEgB,EAAEoS,OAAUC,QAAQtT,EAAE61B,GAAG51B,EAAE,CAACgwB,KAAK,UAAUrlB,SAAS5K,EAAE4K,WAAW,KAAY,EAAPhL,EAAEqwB,QAAUjwB,EAAEuxB,MAAMxxB,GAAGC,EAAE8S,OAAOlT,EAAEI,EAAEsT,QAAQ,KAAK,OAAOrS,IAAkB,QAAdlB,EAAEH,EAAE8vB,YAAoB9vB,EAAE8vB,UAAU,CAACzuB,GAAGrB,EAAEmT,OAAO,IAAIhT,EAAEyR,KAAKvQ,IAAIrB,EAAEyT,MAAMrT,EAAEJ,EAAEqT,cAAc,KAAYjT,CAAC,CACnd,SAASogC,GAAGn/B,EAAErB,GAA8D,OAA3DA,EAAEugC,GAAG,CAAClQ,KAAK,UAAUrlB,SAAShL,GAAGqB,EAAEgvB,KAAK,EAAE,OAAQnd,OAAO7R,EAASA,EAAEoS,MAAMzT,CAAC,CAAC,SAASygC,GAAGp/B,EAAErB,EAAEG,EAAEC,GAAwG,OAArG,OAAOA,GAAGwwB,GAAGxwB,GAAGo2B,GAAGx2B,EAAEqB,EAAEoS,MAAM,KAAKtT,IAAGkB,EAAEm/B,GAAGxgC,EAAEA,EAAEgwB,aAAahlB,WAAYmI,OAAO,EAAEnT,EAAEqT,cAAc,KAAYhS,CAAC,CAGkJ,SAAS4/B,GAAG5/B,EAAErB,EAAEG,GAAGkB,EAAEswB,OAAO3xB,EAAE,IAAII,EAAEiB,EAAE4R,UAAU,OAAO7S,IAAIA,EAAEuxB,OAAO3xB,GAAGsxB,GAAGjwB,EAAE6R,OAAOlT,EAAEG,EAAE,CACxc,SAAS+gC,GAAG7/B,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,IAAIM,EAAEgB,EAAEgS,cAAc,OAAOhT,EAAEgB,EAAEgS,cAAc,CAAC8tB,YAAYnhC,EAAEohC,UAAU,KAAKC,mBAAmB,EAAEC,KAAKlhC,EAAEmhC,KAAKphC,EAAEqhC,SAASzhC,IAAIM,EAAE8gC,YAAYnhC,EAAEK,EAAE+gC,UAAU,KAAK/gC,EAAEghC,mBAAmB,EAAEhhC,EAAEihC,KAAKlhC,EAAEC,EAAEkhC,KAAKphC,EAAEE,EAAEmhC,SAASzhC,EAAE,CAC3O,SAAS0hC,GAAGpgC,EAAErB,EAAEG,GAAG,IAAIC,EAAEJ,EAAEgwB,aAAajwB,EAAEK,EAAEk3B,YAAYj3B,EAAED,EAAEmhC,KAAsC,GAAjC/C,GAAGn9B,EAAErB,EAAEI,EAAE4K,SAAS7K,GAAkB,KAAO,GAAtBC,EAAEg3B,GAAEzjB,UAAqBvT,EAAI,EAAFA,EAAI,EAAEJ,EAAEmT,OAAO,QAAQ,CAAC,GAAG,OAAO9R,GAAG,KAAa,IAARA,EAAE8R,OAAW9R,EAAE,IAAIA,EAAErB,EAAEyT,MAAM,OAAOpS,GAAG,CAAC,GAAG,KAAKA,EAAE2G,IAAI,OAAO3G,EAAEgS,eAAe4tB,GAAG5/B,EAAElB,EAAEH,QAAQ,GAAG,KAAKqB,EAAE2G,IAAIi5B,GAAG5/B,EAAElB,EAAEH,QAAQ,GAAG,OAAOqB,EAAEoS,MAAM,CAACpS,EAAEoS,MAAMP,OAAO7R,EAAEA,EAAEA,EAAEoS,MAAM,QAAQ,CAAC,GAAGpS,IAAIrB,EAAE,MAAMqB,EAAE,KAAK,OAAOA,EAAEqS,SAAS,CAAC,GAAG,OAAOrS,EAAE6R,QAAQ7R,EAAE6R,SAASlT,EAAE,MAAMqB,EAAEA,EAAEA,EAAE6R,MAAM,CAAC7R,EAAEqS,QAAQR,OAAO7R,EAAE6R,OAAO7R,EAAEA,EAAEqS,OAAO,CAACtT,GAAG,CAAC,CAAQ,GAAPitB,GAAE+J,GAAEh3B,GAAM,KAAY,EAAPJ,EAAEqwB,MAAQrwB,EAAEqT,cAC/e,UAAU,OAAOtT,GAAG,IAAK,WAAqB,IAAVI,EAAEH,EAAEyT,MAAU1T,EAAE,KAAK,OAAOI,GAAiB,QAAdkB,EAAElB,EAAE8S,YAAoB,OAAOokB,GAAGh2B,KAAKtB,EAAEI,GAAGA,EAAEA,EAAEuT,QAAY,QAAJvT,EAAEJ,IAAYA,EAAEC,EAAEyT,MAAMzT,EAAEyT,MAAM,OAAO1T,EAAEI,EAAEuT,QAAQvT,EAAEuT,QAAQ,MAAMwtB,GAAGlhC,GAAE,EAAGD,EAAEI,EAAEE,GAAG,MAAM,IAAK,YAA6B,IAAjBF,EAAE,KAAKJ,EAAEC,EAAEyT,MAAUzT,EAAEyT,MAAM,KAAK,OAAO1T,GAAG,CAAe,GAAG,QAAjBsB,EAAEtB,EAAEkT,YAAuB,OAAOokB,GAAGh2B,GAAG,CAACrB,EAAEyT,MAAM1T,EAAE,KAAK,CAACsB,EAAEtB,EAAE2T,QAAQ3T,EAAE2T,QAAQvT,EAAEA,EAAEJ,EAAEA,EAAEsB,CAAC,CAAC6/B,GAAGlhC,GAAE,EAAGG,EAAE,KAAKE,GAAG,MAAM,IAAK,WAAW6gC,GAAGlhC,GAAE,EAAG,KAAK,UAAK,GAAQ,MAAM,QAAQA,EAAEqT,cAAc,KAAK,OAAOrT,EAAEyT,KAAK,CAC7d,SAAS8rB,GAAGl+B,EAAErB,GAAG,KAAY,EAAPA,EAAEqwB,OAAS,OAAOhvB,IAAIA,EAAE4R,UAAU,KAAKjT,EAAEiT,UAAU,KAAKjT,EAAEmT,OAAO,EAAE,CAAC,SAASurB,GAAGr9B,EAAErB,EAAEG,GAAyD,GAAtD,OAAOkB,IAAIrB,EAAEyxB,aAAapwB,EAAEowB,cAAciC,IAAI1zB,EAAE2xB,MAAS,KAAKxxB,EAAEH,EAAEuxB,YAAY,OAAO,KAAK,GAAG,OAAOlwB,GAAGrB,EAAEyT,QAAQpS,EAAEoS,MAAM,MAAMrM,MAAMxG,EAAE,MAAM,GAAG,OAAOZ,EAAEyT,MAAM,CAA4C,IAAjCtT,EAAE81B,GAAZ50B,EAAErB,EAAEyT,MAAapS,EAAE2uB,cAAchwB,EAAEyT,MAAMtT,EAAMA,EAAE+S,OAAOlT,EAAE,OAAOqB,EAAEqS,SAASrS,EAAEA,EAAEqS,SAAQvT,EAAEA,EAAEuT,QAAQuiB,GAAG50B,EAAEA,EAAE2uB,eAAgB9c,OAAOlT,EAAEG,EAAEuT,QAAQ,IAAI,CAAC,OAAO1T,EAAEyT,KAAK,CAO9a,SAASiuB,GAAGrgC,EAAErB,GAAG,IAAIyvB,GAAE,OAAOpuB,EAAEmgC,UAAU,IAAK,SAASxhC,EAAEqB,EAAEkgC,KAAK,IAAI,IAAIphC,EAAE,KAAK,OAAOH,GAAG,OAAOA,EAAEiT,YAAY9S,EAAEH,GAAGA,EAAEA,EAAE0T,QAAQ,OAAOvT,EAAEkB,EAAEkgC,KAAK,KAAKphC,EAAEuT,QAAQ,KAAK,MAAM,IAAK,YAAYvT,EAAEkB,EAAEkgC,KAAK,IAAI,IAAInhC,EAAE,KAAK,OAAOD,GAAG,OAAOA,EAAE8S,YAAY7S,EAAED,GAAGA,EAAEA,EAAEuT,QAAQ,OAAOtT,EAAEJ,GAAG,OAAOqB,EAAEkgC,KAAKlgC,EAAEkgC,KAAK,KAAKlgC,EAAEkgC,KAAK7tB,QAAQ,KAAKtT,EAAEsT,QAAQ,KAAK,CAC5U,SAASiuB,GAAEtgC,GAAG,IAAIrB,EAAE,OAAOqB,EAAE4R,WAAW5R,EAAE4R,UAAUQ,QAAQpS,EAAEoS,MAAMtT,EAAE,EAAEC,EAAE,EAAE,GAAGJ,EAAE,IAAI,IAAID,EAAEsB,EAAEoS,MAAM,OAAO1T,GAAGI,GAAGJ,EAAE4xB,MAAM5xB,EAAEwxB,WAAWnxB,GAAkB,SAAfL,EAAEihC,aAAsB5gC,GAAW,SAARL,EAAEoT,MAAepT,EAAEmT,OAAO7R,EAAEtB,EAAEA,EAAE2T,aAAa,IAAI3T,EAAEsB,EAAEoS,MAAM,OAAO1T,GAAGI,GAAGJ,EAAE4xB,MAAM5xB,EAAEwxB,WAAWnxB,GAAGL,EAAEihC,aAAa5gC,GAAGL,EAAEoT,MAAMpT,EAAEmT,OAAO7R,EAAEtB,EAAEA,EAAE2T,QAAyC,OAAjCrS,EAAE2/B,cAAc5gC,EAAEiB,EAAEkwB,WAAWpxB,EAASH,CAAC,CAC7V,SAAS4hC,GAAGvgC,EAAErB,EAAEG,GAAG,IAAIC,EAAEJ,EAAEgwB,aAAmB,OAANV,GAAGtvB,GAAUA,EAAEgI,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,OAAO25B,GAAE3hC,GAAG,KAAK,KAAK,EAUtD,KAAK,GAAG,OAAO6tB,GAAG7tB,EAAExC,OAAOswB,KAAK6T,GAAE3hC,GAAG,KAVqD,KAAK,EAA2Q,OAAzQI,EAAEJ,EAAEyR,UAAUwlB,KAAK7J,GAAEI,IAAIJ,GAAEG,IAAGiK,KAAKp3B,EAAEy/B,iBAAiBz/B,EAAE0xB,QAAQ1xB,EAAEy/B,eAAez/B,EAAEy/B,eAAe,MAAS,OAAOx+B,GAAG,OAAOA,EAAEoS,QAAM+c,GAAGxwB,GAAGA,EAAEmT,OAAO,EAAE,OAAO9R,GAAGA,EAAEgS,cAAcqF,cAAc,KAAa,IAAR1Y,EAAEmT,SAAanT,EAAEmT,OAAO,KAAK,OAAOuc,KAAKmS,GAAGnS,IAAIA,GAAG,QAAOsQ,GAAG3+B,EAAErB,GAAG2hC,GAAE3hC,GAAU,KAAK,KAAK,EAAEm3B,GAAGn3B,GAAG,IAAID,EAAE+2B,GAAGD,GAAGljB,SAC7e,GAATxT,EAAEH,EAAExC,KAAQ,OAAO6D,GAAG,MAAMrB,EAAEyR,UAAUwuB,GAAG5+B,EAAErB,EAAEG,EAAEC,EAAEL,GAAGsB,EAAEo0B,MAAMz1B,EAAEy1B,MAAMz1B,EAAEmT,OAAO,IAAInT,EAAEmT,OAAO,aAAa,CAAC,IAAI/S,EAAE,CAAC,GAAG,OAAOJ,EAAEyR,UAAU,MAAMrK,MAAMxG,EAAE,MAAW,OAAL+gC,GAAE3hC,GAAU,IAAI,CAAkB,GAAjBqB,EAAEy1B,GAAGH,GAAGhjB,SAAY6c,GAAGxwB,GAAG,CAACI,EAAEJ,EAAEyR,UAAUtR,EAAEH,EAAExC,KAAK,IAAI6C,EAAEL,EAAEywB,cAA+C,OAAjCrwB,EAAEysB,IAAI7sB,EAAEI,EAAE0sB,IAAIzsB,EAAEgB,EAAE,KAAY,EAAPrB,EAAEqwB,MAAelwB,GAAG,IAAK,SAASspB,GAAE,SAASrpB,GAAGqpB,GAAE,QAAQrpB,GAAG,MAAM,IAAK,SAAS,IAAK,SAAS,IAAK,QAAQqpB,GAAE,OAAOrpB,GAAG,MAAM,IAAK,QAAQ,IAAK,QAAQ,IAAIL,EAAE,EAAEA,EAAEopB,GAAGxrB,OAAOoC,IAAI0pB,GAAEN,GAAGppB,GAAGK,GAAG,MAAM,IAAK,SAASqpB,GAAE,QAAQrpB,GAAG,MAAM,IAAK,MAAM,IAAK,QAAQ,IAAK,OAAOqpB,GAAE,QACnhBrpB,GAAGqpB,GAAE,OAAOrpB,GAAG,MAAM,IAAK,UAAUqpB,GAAE,SAASrpB,GAAG,MAAM,IAAK,QAAQ0J,EAAG1J,EAAEC,GAAGopB,GAAE,UAAUrpB,GAAG,MAAM,IAAK,SAASA,EAAEwJ,cAAc,CAACk4B,cAAczhC,EAAE0hC,UAAUtY,GAAE,UAAUrpB,GAAG,MAAM,IAAK,WAAW6K,GAAG7K,EAAEC,GAAGopB,GAAE,UAAUrpB,GAAkB,IAAI,IAAIE,KAAvBqQ,GAAGxQ,EAAEE,GAAGN,EAAE,KAAkBM,EAAE,GAAGA,EAAE2D,eAAe1D,GAAG,CAAC,IAAIC,EAAEF,EAAEC,GAAG,aAAaA,EAAE,kBAAkBC,EAAEH,EAAEgL,cAAc7K,KAAI,IAAKF,EAAE2hC,0BAA0B1W,GAAGlrB,EAAEgL,YAAY7K,EAAEc,GAAGtB,EAAE,CAAC,WAAWQ,IAAI,kBAAkBA,GAAGH,EAAEgL,cAAc,GAAG7K,KAAI,IAAKF,EAAE2hC,0BAA0B1W,GAAGlrB,EAAEgL,YAC1e7K,EAAEc,GAAGtB,EAAE,CAAC,WAAW,GAAGQ,IAAIgD,EAAGS,eAAe1D,IAAI,MAAMC,GAAG,aAAaD,GAAGmpB,GAAE,SAASrpB,EAAE,CAAC,OAAOD,GAAG,IAAK,QAAQsI,EAAGrI,GAAGgK,EAAGhK,EAAEC,GAAE,GAAI,MAAM,IAAK,WAAWoI,EAAGrI,GAAG+K,GAAG/K,GAAG,MAAM,IAAK,SAAS,IAAK,SAAS,MAAM,QAAQ,oBAAoBC,EAAE4hC,UAAU7hC,EAAE8hC,QAAQ3W,IAAInrB,EAAEL,EAAEC,EAAEwyB,YAAYpyB,EAAE,OAAOA,IAAIJ,EAAEmT,OAAO,EAAE,KAAK,CAAC7S,EAAE,IAAIP,EAAEqM,SAASrM,EAAEA,EAAEsK,cAAc,iCAAiChJ,IAAIA,EAAEgK,GAAGlL,IAAI,iCAAiCkB,EAAE,WAAWlB,IAAGkB,EAAEf,EAAEwD,cAAc,QAAS4H,UAAU,qBAAuBrK,EAAEA,EAAEyK,YAAYzK,EAAEwK,aAC/f,kBAAkBzL,EAAEyQ,GAAGxP,EAAEf,EAAEwD,cAAc3D,EAAE,CAAC0Q,GAAGzQ,EAAEyQ,MAAMxP,EAAEf,EAAEwD,cAAc3D,GAAG,WAAWA,IAAIG,EAAEe,EAAEjB,EAAE2hC,SAASzhC,EAAEyhC,UAAS,EAAG3hC,EAAE+hC,OAAO7hC,EAAE6hC,KAAK/hC,EAAE+hC,QAAQ9gC,EAAEf,EAAE8hC,gBAAgB/gC,EAAElB,GAAGkB,EAAEwrB,IAAI7sB,EAAEqB,EAAEyrB,IAAI1sB,EAAE2/B,GAAG1+B,EAAErB,GAAE,GAAG,GAAIA,EAAEyR,UAAUpQ,EAAEA,EAAE,CAAW,OAAVf,EAAEsQ,GAAGzQ,EAAEC,GAAUD,GAAG,IAAK,SAASspB,GAAE,SAASpoB,GAAGooB,GAAE,QAAQpoB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,SAAS,IAAK,SAAS,IAAK,QAAQqpB,GAAE,OAAOpoB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,QAAQ,IAAK,QAAQ,IAAIL,EAAE,EAAEA,EAAEopB,GAAGxrB,OAAOoC,IAAI0pB,GAAEN,GAAGppB,GAAGsB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,SAASqpB,GAAE,QAAQpoB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,MAAM,IAAK,QAAQ,IAAK,OAAOqpB,GAAE,QAClfpoB,GAAGooB,GAAE,OAAOpoB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,UAAUqpB,GAAE,SAASpoB,GAAGtB,EAAEK,EAAE,MAAM,IAAK,QAAQ0J,EAAGzI,EAAEjB,GAAGL,EAAE0J,EAAGpI,EAAEjB,GAAGqpB,GAAE,UAAUpoB,GAAG,MAAM,IAAK,SAAiL,QAAQtB,EAAEK,QAAxK,IAAK,SAASiB,EAAEuI,cAAc,CAACk4B,cAAc1hC,EAAE2hC,UAAUhiC,EAAEyB,EAAE,CAAC,EAAEpB,EAAE,CAACiJ,WAAM,IAASogB,GAAE,UAAUpoB,GAAG,MAAM,IAAK,WAAW4J,GAAG5J,EAAEjB,GAAGL,EAAE+K,GAAGzJ,EAAEjB,GAAGqpB,GAAE,UAAUpoB,GAAiC,IAAIhB,KAAhBsQ,GAAGxQ,EAAEJ,GAAGQ,EAAER,EAAa,GAAGQ,EAAEyD,eAAe3D,GAAG,CAAC,IAAIG,EAAED,EAAEF,GAAG,UAAUA,EAAE+O,GAAG/N,EAAEb,GAAG,4BAA4BH,EAAuB,OAApBG,EAAEA,EAAEA,EAAEmrB,YAAO,IAAgBngB,GAAGnK,EAAEb,GAAI,aAAaH,EAAE,kBAAkBG,GAAG,aAC7eL,GAAG,KAAKK,IAAI0L,GAAG7K,EAAEb,GAAG,kBAAkBA,GAAG0L,GAAG7K,EAAE,GAAGb,GAAG,mCAAmCH,GAAG,6BAA6BA,GAAG,cAAcA,IAAIkD,EAAGS,eAAe3D,GAAG,MAAMG,GAAG,aAAaH,GAAGopB,GAAE,SAASpoB,GAAG,MAAMb,GAAG0E,EAAG7D,EAAEhB,EAAEG,EAAEF,GAAG,CAAC,OAAOH,GAAG,IAAK,QAAQsI,EAAGpH,GAAG+I,EAAG/I,EAAEjB,GAAE,GAAI,MAAM,IAAK,WAAWqI,EAAGpH,GAAG8J,GAAG9J,GAAG,MAAM,IAAK,SAAS,MAAMjB,EAAEiJ,OAAOhI,EAAEsE,aAAa,QAAQ,GAAG2C,EAAGlI,EAAEiJ,QAAQ,MAAM,IAAK,SAAShI,EAAE0gC,WAAW3hC,EAAE2hC,SAAmB,OAAV1hC,EAAED,EAAEiJ,OAAcoB,GAAGpJ,IAAIjB,EAAE2hC,SAAS1hC,GAAE,GAAI,MAAMD,EAAEuJ,cAAcc,GAAGpJ,IAAIjB,EAAE2hC,SAAS3hC,EAAEuJ,cAClf,GAAI,MAAM,QAAQ,oBAAoB5J,EAAEkiC,UAAU5gC,EAAE6gC,QAAQ3W,IAAI,OAAOprB,GAAG,IAAK,SAAS,IAAK,QAAQ,IAAK,SAAS,IAAK,WAAWC,IAAIA,EAAEiiC,UAAU,MAAMhhC,EAAE,IAAK,MAAMjB,GAAE,EAAG,MAAMiB,EAAE,QAAQjB,GAAE,EAAG,CAACA,IAAIJ,EAAEmT,OAAO,EAAE,CAAC,OAAOnT,EAAEy1B,MAAMz1B,EAAEmT,OAAO,IAAInT,EAAEmT,OAAO,QAAQ,CAAM,OAALwuB,GAAE3hC,GAAU,KAAK,KAAK,EAAE,GAAGqB,GAAG,MAAMrB,EAAEyR,UAAUyuB,GAAG7+B,EAAErB,EAAEqB,EAAEovB,cAAcrwB,OAAO,CAAC,GAAG,kBAAkBA,GAAG,OAAOJ,EAAEyR,UAAU,MAAMrK,MAAMxG,EAAE,MAAsC,GAAhCT,EAAE22B,GAAGD,GAAGljB,SAASmjB,GAAGH,GAAGhjB,SAAY6c,GAAGxwB,GAAG,CAAyC,GAAxCI,EAAEJ,EAAEyR,UAAUtR,EAAEH,EAAEywB,cAAcrwB,EAAEysB,IAAI7sB,GAAKK,EAAED,EAAEiM,YAAYlM,IAC/e,QADofkB,EACvfkuB,IAAY,OAAOluB,EAAE2G,KAAK,KAAK,EAAEsjB,GAAGlrB,EAAEiM,UAAUlM,EAAE,KAAY,EAAPkB,EAAEgvB,OAAS,MAAM,KAAK,GAAE,IAAKhvB,EAAEovB,cAAcuR,0BAA0B1W,GAAGlrB,EAAEiM,UAAUlM,EAAE,KAAY,EAAPkB,EAAEgvB,OAAShwB,IAAIL,EAAEmT,OAAO,EAAE,MAAM/S,GAAG,IAAID,EAAEiM,SAASjM,EAAEA,EAAEkK,eAAei4B,eAAeliC,IAAKysB,IAAI7sB,EAAEA,EAAEyR,UAAUrR,CAAC,CAAM,OAALuhC,GAAE3hC,GAAU,KAAK,KAAK,GAA0B,GAAvBotB,GAAEgK,IAAGh3B,EAAEJ,EAAEqT,cAAiB,OAAOhS,GAAG,OAAOA,EAAEgS,eAAe,OAAOhS,EAAEgS,cAAcC,WAAW,CAAC,GAAGmc,IAAG,OAAOD,IAAI,KAAY,EAAPxvB,EAAEqwB,OAAS,KAAa,IAARrwB,EAAEmT,OAAWud,KAAKC,KAAK3wB,EAAEmT,OAAO,MAAM9S,GAAE,OAAQ,GAAGA,EAAEmwB,GAAGxwB,GAAG,OAAOI,GAAG,OAAOA,EAAEkT,WAAW,CAAC,GAAG,OAC5fjS,EAAE,CAAC,IAAIhB,EAAE,MAAM+G,MAAMxG,EAAE,MAAqD,KAA7BP,EAAE,QAApBA,EAAEL,EAAEqT,eAAyBhT,EAAEiT,WAAW,MAAW,MAAMlM,MAAMxG,EAAE,MAAMP,EAAEwsB,IAAI7sB,CAAC,MAAM2wB,KAAK,KAAa,IAAR3wB,EAAEmT,SAAanT,EAAEqT,cAAc,MAAMrT,EAAEmT,OAAO,EAAEwuB,GAAE3hC,GAAGK,GAAE,CAAE,MAAM,OAAOqvB,KAAKmS,GAAGnS,IAAIA,GAAG,MAAMrvB,GAAE,EAAG,IAAIA,EAAE,OAAe,MAARL,EAAEmT,MAAYnT,EAAE,IAAI,CAAC,OAAG,KAAa,IAARA,EAAEmT,QAAkBnT,EAAE2xB,MAAMxxB,EAAEH,KAAEI,EAAE,OAAOA,MAAO,OAAOiB,GAAG,OAAOA,EAAEgS,gBAAgBjT,IAAIJ,EAAEyT,MAAMN,OAAO,KAAK,KAAY,EAAPnT,EAAEqwB,QAAU,OAAOhvB,GAAG,KAAe,EAAV+1B,GAAEzjB,SAAW,IAAI4uB,KAAIA,GAAE,GAAG3B,OAAO,OAAO5gC,EAAEwyB,cAAcxyB,EAAEmT,OAAO,GAAGwuB,GAAE3hC,GAAU,MAAK,KAAK,EAAE,OAAOi3B,KACrf+I,GAAG3+B,EAAErB,GAAG,OAAOqB,GAAG2oB,GAAGhqB,EAAEyR,UAAUkH,eAAegpB,GAAE3hC,GAAG,KAAK,KAAK,GAAG,OAAOoxB,GAAGpxB,EAAExC,KAAK0K,UAAUy5B,GAAE3hC,GAAG,KAA+C,KAAK,GAA0B,GAAvBotB,GAAEgK,IAAwB,QAArB/2B,EAAEL,EAAEqT,eAA0B,OAAOsuB,GAAE3hC,GAAG,KAAuC,GAAlCI,EAAE,KAAa,IAARJ,EAAEmT,OAA4B,QAAjB7S,EAAED,EAAE+gC,WAAsB,GAAGhhC,EAAEshC,GAAGrhC,GAAE,OAAQ,CAAC,GAAG,IAAIkiC,IAAG,OAAOlhC,GAAG,KAAa,IAARA,EAAE8R,OAAW,IAAI9R,EAAErB,EAAEyT,MAAM,OAAOpS,GAAG,CAAS,GAAG,QAAXf,EAAE+2B,GAAGh2B,IAAe,CAAmG,IAAlGrB,EAAEmT,OAAO,IAAIuuB,GAAGrhC,GAAE,GAAoB,QAAhBD,EAAEE,EAAEkyB,eAAuBxyB,EAAEwyB,YAAYpyB,EAAEJ,EAAEmT,OAAO,GAAGnT,EAAEghC,aAAa,EAAE5gC,EAAED,EAAMA,EAAEH,EAAEyT,MAAM,OAAOtT,GAAOkB,EAAEjB,GAANC,EAAEF,GAAQgT,OAAO,SAC/d,QAAd7S,EAAED,EAAE4S,YAAoB5S,EAAEkxB,WAAW,EAAElxB,EAAEsxB,MAAMtwB,EAAEhB,EAAEoT,MAAM,KAAKpT,EAAE2gC,aAAa,EAAE3gC,EAAEowB,cAAc,KAAKpwB,EAAEgT,cAAc,KAAKhT,EAAEmyB,YAAY,KAAKnyB,EAAEoxB,aAAa,KAAKpxB,EAAEoR,UAAU,OAAOpR,EAAEkxB,WAAWjxB,EAAEixB,WAAWlxB,EAAEsxB,MAAMrxB,EAAEqxB,MAAMtxB,EAAEoT,MAAMnT,EAAEmT,MAAMpT,EAAE2gC,aAAa,EAAE3gC,EAAEyvB,UAAU,KAAKzvB,EAAEowB,cAAcnwB,EAAEmwB,cAAcpwB,EAAEgT,cAAc/S,EAAE+S,cAAchT,EAAEmyB,YAAYlyB,EAAEkyB,YAAYnyB,EAAE7C,KAAK8C,EAAE9C,KAAK6D,EAAEf,EAAEmxB,aAAapxB,EAAEoxB,aAAa,OAAOpwB,EAAE,KAAK,CAACswB,MAAMtwB,EAAEswB,MAAMD,aAAarwB,EAAEqwB,eAAevxB,EAAEA,EAAEuT,QAA2B,OAAnB2Z,GAAE+J,GAAY,EAAVA,GAAEzjB,QAAU,GAAU3T,EAAEyT,KAAK,CAACpS,EAClgBA,EAAEqS,OAAO,CAAC,OAAOrT,EAAEkhC,MAAMjtB,KAAIkuB,KAAKxiC,EAAEmT,OAAO,IAAI/S,GAAE,EAAGshC,GAAGrhC,GAAE,GAAIL,EAAE2xB,MAAM,QAAQ,KAAK,CAAC,IAAIvxB,EAAE,GAAW,QAARiB,EAAEg2B,GAAG/2B,KAAa,GAAGN,EAAEmT,OAAO,IAAI/S,GAAE,EAAmB,QAAhBD,EAAEkB,EAAEmxB,eAAuBxyB,EAAEwyB,YAAYryB,EAAEH,EAAEmT,OAAO,GAAGuuB,GAAGrhC,GAAE,GAAI,OAAOA,EAAEkhC,MAAM,WAAWlhC,EAAEmhC,WAAWlhC,EAAE2S,YAAYwc,GAAE,OAAOkS,GAAE3hC,GAAG,UAAU,EAAEsU,KAAIjU,EAAEghC,mBAAmBmB,IAAI,aAAariC,IAAIH,EAAEmT,OAAO,IAAI/S,GAAE,EAAGshC,GAAGrhC,GAAE,GAAIL,EAAE2xB,MAAM,SAAStxB,EAAE8gC,aAAa7gC,EAAEoT,QAAQ1T,EAAEyT,MAAMzT,EAAEyT,MAAMnT,IAAa,QAATH,EAAEE,EAAEihC,MAAcnhC,EAAEuT,QAAQpT,EAAEN,EAAEyT,MAAMnT,EAAED,EAAEihC,KAAKhhC,EAAE,CAAC,OAAG,OAAOD,EAAEkhC,MAAYvhC,EAAEK,EAAEkhC,KAAKlhC,EAAE+gC,UAC9ephC,EAAEK,EAAEkhC,KAAKvhC,EAAE0T,QAAQrT,EAAEghC,mBAAmB/sB,KAAItU,EAAE0T,QAAQ,KAAKvT,EAAEi3B,GAAEzjB,QAAQ0Z,GAAE+J,GAAEh3B,EAAI,EAAFD,EAAI,EAAI,EAAFA,GAAKH,IAAE2hC,GAAE3hC,GAAU,MAAK,KAAK,GAAG,KAAK,GAAG,OAAOyiC,KAAKriC,EAAE,OAAOJ,EAAEqT,cAAc,OAAOhS,GAAG,OAAOA,EAAEgS,gBAAgBjT,IAAIJ,EAAEmT,OAAO,MAAM/S,GAAG,KAAY,EAAPJ,EAAEqwB,MAAQ,KAAQ,WAAH+O,MAAiBuC,GAAE3hC,GAAkB,EAAfA,EAAEghC,eAAiBhhC,EAAEmT,OAAO,OAAOwuB,GAAE3hC,GAAG,KAAK,KAAK,GAAe,KAAK,GAAG,OAAO,KAAK,MAAMoH,MAAMxG,EAAE,IAAIZ,EAAEgI,KAAM,CAClX,SAAS06B,GAAGrhC,EAAErB,GAAS,OAANsvB,GAAGtvB,GAAUA,EAAEgI,KAAK,KAAK,EAAE,OAAO6lB,GAAG7tB,EAAExC,OAAOswB,KAAiB,OAAZzsB,EAAErB,EAAEmT,QAAenT,EAAEmT,OAAS,MAAH9R,EAAS,IAAIrB,GAAG,KAAK,KAAK,EAAE,OAAOi3B,KAAK7J,GAAEI,IAAIJ,GAAEG,IAAGiK,KAAe,KAAO,OAAjBn2B,EAAErB,EAAEmT,SAAqB,KAAO,IAAF9R,IAAQrB,EAAEmT,OAAS,MAAH9R,EAAS,IAAIrB,GAAG,KAAK,KAAK,EAAE,OAAOm3B,GAAGn3B,GAAG,KAAK,KAAK,GAA0B,GAAvBotB,GAAEgK,IAAwB,QAArB/1B,EAAErB,EAAEqT,gBAA2B,OAAOhS,EAAEiS,WAAW,CAAC,GAAG,OAAOtT,EAAEiT,UAAU,MAAM7L,MAAMxG,EAAE,MAAM+vB,IAAI,CAAW,OAAS,OAAnBtvB,EAAErB,EAAEmT,QAAsBnT,EAAEmT,OAAS,MAAH9R,EAAS,IAAIrB,GAAG,KAAK,KAAK,GAAG,OAAOotB,GAAEgK,IAAG,KAAK,KAAK,EAAE,OAAOH,KAAK,KAAK,KAAK,GAAG,OAAO7F,GAAGpxB,EAAExC,KAAK0K,UAAU,KAAK,KAAK,GAAG,KAAK,GAAG,OAAOu6B,KAC1gB,KAAyB,QAAQ,OAAO,KAAK,CArB7C1C,GAAG,SAAS1+B,EAAErB,GAAG,IAAI,IAAIG,EAAEH,EAAEyT,MAAM,OAAOtT,GAAG,CAAC,GAAG,IAAIA,EAAE6H,KAAK,IAAI7H,EAAE6H,IAAI3G,EAAE0K,YAAY5L,EAAEsR,gBAAgB,GAAG,IAAItR,EAAE6H,KAAK,OAAO7H,EAAEsT,MAAM,CAACtT,EAAEsT,MAAMP,OAAO/S,EAAEA,EAAEA,EAAEsT,MAAM,QAAQ,CAAC,GAAGtT,IAAIH,EAAE,MAAM,KAAK,OAAOG,EAAEuT,SAAS,CAAC,GAAG,OAAOvT,EAAE+S,QAAQ/S,EAAE+S,SAASlT,EAAE,OAAOG,EAAEA,EAAE+S,MAAM,CAAC/S,EAAEuT,QAAQR,OAAO/S,EAAE+S,OAAO/S,EAAEA,EAAEuT,OAAO,CAAC,EAAEssB,GAAG,WAAW,EACxTC,GAAG,SAAS5+B,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEsB,EAAEovB,cAAc,GAAG1wB,IAAIK,EAAE,CAACiB,EAAErB,EAAEyR,UAAUqlB,GAAGH,GAAGhjB,SAAS,IAA4RrT,EAAxRD,EAAE,KAAK,OAAOF,GAAG,IAAK,QAAQJ,EAAE0J,EAAGpI,EAAEtB,GAAGK,EAAEqJ,EAAGpI,EAAEjB,GAAGC,EAAE,GAAG,MAAM,IAAK,SAASN,EAAEyB,EAAE,CAAC,EAAEzB,EAAE,CAACsJ,WAAM,IAASjJ,EAAEoB,EAAE,CAAC,EAAEpB,EAAE,CAACiJ,WAAM,IAAShJ,EAAE,GAAG,MAAM,IAAK,WAAWN,EAAE+K,GAAGzJ,EAAEtB,GAAGK,EAAE0K,GAAGzJ,EAAEjB,GAAGC,EAAE,GAAG,MAAM,QAAQ,oBAAoBN,EAAEkiC,SAAS,oBAAoB7hC,EAAE6hC,UAAU5gC,EAAE6gC,QAAQ3W,IAAyB,IAAI9qB,KAAzBkQ,GAAGxQ,EAAEC,GAASD,EAAE,KAAcJ,EAAE,IAAIK,EAAE4D,eAAevD,IAAIV,EAAEiE,eAAevD,IAAI,MAAMV,EAAEU,GAAG,GAAG,UAAUA,EAAE,CAAC,IAAIF,EAAER,EAAEU,GAAG,IAAIH,KAAKC,EAAEA,EAAEyD,eAAe1D,KACjfH,IAAIA,EAAE,CAAC,GAAGA,EAAEG,GAAG,GAAG,KAAK,4BAA4BG,GAAG,aAAaA,GAAG,mCAAmCA,GAAG,6BAA6BA,GAAG,cAAcA,IAAI8C,EAAGS,eAAevD,GAAGJ,IAAIA,EAAE,KAAKA,EAAEA,GAAG,IAAIuR,KAAKnR,EAAE,OAAO,IAAIA,KAAKL,EAAE,CAAC,IAAII,EAAEJ,EAAEK,GAAyB,GAAtBF,EAAE,MAAMR,EAAEA,EAAEU,QAAG,EAAUL,EAAE4D,eAAevD,IAAID,IAAID,IAAI,MAAMC,GAAG,MAAMD,GAAG,GAAG,UAAUE,EAAE,GAAGF,EAAE,CAAC,IAAID,KAAKC,GAAGA,EAAEyD,eAAe1D,IAAIE,GAAGA,EAAEwD,eAAe1D,KAAKH,IAAIA,EAAE,CAAC,GAAGA,EAAEG,GAAG,IAAI,IAAIA,KAAKE,EAAEA,EAAEwD,eAAe1D,IAAIC,EAAED,KAAKE,EAAEF,KAAKH,IAAIA,EAAE,CAAC,GAAGA,EAAEG,GAAGE,EAAEF,GAAG,MAAMH,IAAIE,IAAIA,EAAE,IAAIA,EAAEuR,KAAKnR,EACpfN,IAAIA,EAAEK,MAAM,4BAA4BC,GAAGD,EAAEA,EAAEA,EAAEmrB,YAAO,EAAOprB,EAAEA,EAAEA,EAAEorB,YAAO,EAAO,MAAMnrB,GAAGD,IAAIC,IAAIH,EAAEA,GAAG,IAAIuR,KAAKnR,EAAED,IAAI,aAAaC,EAAE,kBAAkBD,GAAG,kBAAkBA,IAAIH,EAAEA,GAAG,IAAIuR,KAAKnR,EAAE,GAAGD,GAAG,mCAAmCC,GAAG,6BAA6BA,IAAI8C,EAAGS,eAAevD,IAAI,MAAMD,GAAG,aAAaC,GAAGgpB,GAAE,SAASpoB,GAAGhB,GAAGE,IAAIC,IAAIH,EAAE,MAAMA,EAAEA,GAAG,IAAIuR,KAAKnR,EAAED,GAAG,CAACL,IAAIE,EAAEA,GAAG,IAAIuR,KAAK,QAAQzR,GAAG,IAAIM,EAAEJ,GAAKL,EAAEwyB,YAAY/xB,KAAET,EAAEmT,OAAO,EAAC,CAAC,EAAE+sB,GAAG,SAAS7+B,EAAErB,EAAEG,EAAEC,GAAGD,IAAIC,IAAIJ,EAAEmT,OAAO,EAAE,EAkBlb,IAAIwvB,IAAG,EAAGC,IAAE,EAAGC,GAAG,oBAAoBC,QAAQA,QAAQx/B,IAAIy/B,GAAE,KAAK,SAASC,GAAG3hC,EAAErB,GAAG,IAAIG,EAAEkB,EAAEo0B,IAAI,GAAG,OAAOt1B,EAAE,GAAG,oBAAoBA,EAAE,IAAIA,EAAE,KAAK,CAAC,MAAMC,GAAG6iC,GAAE5hC,EAAErB,EAAEI,EAAE,MAAMD,EAAEwT,QAAQ,IAAI,CAAC,SAASuvB,GAAG7hC,EAAErB,EAAEG,GAAG,IAAIA,GAAG,CAAC,MAAMC,GAAG6iC,GAAE5hC,EAAErB,EAAEI,EAAE,CAAC,CAAC,IAAI+iC,IAAG,EAIxR,SAASC,GAAG/hC,EAAErB,EAAEG,GAAG,IAAIC,EAAEJ,EAAEwyB,YAAyC,GAAG,QAAhCpyB,EAAE,OAAOA,EAAEA,EAAE+5B,WAAW,MAAiB,CAAC,IAAIp6B,EAAEK,EAAEA,EAAE4xB,KAAK,EAAE,CAAC,IAAIjyB,EAAEiI,IAAI3G,KAAKA,EAAE,CAAC,IAAIhB,EAAEN,EAAE26B,QAAQ36B,EAAE26B,aAAQ,OAAO,IAASr6B,GAAG6iC,GAAGljC,EAAEG,EAAEE,EAAE,CAACN,EAAEA,EAAEiyB,IAAI,OAAOjyB,IAAIK,EAAE,CAAC,CAAC,SAASijC,GAAGhiC,EAAErB,GAAgD,GAAG,QAAhCA,EAAE,QAAlBA,EAAEA,EAAEwyB,aAAuBxyB,EAAEm6B,WAAW,MAAiB,CAAC,IAAIh6B,EAAEH,EAAEA,EAAEgyB,KAAK,EAAE,CAAC,IAAI7xB,EAAE6H,IAAI3G,KAAKA,EAAE,CAAC,IAAIjB,EAAED,EAAEs6B,OAAOt6B,EAAEu6B,QAAQt6B,GAAG,CAACD,EAAEA,EAAE6xB,IAAI,OAAO7xB,IAAIH,EAAE,CAAC,CAAC,SAASsjC,GAAGjiC,GAAG,IAAIrB,EAAEqB,EAAEo0B,IAAI,GAAG,OAAOz1B,EAAE,CAAC,IAAIG,EAAEkB,EAAEoQ,UAAiBpQ,EAAE2G,IAA8B3G,EAAElB,EAAE,oBAAoBH,EAAEA,EAAEqB,GAAGrB,EAAE2T,QAAQtS,CAAC,CAAC,CAClf,SAASkiC,GAAGliC,GAAG,IAAIrB,EAAEqB,EAAE4R,UAAU,OAAOjT,IAAIqB,EAAE4R,UAAU,KAAKswB,GAAGvjC,IAAIqB,EAAEoS,MAAM,KAAKpS,EAAEyuB,UAAU,KAAKzuB,EAAEqS,QAAQ,KAAK,IAAIrS,EAAE2G,MAAoB,QAAdhI,EAAEqB,EAAEoQ,oBAA4BzR,EAAE6sB,WAAW7sB,EAAE8sB,WAAW9sB,EAAE0pB,WAAW1pB,EAAE+sB,WAAW/sB,EAAEgtB,MAAM3rB,EAAEoQ,UAAU,KAAKpQ,EAAE6R,OAAO,KAAK7R,EAAEowB,aAAa,KAAKpwB,EAAEovB,cAAc,KAAKpvB,EAAEgS,cAAc,KAAKhS,EAAE2uB,aAAa,KAAK3uB,EAAEoQ,UAAU,KAAKpQ,EAAEmxB,YAAY,IAAI,CAAC,SAASgR,GAAGniC,GAAG,OAAO,IAAIA,EAAE2G,KAAK,IAAI3G,EAAE2G,KAAK,IAAI3G,EAAE2G,GAAG,CACna,SAASy7B,GAAGpiC,GAAGA,EAAE,OAAO,CAAC,KAAK,OAAOA,EAAEqS,SAAS,CAAC,GAAG,OAAOrS,EAAE6R,QAAQswB,GAAGniC,EAAE6R,QAAQ,OAAO,KAAK7R,EAAEA,EAAE6R,MAAM,CAA2B,IAA1B7R,EAAEqS,QAAQR,OAAO7R,EAAE6R,OAAW7R,EAAEA,EAAEqS,QAAQ,IAAIrS,EAAE2G,KAAK,IAAI3G,EAAE2G,KAAK,KAAK3G,EAAE2G,KAAK,CAAC,GAAW,EAAR3G,EAAE8R,MAAQ,SAAS9R,EAAE,GAAG,OAAOA,EAAEoS,OAAO,IAAIpS,EAAE2G,IAAI,SAAS3G,EAAOA,EAAEoS,MAAMP,OAAO7R,EAAEA,EAAEA,EAAEoS,KAAK,CAAC,KAAa,EAARpS,EAAE8R,OAAS,OAAO9R,EAAEoQ,SAAS,CAAC,CACzT,SAASiyB,GAAGriC,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAE2G,IAAI,GAAG,IAAI5H,GAAG,IAAIA,EAAEiB,EAAEA,EAAEoQ,UAAUzR,EAAE,IAAIG,EAAEiM,SAASjM,EAAEgR,WAAWwyB,aAAatiC,EAAErB,GAAGG,EAAEwjC,aAAatiC,EAAErB,IAAI,IAAIG,EAAEiM,UAAUpM,EAAEG,EAAEgR,YAAawyB,aAAatiC,EAAElB,IAAKH,EAAEG,GAAI4L,YAAY1K,GAA4B,QAAxBlB,EAAEA,EAAEyjC,2BAA8B,IAASzjC,GAAG,OAAOH,EAAEkiC,UAAUliC,EAAEkiC,QAAQ3W,UAAU,GAAG,IAAInrB,GAAc,QAAViB,EAAEA,EAAEoS,OAAgB,IAAIiwB,GAAGriC,EAAErB,EAAEG,GAAGkB,EAAEA,EAAEqS,QAAQ,OAAOrS,GAAGqiC,GAAGriC,EAAErB,EAAEG,GAAGkB,EAAEA,EAAEqS,OAAO,CAC1X,SAASmwB,GAAGxiC,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAE2G,IAAI,GAAG,IAAI5H,GAAG,IAAIA,EAAEiB,EAAEA,EAAEoQ,UAAUzR,EAAEG,EAAEwjC,aAAatiC,EAAErB,GAAGG,EAAE4L,YAAY1K,QAAQ,GAAG,IAAIjB,GAAc,QAAViB,EAAEA,EAAEoS,OAAgB,IAAIowB,GAAGxiC,EAAErB,EAAEG,GAAGkB,EAAEA,EAAEqS,QAAQ,OAAOrS,GAAGwiC,GAAGxiC,EAAErB,EAAEG,GAAGkB,EAAEA,EAAEqS,OAAO,CAAC,IAAIowB,GAAE,KAAKC,IAAG,EAAG,SAASC,GAAG3iC,EAAErB,EAAEG,GAAG,IAAIA,EAAEA,EAAEsT,MAAM,OAAOtT,GAAG8jC,GAAG5iC,EAAErB,EAAEG,GAAGA,EAAEA,EAAEuT,OAAO,CACnR,SAASuwB,GAAG5iC,EAAErB,EAAEG,GAAG,GAAGkV,IAAI,oBAAoBA,GAAG6uB,qBAAqB,IAAI7uB,GAAG6uB,qBAAqB9uB,GAAGjV,EAAE,CAAC,MAAMI,GAAG,CAAC,OAAOJ,EAAE6H,KAAK,KAAK,EAAE46B,IAAGI,GAAG7iC,EAAEH,GAAG,KAAK,EAAE,IAAII,EAAE0jC,GAAE/jC,EAAEgkC,GAAGD,GAAE,KAAKE,GAAG3iC,EAAErB,EAAEG,GAAO4jC,GAAGhkC,EAAE,QAAT+jC,GAAE1jC,KAAkB2jC,IAAI1iC,EAAEyiC,GAAE3jC,EAAEA,EAAEsR,UAAU,IAAIpQ,EAAE+K,SAAS/K,EAAE8P,WAAWrF,YAAY3L,GAAGkB,EAAEyK,YAAY3L,IAAI2jC,GAAEh4B,YAAY3L,EAAEsR,YAAY,MAAM,KAAK,GAAG,OAAOqyB,KAAIC,IAAI1iC,EAAEyiC,GAAE3jC,EAAEA,EAAEsR,UAAU,IAAIpQ,EAAE+K,SAASogB,GAAGnrB,EAAE8P,WAAWhR,GAAG,IAAIkB,EAAE+K,UAAUogB,GAAGnrB,EAAElB,GAAGgZ,GAAG9X,IAAImrB,GAAGsX,GAAE3jC,EAAEsR,YAAY,MAAM,KAAK,EAAErR,EAAE0jC,GAAE/jC,EAAEgkC,GAAGD,GAAE3jC,EAAEsR,UAAUkH,cAAcorB,IAAG,EAClfC,GAAG3iC,EAAErB,EAAEG,GAAG2jC,GAAE1jC,EAAE2jC,GAAGhkC,EAAE,MAAM,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI6iC,KAAoB,QAAhBxiC,EAAED,EAAEqyB,cAAsC,QAAfpyB,EAAEA,EAAE+5B,aAAsB,CAACp6B,EAAEK,EAAEA,EAAE4xB,KAAK,EAAE,CAAC,IAAI3xB,EAAEN,EAAEO,EAAED,EAAEq6B,QAAQr6B,EAAEA,EAAE2H,SAAI,IAAS1H,IAAI,KAAO,EAAFD,IAAe,KAAO,EAAFA,KAAf6iC,GAAG/iC,EAAEH,EAAEM,GAAyBP,EAAEA,EAAEiyB,IAAI,OAAOjyB,IAAIK,EAAE,CAAC4jC,GAAG3iC,EAAErB,EAAEG,GAAG,MAAM,KAAK,EAAE,IAAIyiC,KAAII,GAAG7iC,EAAEH,GAAiB,oBAAdI,EAAED,EAAEsR,WAAgC0yB,sBAAsB,IAAI/jC,EAAE+0B,MAAMh1B,EAAEswB,cAAcrwB,EAAEy0B,MAAM10B,EAAEkT,cAAcjT,EAAE+jC,sBAAsB,CAAC,MAAM5jC,GAAG0iC,GAAE9iC,EAAEH,EAAEO,EAAE,CAACyjC,GAAG3iC,EAAErB,EAAEG,GAAG,MAAM,KAAK,GAAG6jC,GAAG3iC,EAAErB,EAAEG,GAAG,MAAM,KAAK,GAAU,EAAPA,EAAEkwB,MAAQuS,IAAGxiC,EAAEwiC,KAAI,OAChfziC,EAAEkT,cAAc2wB,GAAG3iC,EAAErB,EAAEG,GAAGyiC,GAAExiC,GAAG4jC,GAAG3iC,EAAErB,EAAEG,GAAG,MAAM,QAAQ6jC,GAAG3iC,EAAErB,EAAEG,GAAG,CAAC,SAASikC,GAAG/iC,GAAG,IAAIrB,EAAEqB,EAAEmxB,YAAY,GAAG,OAAOxyB,EAAE,CAACqB,EAAEmxB,YAAY,KAAK,IAAIryB,EAAEkB,EAAEoQ,UAAU,OAAOtR,IAAIA,EAAEkB,EAAEoQ,UAAU,IAAIoxB,IAAI7iC,EAAE6E,SAAQ,SAAS7E,GAAG,IAAII,EAAEikC,GAAGpa,KAAK,KAAK5oB,EAAErB,GAAGG,EAAEwpB,IAAI3pB,KAAKG,EAAEuD,IAAI1D,GAAGA,EAAEqsB,KAAKjsB,EAAEA,GAAG,GAAE,CAAC,CACzQ,SAASkkC,GAAGjjC,EAAErB,GAAG,IAAIG,EAAEH,EAAE8vB,UAAU,GAAG,OAAO3vB,EAAE,IAAI,IAAIC,EAAE,EAAEA,EAAED,EAAExC,OAAOyC,IAAI,CAAC,IAAIL,EAAEI,EAAEC,GAAG,IAAI,IAAIC,EAAEgB,EAAEf,EAAEN,EAAEO,EAAED,EAAEe,EAAE,KAAK,OAAOd,GAAG,CAAC,OAAOA,EAAEyH,KAAK,KAAK,EAAE87B,GAAEvjC,EAAEkR,UAAUsyB,IAAG,EAAG,MAAM1iC,EAAE,KAAK,EAA4C,KAAK,EAAEyiC,GAAEvjC,EAAEkR,UAAUkH,cAAcorB,IAAG,EAAG,MAAM1iC,EAAEd,EAAEA,EAAE2S,MAAM,CAAC,GAAG,OAAO4wB,GAAE,MAAM18B,MAAMxG,EAAE,MAAMqjC,GAAG5jC,EAAEC,EAAEP,GAAG+jC,GAAE,KAAKC,IAAG,EAAG,IAAIvjC,EAAET,EAAEkT,UAAU,OAAOzS,IAAIA,EAAE0S,OAAO,MAAMnT,EAAEmT,OAAO,IAAI,CAAC,MAAMzS,GAAGwiC,GAAEljC,EAAEC,EAAES,EAAE,CAAC,CAAC,GAAkB,MAAfT,EAAEghC,aAAmB,IAAIhhC,EAAEA,EAAEyT,MAAM,OAAOzT,GAAGukC,GAAGvkC,EAAEqB,GAAGrB,EAAEA,EAAE0T,OAAO,CACje,SAAS6wB,GAAGljC,EAAErB,GAAG,IAAIG,EAAEkB,EAAE4R,UAAU7S,EAAEiB,EAAE8R,MAAM,OAAO9R,EAAE2G,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAiB,GAAds8B,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAQ,EAAFjB,EAAI,CAAC,IAAIgjC,GAAG,EAAE/hC,EAAEA,EAAE6R,QAAQmwB,GAAG,EAAEhiC,EAAE,CAAC,MAAMN,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,IAAIqiC,GAAG,EAAE/hC,EAAEA,EAAE6R,OAAO,CAAC,MAAMnS,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,CAAC,MAAM,KAAK,EAAEujC,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAK,IAAFjB,GAAO,OAAOD,GAAG6iC,GAAG7iC,EAAEA,EAAE+S,QAAQ,MAAM,KAAK,EAAgD,GAA9CoxB,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAK,IAAFjB,GAAO,OAAOD,GAAG6iC,GAAG7iC,EAAEA,EAAE+S,QAAmB,GAAR7R,EAAE8R,MAAS,CAAC,IAAIpT,EAAEsB,EAAEoQ,UAAU,IAAIvF,GAAGnM,EAAE,GAAG,CAAC,MAAMgB,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,CAAC,GAAK,EAAFX,GAAoB,OAAdL,EAAEsB,EAAEoQ,WAAmB,CAAC,IAAIpR,EAAEgB,EAAEovB,cAAcnwB,EAAE,OAAOH,EAAEA,EAAEswB,cAAcpwB,EAAEE,EAAEc,EAAE7D,KAAKgD,EAAEa,EAAEmxB,YACje,GAAnBnxB,EAAEmxB,YAAY,KAAQ,OAAOhyB,EAAE,IAAI,UAAUD,GAAG,UAAUF,EAAE7C,MAAM,MAAM6C,EAAE3C,MAAMuM,EAAGlK,EAAEM,GAAGuQ,GAAGrQ,EAAED,GAAG,IAAIG,EAAEmQ,GAAGrQ,EAAEF,GAAG,IAAIC,EAAE,EAAEA,EAAEE,EAAE7C,OAAO2C,GAAG,EAAE,CAAC,IAAII,EAAEF,EAAEF,GAAGO,EAAEL,EAAEF,EAAE,GAAG,UAAUI,EAAE0O,GAAGrP,EAAEc,GAAG,4BAA4BH,EAAE8K,GAAGzL,EAAEc,GAAG,aAAaH,EAAEwL,GAAGnM,EAAEc,GAAGqE,EAAGnF,EAAEW,EAAEG,EAAEJ,EAAE,CAAC,OAAOF,GAAG,IAAK,QAAQ2J,EAAGnK,EAAEM,GAAG,MAAM,IAAK,WAAW6K,GAAGnL,EAAEM,GAAG,MAAM,IAAK,SAAS,IAAIS,EAAEf,EAAE6J,cAAck4B,YAAY/hC,EAAE6J,cAAck4B,cAAczhC,EAAE0hC,SAAS,IAAI5gC,EAAEd,EAAEgJ,MAAM,MAAMlI,EAAEsJ,GAAG1K,IAAIM,EAAE0hC,SAAS5gC,GAAE,GAAIL,MAAMT,EAAE0hC,WAAW,MAAM1hC,EAAEsJ,aAAac,GAAG1K,IAAIM,EAAE0hC,SACnf1hC,EAAEsJ,cAAa,GAAIc,GAAG1K,IAAIM,EAAE0hC,SAAS1hC,EAAE0hC,SAAS,GAAG,IAAG,IAAKhiC,EAAE+sB,IAAIzsB,CAAC,CAAC,MAAMU,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,CAAC,MAAM,KAAK,EAAgB,GAAdujC,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAQ,EAAFjB,EAAI,CAAC,GAAG,OAAOiB,EAAEoQ,UAAU,MAAMrK,MAAMxG,EAAE,MAAMb,EAAEsB,EAAEoQ,UAAUpR,EAAEgB,EAAEovB,cAAc,IAAI1wB,EAAEsM,UAAUhM,CAAC,CAAC,MAAMU,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,CAAC,MAAM,KAAK,EAAgB,GAAdujC,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAQ,EAAFjB,GAAK,OAAOD,GAAGA,EAAEkT,cAAcqF,aAAa,IAAIS,GAAGnZ,EAAE2Y,cAAc,CAAC,MAAM5X,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,MAAM,KAAK,EAG4G,QAAQujC,GAAGtkC,EACnfqB,GAAGmjC,GAAGnjC,SAJ4Y,KAAK,GAAGijC,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAqB,MAAlBtB,EAAEsB,EAAEoS,OAAQN,QAAa9S,EAAE,OAAON,EAAEsT,cAActT,EAAE0R,UAAUgzB,SAASpkC,GAAGA,GAClf,OAAON,EAAEkT,WAAW,OAAOlT,EAAEkT,UAAUI,gBAAgBqxB,GAAGpwB,OAAQ,EAAFlU,GAAKgkC,GAAG/iC,GAAG,MAAM,KAAK,GAAsF,GAAnFX,EAAE,OAAOP,GAAG,OAAOA,EAAEkT,cAAqB,EAAPhS,EAAEgvB,MAAQuS,IAAGniC,EAAEmiC,KAAIliC,EAAE4jC,GAAGtkC,EAAEqB,GAAGuhC,GAAEniC,GAAG6jC,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAQ,KAAFjB,EAAO,CAA0B,GAAzBK,EAAE,OAAOY,EAAEgS,eAAkBhS,EAAEoQ,UAAUgzB,SAAShkC,KAAKC,GAAG,KAAY,EAAPW,EAAEgvB,MAAQ,IAAI0S,GAAE1hC,EAAEX,EAAEW,EAAEoS,MAAM,OAAO/S,GAAG,CAAC,IAAIG,EAAEkiC,GAAEriC,EAAE,OAAOqiC,IAAG,CAAe,OAAV5hC,GAAJL,EAAEiiC,IAAMtvB,MAAa3S,EAAEkH,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAGo7B,GAAG,EAAEtiC,EAAEA,EAAEoS,QAAQ,MAAM,KAAK,EAAE8vB,GAAGliC,EAAEA,EAAEoS,QAAQ,IAAIvS,EAAEG,EAAE2Q,UAAU,GAAG,oBAAoB9Q,EAAEwjC,qBAAqB,CAAC/jC,EAAEU,EAAEX,EAAEW,EAAEoS,OAAO,IAAIlT,EAAEI,EAAEO,EAAEw0B,MACpfn1B,EAAEywB,cAAc9vB,EAAEk0B,MAAM70B,EAAEqT,cAAc1S,EAAEwjC,sBAAsB,CAAC,MAAMpjC,GAAGkiC,GAAE7iC,EAAED,EAAEY,EAAE,CAAC,CAAC,MAAM,KAAK,EAAEiiC,GAAGliC,EAAEA,EAAEoS,QAAQ,MAAM,KAAK,GAAG,GAAG,OAAOpS,EAAEuS,cAAc,CAACsxB,GAAG9jC,GAAG,QAAQ,EAAE,OAAOM,GAAGA,EAAE+R,OAAOpS,EAAEiiC,GAAE5hC,GAAGwjC,GAAG9jC,EAAE,CAACH,EAAEA,EAAEgT,OAAO,CAACrS,EAAE,IAAIX,EAAE,KAAKG,EAAEQ,IAAI,CAAC,GAAG,IAAIR,EAAEmH,KAAK,GAAG,OAAOtH,EAAE,CAACA,EAAEG,EAAE,IAAId,EAAEc,EAAE4Q,UAAUhR,EAAa,oBAAVJ,EAAEN,EAAEsP,OAA4BE,YAAYlP,EAAEkP,YAAY,UAAU,OAAO,aAAalP,EAAEukC,QAAQ,QAASrkC,EAAEM,EAAE4Q,UAAkCnR,OAAE,KAA1BE,EAAEK,EAAE4vB,cAAcphB,QAAoB,OAAO7O,GAAGA,EAAEwD,eAAe,WAAWxD,EAAEokC,QAAQ,KAAKrkC,EAAE8O,MAAMu1B,QACzfz1B,GAAG,UAAU7O,GAAG,CAAC,MAAMS,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,CAAC,OAAO,GAAG,IAAIF,EAAEmH,KAAK,GAAG,OAAOtH,EAAE,IAAIG,EAAE4Q,UAAUpF,UAAU5L,EAAE,GAAGI,EAAE4vB,aAAa,CAAC,MAAM1vB,GAAGkiC,GAAE5hC,EAAEA,EAAE6R,OAAOnS,EAAE,OAAO,IAAI,KAAKF,EAAEmH,KAAK,KAAKnH,EAAEmH,KAAK,OAAOnH,EAAEwS,eAAexS,IAAIQ,IAAI,OAAOR,EAAE4S,MAAM,CAAC5S,EAAE4S,MAAMP,OAAOrS,EAAEA,EAAEA,EAAE4S,MAAM,QAAQ,CAAC,GAAG5S,IAAIQ,EAAE,MAAMA,EAAE,KAAK,OAAOR,EAAE6S,SAAS,CAAC,GAAG,OAAO7S,EAAEqS,QAAQrS,EAAEqS,SAAS7R,EAAE,MAAMA,EAAEX,IAAIG,IAAIH,EAAE,MAAMG,EAAEA,EAAEqS,MAAM,CAACxS,IAAIG,IAAIH,EAAE,MAAMG,EAAE6S,QAAQR,OAAOrS,EAAEqS,OAAOrS,EAAEA,EAAE6S,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG4wB,GAAGtkC,EAAEqB,GAAGmjC,GAAGnjC,GAAK,EAAFjB,GAAKgkC,GAAG/iC,GAAS,KAAK,IACtd,CAAC,SAASmjC,GAAGnjC,GAAG,IAAIrB,EAAEqB,EAAE8R,MAAM,GAAK,EAAFnT,EAAI,CAAC,IAAIqB,EAAE,CAAC,IAAI,IAAIlB,EAAEkB,EAAE6R,OAAO,OAAO/S,GAAG,CAAC,GAAGqjC,GAAGrjC,GAAG,CAAC,IAAIC,EAAED,EAAE,MAAMkB,CAAC,CAAClB,EAAEA,EAAE+S,MAAM,CAAC,MAAM9L,MAAMxG,EAAE,KAAM,CAAC,OAAOR,EAAE4H,KAAK,KAAK,EAAE,IAAIjI,EAAEK,EAAEqR,UAAkB,GAARrR,EAAE+S,QAAWjH,GAAGnM,EAAE,IAAIK,EAAE+S,QAAQ,IAAgB0wB,GAAGxiC,EAAToiC,GAAGpiC,GAAUtB,GAAG,MAAM,KAAK,EAAE,KAAK,EAAE,IAAIO,EAAEF,EAAEqR,UAAUkH,cAAsB+qB,GAAGriC,EAAToiC,GAAGpiC,GAAUf,GAAG,MAAM,QAAQ,MAAM8G,MAAMxG,EAAE,MAAO,CAAC,MAAMJ,GAAGyiC,GAAE5hC,EAAEA,EAAE6R,OAAO1S,EAAE,CAACa,EAAE8R,QAAQ,CAAC,CAAG,KAAFnT,IAASqB,EAAE8R,QAAQ,KAAK,CAAC,SAAS0xB,GAAGxjC,EAAErB,EAAEG,GAAG4iC,GAAE1hC,EAAEyjC,GAAGzjC,EAAErB,EAAEG,EAAE,CACvb,SAAS2kC,GAAGzjC,EAAErB,EAAEG,GAAG,IAAI,IAAIC,EAAE,KAAY,EAAPiB,EAAEgvB,MAAQ,OAAO0S,IAAG,CAAC,IAAIhjC,EAAEgjC,GAAE1iC,EAAEN,EAAE0T,MAAM,GAAG,KAAK1T,EAAEiI,KAAK5H,EAAE,CAAC,IAAIE,EAAE,OAAOP,EAAEsT,eAAesvB,GAAG,IAAIriC,EAAE,CAAC,IAAIC,EAAER,EAAEkT,UAAUzS,EAAE,OAAOD,GAAG,OAAOA,EAAE8S,eAAeuvB,GAAEriC,EAAEoiC,GAAG,IAAIliC,EAAEmiC,GAAO,GAALD,GAAGriC,GAAMsiC,GAAEpiC,KAAKC,EAAE,IAAIsiC,GAAEhjC,EAAE,OAAOgjC,IAAOviC,GAAJF,EAAEyiC,IAAMtvB,MAAM,KAAKnT,EAAE0H,KAAK,OAAO1H,EAAE+S,cAAc0xB,GAAGhlC,GAAG,OAAOS,GAAGA,EAAE0S,OAAO5S,EAAEyiC,GAAEviC,GAAGukC,GAAGhlC,GAAG,KAAK,OAAOM,GAAG0iC,GAAE1iC,EAAEykC,GAAGzkC,EAAEL,EAAEG,GAAGE,EAAEA,EAAEqT,QAAQqvB,GAAEhjC,EAAE4iC,GAAGpiC,EAAEqiC,GAAEniC,CAAC,CAACukC,GAAG3jC,EAAM,MAAM,KAAoB,KAAftB,EAAEihC,eAAoB,OAAO3gC,GAAGA,EAAE6S,OAAOnT,EAAEgjC,GAAE1iC,GAAG2kC,GAAG3jC,EAAM,CAAC,CACvc,SAAS2jC,GAAG3jC,GAAG,KAAK,OAAO0hC,IAAG,CAAC,IAAI/iC,EAAE+iC,GAAE,GAAG,KAAa,KAAR/iC,EAAEmT,OAAY,CAAC,IAAIhT,EAAEH,EAAEiT,UAAU,IAAI,GAAG,KAAa,KAARjT,EAAEmT,OAAY,OAAOnT,EAAEgI,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG46B,IAAGS,GAAG,EAAErjC,GAAG,MAAM,KAAK,EAAE,IAAII,EAAEJ,EAAEyR,UAAU,GAAW,EAARzR,EAAEmT,QAAUyvB,GAAE,GAAG,OAAOziC,EAAEC,EAAEm1B,wBAAwB,CAAC,IAAIx1B,EAAEC,EAAE6vB,cAAc7vB,EAAExC,KAAK2C,EAAEswB,cAAcK,GAAG9wB,EAAExC,KAAK2C,EAAEswB,eAAerwB,EAAEs/B,mBAAmB3/B,EAAEI,EAAEkT,cAAcjT,EAAE6kC,oCAAoC,CAAC,IAAI5kC,EAAEL,EAAEwyB,YAAY,OAAOnyB,GAAGszB,GAAG3zB,EAAEK,EAAED,GAAG,MAAM,KAAK,EAAE,IAAIE,EAAEN,EAAEwyB,YAAY,GAAG,OAAOlyB,EAAE,CAAQ,GAAPH,EAAE,KAAQ,OAAOH,EAAEyT,MAAM,OAAOzT,EAAEyT,MAAMzL,KAAK,KAAK,EACvf,KAAK,EAAE7H,EAAEH,EAAEyT,MAAMhC,UAAUkiB,GAAG3zB,EAAEM,EAAEH,EAAE,CAAC,MAAM,KAAK,EAAE,IAAII,EAAEP,EAAEyR,UAAU,GAAG,OAAOtR,GAAW,EAARH,EAAEmT,MAAQ,CAAChT,EAAEI,EAAE,IAAIC,EAAER,EAAEywB,cAAc,OAAOzwB,EAAExC,MAAM,IAAK,SAAS,IAAK,QAAQ,IAAK,SAAS,IAAK,WAAWgD,EAAE6hC,WAAWliC,EAAEsnB,QAAQ,MAAM,IAAK,MAAMjnB,EAAE0kC,MAAM/kC,EAAE+kC,IAAI1kC,EAAE0kC,KAAK,CAAC,MAAM,KAAK,EAAQ,KAAK,EAAQ,KAAK,GAAyJ,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAhM,KAAK,GAAG,GAAG,OAAOllC,EAAEqT,cAAc,CAAC,IAAI5S,EAAET,EAAEiT,UAAU,GAAG,OAAOxS,EAAE,CAAC,IAAIC,EAAED,EAAE4S,cAAc,GAAG,OAAO3S,EAAE,CAAC,IAAIG,EAAEH,EAAE4S,WAAW,OAAOzS,GAAGsY,GAAGtY,EAAE,CAAC,CAAC,CAAC,MAC5c,QAAQ,MAAMuG,MAAMxG,EAAE,MAAOgiC,IAAW,IAAR5iC,EAAEmT,OAAWmwB,GAAGtjC,EAAE,CAAC,MAAMc,GAAGmiC,GAAEjjC,EAAEA,EAAEkT,OAAOpS,EAAE,CAAC,CAAC,GAAGd,IAAIqB,EAAE,CAAC0hC,GAAE,KAAK,KAAK,CAAa,GAAG,QAAf5iC,EAAEH,EAAE0T,SAAoB,CAACvT,EAAE+S,OAAOlT,EAAEkT,OAAO6vB,GAAE5iC,EAAE,KAAK,CAAC4iC,GAAE/iC,EAAEkT,MAAM,CAAC,CAAC,SAASyxB,GAAGtjC,GAAG,KAAK,OAAO0hC,IAAG,CAAC,IAAI/iC,EAAE+iC,GAAE,GAAG/iC,IAAIqB,EAAE,CAAC0hC,GAAE,KAAK,KAAK,CAAC,IAAI5iC,EAAEH,EAAE0T,QAAQ,GAAG,OAAOvT,EAAE,CAACA,EAAE+S,OAAOlT,EAAEkT,OAAO6vB,GAAE5iC,EAAE,KAAK,CAAC4iC,GAAE/iC,EAAEkT,MAAM,CAAC,CACvS,SAAS6xB,GAAG1jC,GAAG,KAAK,OAAO0hC,IAAG,CAAC,IAAI/iC,EAAE+iC,GAAE,IAAI,OAAO/iC,EAAEgI,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI7H,EAAEH,EAAEkT,OAAO,IAAImwB,GAAG,EAAErjC,EAAE,CAAC,MAAMQ,GAAGyiC,GAAEjjC,EAAEG,EAAEK,EAAE,CAAC,MAAM,KAAK,EAAE,IAAIJ,EAAEJ,EAAEyR,UAAU,GAAG,oBAAoBrR,EAAEm1B,kBAAkB,CAAC,IAAIx1B,EAAEC,EAAEkT,OAAO,IAAI9S,EAAEm1B,mBAAmB,CAAC,MAAM/0B,GAAGyiC,GAAEjjC,EAAED,EAAES,EAAE,CAAC,CAAC,IAAIH,EAAEL,EAAEkT,OAAO,IAAIowB,GAAGtjC,EAAE,CAAC,MAAMQ,GAAGyiC,GAAEjjC,EAAEK,EAAEG,EAAE,CAAC,MAAM,KAAK,EAAE,IAAIF,EAAEN,EAAEkT,OAAO,IAAIowB,GAAGtjC,EAAE,CAAC,MAAMQ,GAAGyiC,GAAEjjC,EAAEM,EAAEE,EAAE,EAAE,CAAC,MAAMA,GAAGyiC,GAAEjjC,EAAEA,EAAEkT,OAAO1S,EAAE,CAAC,GAAGR,IAAIqB,EAAE,CAAC0hC,GAAE,KAAK,KAAK,CAAC,IAAIxiC,EAAEP,EAAE0T,QAAQ,GAAG,OAAOnT,EAAE,CAACA,EAAE2S,OAAOlT,EAAEkT,OAAO6vB,GAAExiC,EAAE,KAAK,CAACwiC,GAAE/iC,EAAEkT,MAAM,CAAC,CAC7d,IAwBkNiyB,GAxB9MC,GAAG7vB,KAAK8vB,KAAKC,GAAGv/B,EAAG4xB,uBAAuB4N,GAAGx/B,EAAGw4B,kBAAkBiH,GAAGz/B,EAAGsT,wBAAwBia,GAAE,EAAE2G,GAAE,KAAKwL,GAAE,KAAKC,GAAE,EAAEtG,GAAG,EAAED,GAAGhS,GAAG,GAAGoV,GAAE,EAAEoD,GAAG,KAAKjS,GAAG,EAAEkS,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAKC,GAAG,KAAKrB,GAAG,EAAElC,GAAGwD,IAASC,GAAG,KAAKtI,IAAG,EAAGC,GAAG,KAAKG,GAAG,KAAKmI,IAAG,EAAGC,GAAG,KAAKC,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAKC,IAAI,EAAEC,GAAG,EAAE,SAASpS,KAAI,OAAO,KAAO,EAAFd,IAAKhf,MAAK,IAAIiyB,GAAGA,GAAGA,GAAGjyB,IAAG,CAChU,SAAS+f,GAAGhzB,GAAG,OAAG,KAAY,EAAPA,EAAEgvB,MAAe,EAAK,KAAO,EAAFiD,KAAM,IAAIoS,GAASA,IAAGA,GAAK,OAAO7U,GAAGrX,YAAkB,IAAIgtB,KAAKA,GAAGhwB,MAAMgwB,IAAU,KAAPnlC,EAAEwV,IAAkBxV,EAAiBA,OAAE,KAAjBA,EAAEuC,OAAO4f,OAAmB,GAAGzJ,GAAG1Y,EAAE7D,KAAc,CAAC,SAAS82B,GAAGjzB,EAAErB,EAAEG,EAAEC,GAAG,GAAG,GAAGimC,GAAG,MAAMA,GAAG,EAAEC,GAAG,KAAKl/B,MAAMxG,EAAE,MAAM8V,GAAGrV,EAAElB,EAAEC,GAAM,KAAO,EAAFkzB,KAAMjyB,IAAI44B,KAAE54B,IAAI44B,KAAI,KAAO,EAAF3G,MAAOsS,IAAIzlC,GAAG,IAAIoiC,IAAGkE,GAAGplC,EAAEqkC,KAAIgB,GAAGrlC,EAAEjB,GAAG,IAAID,GAAG,IAAImzB,IAAG,KAAY,EAAPtzB,EAAEqwB,QAAUmS,GAAGluB,KAAI,IAAIga,IAAIG,MAAK,CAC1Y,SAASiY,GAAGrlC,EAAErB,GAAG,IAAIG,EAAEkB,EAAEslC,cA5MzB,SAAYtlC,EAAErB,GAAG,IAAI,IAAIG,EAAEkB,EAAE6U,eAAe9V,EAAEiB,EAAE8U,YAAYpW,EAAEsB,EAAEulC,gBAAgBvmC,EAAEgB,EAAE4U,aAAa,EAAE5V,GAAG,CAAC,IAAIC,EAAE,GAAGgV,GAAGjV,GAAGE,EAAE,GAAGD,EAAEE,EAAET,EAAEO,IAAO,IAAIE,EAAM,KAAKD,EAAEJ,IAAI,KAAKI,EAAEH,KAAGL,EAAEO,GAAGgW,GAAG/V,EAAEP,IAAQQ,GAAGR,IAAIqB,EAAEwlC,cAActmC,GAAGF,IAAIE,CAAC,CAAC,CA4MnLumC,CAAGzlC,EAAErB,GAAG,IAAII,EAAE4V,GAAG3U,EAAEA,IAAI44B,GAAEyL,GAAE,GAAG,GAAG,IAAItlC,EAAE,OAAOD,GAAG6T,GAAG7T,GAAGkB,EAAEslC,aAAa,KAAKtlC,EAAE0lC,iBAAiB,OAAO,GAAG/mC,EAAEI,GAAGA,EAAEiB,EAAE0lC,mBAAmB/mC,EAAE,CAAgB,GAAf,MAAMG,GAAG6T,GAAG7T,GAAM,IAAIH,EAAE,IAAIqB,EAAE2G,IA7IsJ,SAAY3G,GAAGitB,IAAG,EAAGE,GAAGntB,EAAE,CA6I5K2lC,CAAGC,GAAGhd,KAAK,KAAK5oB,IAAImtB,GAAGyY,GAAGhd,KAAK,KAAK5oB,IAAI6qB,IAAG,WAAW,KAAO,EAAFoH,KAAM7E,IAAI,IAAGtuB,EAAE,SAAS,CAAC,OAAO2W,GAAG1W,IAAI,KAAK,EAAED,EAAEuU,GAAG,MAAM,KAAK,EAAEvU,EAAEyU,GAAG,MAAM,KAAK,GAAwC,QAAQzU,EAAE2U,SAApC,KAAK,UAAU3U,EAAE+U,GAAsB/U,EAAE+mC,GAAG/mC,EAAEgnC,GAAGld,KAAK,KAAK5oB,GAAG,CAACA,EAAE0lC,iBAAiB/mC,EAAEqB,EAAEslC,aAAaxmC,CAAC,CAAC,CAC7c,SAASgnC,GAAG9lC,EAAErB,GAAc,GAAXumC,IAAI,EAAEC,GAAG,EAAK,KAAO,EAAFlT,IAAK,MAAMlsB,MAAMxG,EAAE,MAAM,IAAIT,EAAEkB,EAAEslC,aAAa,GAAGS,MAAM/lC,EAAEslC,eAAexmC,EAAE,OAAO,KAAK,IAAIC,EAAE4V,GAAG3U,EAAEA,IAAI44B,GAAEyL,GAAE,GAAG,GAAG,IAAItlC,EAAE,OAAO,KAAK,GAAG,KAAO,GAAFA,IAAO,KAAKA,EAAEiB,EAAEwlC,eAAe7mC,EAAEA,EAAEqnC,GAAGhmC,EAAEjB,OAAO,CAACJ,EAAEI,EAAE,IAAIL,EAAEuzB,GAAEA,IAAG,EAAE,IAAIjzB,EAAEinC,KAAgD,IAAxCrN,KAAI54B,GAAGqkC,KAAI1lC,IAAEimC,GAAG,KAAKzD,GAAGluB,KAAI,IAAIizB,GAAGlmC,EAAErB,UAAUwnC,KAAK,KAAK,CAAC,MAAMjnC,GAAGknC,GAAGpmC,EAAEd,EAAE,CAAU4wB,KAAKmU,GAAG3xB,QAAQtT,EAAEizB,GAAEvzB,EAAE,OAAO0lC,GAAEzlC,EAAE,GAAGi6B,GAAE,KAAKyL,GAAE,EAAE1lC,EAAEuiC,GAAE,CAAC,GAAG,IAAIviC,EAAE,CAAyC,GAAxC,IAAIA,IAAY,KAARD,EAAEwW,GAAGlV,MAAWjB,EAAEL,EAAEC,EAAE0nC,GAAGrmC,EAAEtB,KAAQ,IAAIC,EAAE,MAAMG,EAAEwlC,GAAG4B,GAAGlmC,EAAE,GAAGolC,GAAGplC,EAAEjB,GAAGsmC,GAAGrlC,EAAEiT,MAAKnU,EAAE,GAAG,IAAIH,EAAEymC,GAAGplC,EAAEjB,OAChf,CAAuB,GAAtBL,EAAEsB,EAAEsS,QAAQV,UAAa,KAAO,GAAF7S,KAGnC,SAAYiB,GAAG,IAAI,IAAIrB,EAAEqB,IAAI,CAAC,GAAW,MAARrB,EAAEmT,MAAY,CAAC,IAAIhT,EAAEH,EAAEwyB,YAAY,GAAG,OAAOryB,GAAe,QAAXA,EAAEA,EAAEi6B,QAAiB,IAAI,IAAIh6B,EAAE,EAAEA,EAAED,EAAExC,OAAOyC,IAAI,CAAC,IAAIL,EAAEI,EAAEC,GAAGC,EAAEN,EAAE+5B,YAAY/5B,EAAEA,EAAEsJ,MAAM,IAAI,IAAIyb,GAAGzkB,IAAIN,GAAG,OAAM,CAAE,CAAC,MAAMO,GAAG,OAAM,CAAE,CAAC,CAAC,CAAW,GAAVH,EAAEH,EAAEyT,MAAwB,MAAfzT,EAAEghC,cAAoB,OAAO7gC,EAAEA,EAAE+S,OAAOlT,EAAEA,EAAEG,MAAM,CAAC,GAAGH,IAAIqB,EAAE,MAAM,KAAK,OAAOrB,EAAE0T,SAAS,CAAC,GAAG,OAAO1T,EAAEkT,QAAQlT,EAAEkT,SAAS7R,EAAE,OAAM,EAAGrB,EAAEA,EAAEkT,MAAM,CAAClT,EAAE0T,QAAQR,OAAOlT,EAAEkT,OAAOlT,EAAEA,EAAE0T,OAAO,CAAC,CAAC,OAAM,CAAE,CAHvXi0B,CAAG5nC,KAAe,KAAVC,EAAEqnC,GAAGhmC,EAAEjB,MAAmB,KAARC,EAAEkW,GAAGlV,MAAWjB,EAAEC,EAAEL,EAAE0nC,GAAGrmC,EAAEhB,KAAK,IAAIL,GAAG,MAAMG,EAAEwlC,GAAG4B,GAAGlmC,EAAE,GAAGolC,GAAGplC,EAAEjB,GAAGsmC,GAAGrlC,EAAEiT,MAAKnU,EAAqC,OAAnCkB,EAAEumC,aAAa7nC,EAAEsB,EAAEwmC,cAAcznC,EAASJ,GAAG,KAAK,EAAE,KAAK,EAAE,MAAMoH,MAAMxG,EAAE,MAAM,KAAK,EAC8B,KAAK,EAAEknC,GAAGzmC,EAAE0kC,GAAGE,IAAI,MAD7B,KAAK,EAAU,GAARQ,GAAGplC,EAAEjB,IAAS,UAAFA,KAAeA,GAAiB,IAAbJ,EAAE0kC,GAAG,IAAIpwB,MAAU,CAAC,GAAG,IAAI0B,GAAG3U,EAAE,GAAG,MAAyB,KAAnBtB,EAAEsB,EAAE6U,gBAAqB9V,KAAKA,EAAE,CAACg0B,KAAI/yB,EAAE8U,aAAa9U,EAAE6U,eAAenW,EAAE,KAAK,CAACsB,EAAE0mC,cAAcnc,GAAGkc,GAAG7d,KAAK,KAAK5oB,EAAE0kC,GAAGE,IAAIjmC,GAAG,KAAK,CAAC8nC,GAAGzmC,EAAE0kC,GAAGE,IAAI,MAAM,KAAK,EAAU,GAARQ,GAAGplC,EAAEjB,IAAS,QAAFA,KAC9eA,EAAE,MAAqB,IAAfJ,EAAEqB,EAAEsV,WAAe5W,GAAG,EAAE,EAAEK,GAAG,CAAC,IAAIE,EAAE,GAAGgV,GAAGlV,GAAGC,EAAE,GAAGC,GAAEA,EAAEN,EAAEM,IAAKP,IAAIA,EAAEO,GAAGF,IAAIC,CAAC,CAAqG,GAApGD,EAAEL,EAAqG,IAA3FK,GAAG,KAAXA,EAAEkU,KAAIlU,GAAW,IAAI,IAAIA,EAAE,IAAI,KAAKA,EAAE,KAAK,KAAKA,EAAE,KAAK,IAAIA,EAAE,IAAI,KAAKA,EAAE,KAAK,KAAKglC,GAAGhlC,EAAE,OAAOA,GAAU,CAACiB,EAAE0mC,cAAcnc,GAAGkc,GAAG7d,KAAK,KAAK5oB,EAAE0kC,GAAGE,IAAI7lC,GAAG,KAAK,CAAC0nC,GAAGzmC,EAAE0kC,GAAGE,IAAI,MAA+B,QAAQ,MAAM7+B,MAAMxG,EAAE,MAAO,CAAC,CAAW,OAAV8lC,GAAGrlC,EAAEiT,MAAYjT,EAAEslC,eAAexmC,EAAEgnC,GAAGld,KAAK,KAAK5oB,GAAG,IAAI,CACrX,SAASqmC,GAAGrmC,EAAErB,GAAG,IAAIG,EAAE2lC,GAA2G,OAAxGzkC,EAAEsS,QAAQN,cAAcqF,eAAe6uB,GAAGlmC,EAAErB,GAAGmT,OAAO,KAAe,KAAV9R,EAAEgmC,GAAGhmC,EAAErB,MAAWA,EAAE+lC,GAAGA,GAAG5lC,EAAE,OAAOH,GAAG6hC,GAAG7hC,IAAWqB,CAAC,CAAC,SAASwgC,GAAGxgC,GAAG,OAAO0kC,GAAGA,GAAG1kC,EAAE0kC,GAAGn0B,KAAKY,MAAMuzB,GAAG1kC,EAAE,CAE5L,SAASolC,GAAGplC,EAAErB,GAAuD,IAApDA,IAAI6lC,GAAG7lC,IAAI4lC,GAAGvkC,EAAE6U,gBAAgBlW,EAAEqB,EAAE8U,cAAcnW,EAAMqB,EAAEA,EAAEulC,gBAAgB,EAAE5mC,GAAG,CAAC,IAAIG,EAAE,GAAGmV,GAAGtV,GAAGI,EAAE,GAAGD,EAAEkB,EAAElB,IAAI,EAAEH,IAAII,CAAC,CAAC,CAAC,SAAS6mC,GAAG5lC,GAAG,GAAG,KAAO,EAAFiyB,IAAK,MAAMlsB,MAAMxG,EAAE,MAAMwmC,KAAK,IAAIpnC,EAAEgW,GAAG3U,EAAE,GAAG,GAAG,KAAO,EAAFrB,GAAK,OAAO0mC,GAAGrlC,EAAEiT,MAAK,KAAK,IAAInU,EAAEknC,GAAGhmC,EAAErB,GAAG,GAAG,IAAIqB,EAAE2G,KAAK,IAAI7H,EAAE,CAAC,IAAIC,EAAEmW,GAAGlV,GAAG,IAAIjB,IAAIJ,EAAEI,EAAED,EAAEunC,GAAGrmC,EAAEjB,GAAG,CAAC,GAAG,IAAID,EAAE,MAAMA,EAAEwlC,GAAG4B,GAAGlmC,EAAE,GAAGolC,GAAGplC,EAAErB,GAAG0mC,GAAGrlC,EAAEiT,MAAKnU,EAAE,GAAG,IAAIA,EAAE,MAAMiH,MAAMxG,EAAE,MAAiF,OAA3ES,EAAEumC,aAAavmC,EAAEsS,QAAQV,UAAU5R,EAAEwmC,cAAc7nC,EAAE8nC,GAAGzmC,EAAE0kC,GAAGE,IAAIS,GAAGrlC,EAAEiT,MAAY,IAAI,CACvd,SAAS0zB,GAAG3mC,EAAErB,GAAG,IAAIG,EAAEmzB,GAAEA,IAAG,EAAE,IAAI,OAAOjyB,EAAErB,EAAE,CAAC,QAAY,KAAJszB,GAAEnzB,KAAUqiC,GAAGluB,KAAI,IAAIga,IAAIG,KAAK,CAAC,CAAC,SAASwZ,GAAG5mC,GAAG,OAAO8kC,IAAI,IAAIA,GAAGn+B,KAAK,KAAO,EAAFsrB,KAAM8T,KAAK,IAAIpnC,EAAEszB,GAAEA,IAAG,EAAE,IAAInzB,EAAEqlC,GAAGhsB,WAAWpZ,EAAEyW,GAAE,IAAI,GAAG2uB,GAAGhsB,WAAW,KAAK3C,GAAE,EAAExV,EAAE,OAAOA,GAAG,CAAC,QAAQwV,GAAEzW,EAAEolC,GAAGhsB,WAAWrZ,EAAM,KAAO,GAAXmzB,GAAEtzB,KAAayuB,IAAI,CAAC,CAAC,SAASgU,KAAKrD,GAAGD,GAAGxrB,QAAQyZ,GAAE+R,GAAG,CAChT,SAASoI,GAAGlmC,EAAErB,GAAGqB,EAAEumC,aAAa,KAAKvmC,EAAEwmC,cAAc,EAAE,IAAI1nC,EAAEkB,EAAE0mC,cAAiD,IAAlC,IAAI5nC,IAAIkB,EAAE0mC,eAAe,EAAEjc,GAAG3rB,IAAO,OAAOslC,GAAE,IAAItlC,EAAEslC,GAAEvyB,OAAO,OAAO/S,GAAG,CAAC,IAAIC,EAAED,EAAQ,OAANmvB,GAAGlvB,GAAUA,EAAE4H,KAAK,KAAK,EAA6B,QAA3B5H,EAAEA,EAAE5C,KAAKV,yBAA4B,IAASsD,GAAG0tB,KAAK,MAAM,KAAK,EAAEmJ,KAAK7J,GAAEI,IAAIJ,GAAEG,IAAGiK,KAAK,MAAM,KAAK,EAAEL,GAAG/2B,GAAG,MAAM,KAAK,EAAE62B,KAAK,MAAM,KAAK,GAAc,KAAK,GAAG7J,GAAEgK,IAAG,MAAM,KAAK,GAAGhG,GAAGhxB,EAAE5C,KAAK0K,UAAU,MAAM,KAAK,GAAG,KAAK,GAAGu6B,KAAKtiC,EAAEA,EAAE+S,MAAM,CAAqE,GAApE+mB,GAAE54B,EAAEokC,GAAEpkC,EAAE40B,GAAG50B,EAAEsS,QAAQ,MAAM+xB,GAAEtG,GAAGp/B,EAAEuiC,GAAE,EAAEoD,GAAG,KAAKE,GAAGD,GAAGlS,GAAG,EAAEqS,GAAGD,GAAG,KAAQ,OAAO7T,GAAG,CAAC,IAAIjyB,EAC1f,EAAEA,EAAEiyB,GAAGt0B,OAAOqC,IAAI,GAA2B,QAAhBI,GAARD,EAAE8xB,GAAGjyB,IAAOoyB,aAAqB,CAACjyB,EAAEiyB,YAAY,KAAK,IAAIryB,EAAEK,EAAE4xB,KAAK3xB,EAAEF,EAAE0yB,QAAQ,GAAG,OAAOxyB,EAAE,CAAC,IAAIC,EAAED,EAAE2xB,KAAK3xB,EAAE2xB,KAAKjyB,EAAEK,EAAE4xB,KAAK1xB,CAAC,CAACH,EAAE0yB,QAAQzyB,CAAC,CAAC6xB,GAAG,IAAI,CAAC,OAAO5wB,CAAC,CAC3K,SAASomC,GAAGpmC,EAAErB,GAAG,OAAE,CAAC,IAAIG,EAAEslC,GAAE,IAAuB,GAAnBtU,KAAKuG,GAAG/jB,QAAQglB,GAAMV,GAAG,CAAC,IAAI,IAAI73B,EAAE03B,GAAEzkB,cAAc,OAAOjT,GAAG,CAAC,IAAIL,EAAEK,EAAE24B,MAAM,OAAOh5B,IAAIA,EAAE8yB,QAAQ,MAAMzyB,EAAEA,EAAE4xB,IAAI,CAACiG,IAAG,CAAE,CAA4C,GAA3CJ,GAAG,EAAEG,GAAED,GAAED,GAAE,KAAKI,IAAG,EAAGC,GAAG,EAAEoN,GAAG5xB,QAAQ,KAAQ,OAAOxT,GAAG,OAAOA,EAAE+S,OAAO,CAACqvB,GAAE,EAAEoD,GAAG3lC,EAAEylC,GAAE,KAAK,KAAK,CAACpkC,EAAE,CAAC,IAAIhB,EAAEgB,EAAEf,EAAEH,EAAE+S,OAAO3S,EAAEJ,EAAEK,EAAER,EAAqB,GAAnBA,EAAE0lC,GAAEnlC,EAAE4S,OAAO,MAAS,OAAO3S,GAAG,kBAAkBA,GAAG,oBAAoBA,EAAE6rB,KAAK,CAAC,IAAI5rB,EAAED,EAAEE,EAAEH,EAAEM,EAAEH,EAAEsH,IAAI,GAAG,KAAY,EAAPtH,EAAE2vB,QAAU,IAAIxvB,GAAG,KAAKA,GAAG,KAAKA,GAAG,CAAC,IAAIC,EAAEJ,EAAEuS,UAAUnS,GAAGJ,EAAE8xB,YAAY1xB,EAAE0xB,YAAY9xB,EAAE2S,cAAcvS,EAAEuS,cACxe3S,EAAEixB,MAAM7wB,EAAE6wB,QAAQjxB,EAAE8xB,YAAY,KAAK9xB,EAAE2S,cAAc,KAAK,CAAC,IAAIlS,EAAEi9B,GAAG99B,GAAG,GAAG,OAAOa,EAAE,CAACA,EAAEgS,QAAQ,IAAIkrB,GAAGl9B,EAAEb,EAAEC,EAAEF,EAAEL,GAAU,EAAPmB,EAAEkvB,MAAQ4N,GAAG59B,EAAEI,EAAET,GAAOQ,EAAEC,EAAE,IAAIE,GAAZX,EAAEmB,GAAcqxB,YAAY,GAAG,OAAO7xB,EAAE,CAAC,IAAII,EAAE,IAAIuC,IAAIvC,EAAE2C,IAAIlD,GAAGR,EAAEwyB,YAAYzxB,CAAC,MAAMJ,EAAE+C,IAAIlD,GAAG,MAAMa,CAAC,CAAM,GAAG,KAAO,EAAFrB,GAAK,CAACi+B,GAAG59B,EAAEI,EAAET,GAAG4gC,KAAK,MAAMv/B,CAAC,CAACb,EAAE4G,MAAMxG,EAAE,KAAM,MAAM,GAAG6uB,IAAU,EAAPlvB,EAAE8vB,KAAO,CAAC,IAAIjG,EAAEgU,GAAG99B,GAAG,GAAG,OAAO8pB,EAAE,CAAC,KAAa,MAARA,EAAEjX,SAAeiX,EAAEjX,OAAO,KAAKkrB,GAAGjU,EAAE9pB,EAAEC,EAAEF,EAAEL,GAAG4wB,GAAGqM,GAAGz8B,EAAED,IAAI,MAAMc,CAAC,CAAC,CAAChB,EAAEG,EAAEy8B,GAAGz8B,EAAED,GAAG,IAAIgiC,KAAIA,GAAE,GAAG,OAAOuD,GAAGA,GAAG,CAACzlC,GAAGylC,GAAGl0B,KAAKvR,GAAGA,EAAEC,EAAE,EAAE,CAAC,OAAOD,EAAE2H,KAAK,KAAK,EAAE3H,EAAE8S,OAAO,MACpfnT,IAAIA,EAAEK,EAAEsxB,OAAO3xB,EAAkBwzB,GAAGnzB,EAAbq9B,GAAGr9B,EAAEG,EAAER,IAAW,MAAMqB,EAAE,KAAK,EAAEd,EAAEC,EAAE,IAAIS,EAAEZ,EAAE7C,KAAK8D,EAAEjB,EAAEoR,UAAU,GAAG,KAAa,IAARpR,EAAE8S,SAAa,oBAAoBlS,EAAE7D,0BAA0B,OAAOkE,GAAG,oBAAoBA,EAAEw8B,oBAAoB,OAAOC,KAAKA,GAAGpU,IAAIroB,KAAK,CAACjB,EAAE8S,OAAO,MAAMnT,IAAIA,EAAEK,EAAEsxB,OAAO3xB,EAAkBwzB,GAAGnzB,EAAbw9B,GAAGx9B,EAAEE,EAAEP,IAAW,MAAMqB,CAAC,EAAEhB,EAAEA,EAAE6S,MAAM,OAAO,OAAO7S,EAAE,CAAC6nC,GAAG/nC,EAAE,CAAC,MAAMwqB,GAAI3qB,EAAE2qB,EAAG8a,KAAItlC,GAAG,OAAOA,IAAIslC,GAAEtlC,EAAEA,EAAE+S,QAAQ,QAAQ,CAAC,KAAK,CAAS,CAAC,SAASo0B,KAAK,IAAIjmC,EAAEikC,GAAG3xB,QAAsB,OAAd2xB,GAAG3xB,QAAQglB,GAAU,OAAOt3B,EAAEs3B,GAAGt3B,CAAC,CACrd,SAASu/B,KAAQ,IAAI2B,IAAG,IAAIA,IAAG,IAAIA,KAAEA,GAAE,GAAE,OAAOtI,IAAG,KAAQ,UAAHvG,KAAe,KAAQ,UAAHkS,KAAea,GAAGxM,GAAEyL,GAAE,CAAC,SAAS2B,GAAGhmC,EAAErB,GAAG,IAAIG,EAAEmzB,GAAEA,IAAG,EAAE,IAAIlzB,EAAEknC,KAAqC,IAA7BrN,KAAI54B,GAAGqkC,KAAI1lC,IAAEimC,GAAG,KAAKsB,GAAGlmC,EAAErB,UAAUmoC,KAAK,KAAK,CAAC,MAAMpoC,GAAG0nC,GAAGpmC,EAAEtB,EAAE,CAAgC,GAAtBoxB,KAAKmC,GAAEnzB,EAAEmlC,GAAG3xB,QAAQvT,EAAK,OAAOqlC,GAAE,MAAMr+B,MAAMxG,EAAE,MAAiB,OAAXq5B,GAAE,KAAKyL,GAAE,EAASnD,EAAC,CAAC,SAAS4F,KAAK,KAAK,OAAO1C,IAAG2C,GAAG3C,GAAE,CAAC,SAAS+B,KAAK,KAAK,OAAO/B,KAAIvxB,MAAMk0B,GAAG3C,GAAE,CAAC,SAAS2C,GAAG/mC,GAAG,IAAIrB,EAAEmlC,GAAG9jC,EAAE4R,UAAU5R,EAAE+9B,IAAI/9B,EAAEovB,cAAcpvB,EAAE2uB,aAAa,OAAOhwB,EAAEkoC,GAAG7mC,GAAGokC,GAAEzlC,EAAEulC,GAAG5xB,QAAQ,IAAI,CAC1d,SAASu0B,GAAG7mC,GAAG,IAAIrB,EAAEqB,EAAE,EAAE,CAAC,IAAIlB,EAAEH,EAAEiT,UAAqB,GAAX5R,EAAErB,EAAEkT,OAAU,KAAa,MAARlT,EAAEmT,QAAc,GAAgB,QAAbhT,EAAEyhC,GAAGzhC,EAAEH,EAAEo/B,KAAkB,YAAJqG,GAAEtlC,OAAc,CAAW,GAAG,QAAbA,EAAEuiC,GAAGviC,EAAEH,IAAmC,OAAnBG,EAAEgT,OAAO,WAAMsyB,GAAEtlC,GAAS,GAAG,OAAOkB,EAAmE,OAAXkhC,GAAE,OAAEkD,GAAE,MAA5DpkC,EAAE8R,OAAO,MAAM9R,EAAE2/B,aAAa,EAAE3/B,EAAEyuB,UAAU,IAA4B,CAAa,GAAG,QAAf9vB,EAAEA,EAAE0T,SAAyB,YAAJ+xB,GAAEzlC,GAASylC,GAAEzlC,EAAEqB,CAAC,OAAO,OAAOrB,GAAG,IAAIuiC,KAAIA,GAAE,EAAE,CAAC,SAASuF,GAAGzmC,EAAErB,EAAEG,GAAG,IAAIC,EAAEyW,GAAE9W,EAAEylC,GAAGhsB,WAAW,IAAIgsB,GAAGhsB,WAAW,KAAK3C,GAAE,EAC3Y,SAAYxV,EAAErB,EAAEG,EAAEC,GAAG,GAAGgnC,WAAW,OAAOjB,IAAI,GAAG,KAAO,EAAF7S,IAAK,MAAMlsB,MAAMxG,EAAE,MAAMT,EAAEkB,EAAEumC,aAAa,IAAI7nC,EAAEsB,EAAEwmC,cAAc,GAAG,OAAO1nC,EAAE,OAAO,KAA2C,GAAtCkB,EAAEumC,aAAa,KAAKvmC,EAAEwmC,cAAc,EAAK1nC,IAAIkB,EAAEsS,QAAQ,MAAMvM,MAAMxG,EAAE,MAAMS,EAAEslC,aAAa,KAAKtlC,EAAE0lC,iBAAiB,EAAE,IAAI1mC,EAAEF,EAAEwxB,MAAMxxB,EAAEoxB,WAA8J,GA1NtT,SAAYlwB,EAAErB,GAAG,IAAIG,EAAEkB,EAAE4U,cAAcjW,EAAEqB,EAAE4U,aAAajW,EAAEqB,EAAE6U,eAAe,EAAE7U,EAAE8U,YAAY,EAAE9U,EAAEwlC,cAAc7mC,EAAEqB,EAAEgnC,kBAAkBroC,EAAEqB,EAAE+U,gBAAgBpW,EAAEA,EAAEqB,EAAEgV,cAAc,IAAIjW,EAAEiB,EAAEsV,WAAW,IAAItV,EAAEA,EAAEulC,gBAAgB,EAAEzmC,GAAG,CAAC,IAAIJ,EAAE,GAAGuV,GAAGnV,GAAGE,EAAE,GAAGN,EAAEC,EAAED,GAAG,EAAEK,EAAEL,IAAI,EAAEsB,EAAEtB,IAAI,EAAEI,IAAIE,CAAC,CAAC,CA0N5GioC,CAAGjnC,EAAEhB,GAAGgB,IAAI44B,KAAIwL,GAAExL,GAAE,KAAKyL,GAAE,GAAG,KAAoB,KAAfvlC,EAAE6gC,eAAoB,KAAa,KAAR7gC,EAAEgT,QAAa+yB,KAAKA,IAAG,EAAGgB,GAAGpyB,IAAG,WAAgB,OAALsyB,KAAY,IAAI,KAAI/mC,EAAE,KAAa,MAARF,EAAEgT,OAAgB,KAAoB,MAAfhT,EAAE6gC,eAAqB3gC,EAAE,CAACA,EAAEmlC,GAAGhsB,WAAWgsB,GAAGhsB,WAAW,KAChf,IAAIlZ,EAAEuW,GAAEA,GAAE,EAAE,IAAItW,EAAE+yB,GAAEA,IAAG,EAAEiS,GAAG5xB,QAAQ,KA1CpC,SAAYtS,EAAErB,GAAgB,GAAbwrB,GAAGlS,GAAasM,GAAVvkB,EAAEmkB,MAAc,CAAC,GAAG,mBAAmBnkB,EAAE,IAAIlB,EAAE,CAAC+lB,MAAM7kB,EAAE+kB,eAAeD,IAAI9kB,EAAEglB,mBAAmBhlB,EAAE,CAA8C,IAAIjB,GAAjDD,GAAGA,EAAEkB,EAAEgJ,gBAAgBlK,EAAEomB,aAAa3iB,QAAe4iB,cAAcrmB,EAAEqmB,eAAe,GAAGpmB,GAAG,IAAIA,EAAEsmB,WAAW,CAACvmB,EAAEC,EAAEumB,WAAW,IAAI5mB,EAAEK,EAAEwmB,aAAavmB,EAAED,EAAEymB,UAAUzmB,EAAEA,EAAE0mB,YAAY,IAAI3mB,EAAEiM,SAAS/L,EAAE+L,QAAQ,CAAC,MAAMie,GAAGlqB,EAAE,KAAK,MAAMkB,CAAC,CAAC,IAAIf,EAAE,EAAEC,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEG,EAAEQ,EAAEP,EAAE,KAAKd,EAAE,OAAO,CAAC,IAAI,IAAImB,EAAKN,IAAIV,GAAG,IAAIJ,GAAG,IAAIc,EAAEuL,WAAW7L,EAAED,EAAEP,GAAGc,IAAIR,GAAG,IAAID,GAAG,IAAIS,EAAEuL,WAAW5L,EAAEF,EAAEF,GAAG,IAAIS,EAAEuL,WAAW9L,GACnfO,EAAEwL,UAAU1O,QAAW,QAAQwD,EAAEN,EAAEgL,aAAkB/K,EAAED,EAAEA,EAAEM,EAAE,OAAO,CAAC,GAAGN,IAAIQ,EAAE,MAAMrB,EAA8C,GAA5Cc,IAAIX,KAAKM,IAAIV,IAAIQ,EAAED,GAAGQ,IAAIT,KAAKK,IAAIN,IAAII,EAAEF,GAAM,QAAQa,EAAEN,EAAEukB,aAAa,MAAUtkB,GAAJD,EAAEC,GAAMqQ,UAAU,CAACtQ,EAAEM,CAAC,CAAChB,GAAG,IAAII,IAAI,IAAIC,EAAE,KAAK,CAAC0lB,MAAM3lB,EAAE4lB,IAAI3lB,EAAE,MAAML,EAAE,IAAI,CAACA,EAAEA,GAAG,CAAC+lB,MAAM,EAAEC,IAAI,EAAE,MAAMhmB,EAAE,KAA+C,IAA1CsrB,GAAG,CAAC1F,YAAY1kB,EAAE2kB,eAAe7lB,GAAGmZ,IAAG,EAAOypB,GAAE/iC,EAAE,OAAO+iC,IAAG,GAAO1hC,GAAJrB,EAAE+iC,IAAMtvB,MAAM,KAAoB,KAAfzT,EAAEghC,eAAoB,OAAO3/B,EAAEA,EAAE6R,OAAOlT,EAAE+iC,GAAE1hC,OAAO,KAAK,OAAO0hC,IAAG,CAAC/iC,EAAE+iC,GAAE,IAAI,IAAIpiC,EAAEX,EAAEiT,UAAU,GAAG,KAAa,KAARjT,EAAEmT,OAAY,OAAOnT,EAAEgI,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GACvK,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,MAA3W,KAAK,EAAE,GAAG,OAAOrH,EAAE,CAAC,IAAII,EAAEJ,EAAE8vB,cAAcrG,EAAEzpB,EAAE0S,cAAcnS,EAAElB,EAAEyR,UAAUxQ,EAAEC,EAAEk0B,wBAAwBp1B,EAAE6vB,cAAc7vB,EAAExC,KAAKuD,EAAE+vB,GAAG9wB,EAAExC,KAAKuD,GAAGqpB,GAAGlpB,EAAE+jC,oCAAoChkC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAIK,EAAEtB,EAAEyR,UAAUkH,cAAc,IAAIrX,EAAE8K,SAAS9K,EAAE8J,YAAY,GAAG,IAAI9J,EAAE8K,UAAU9K,EAAE2kB,iBAAiB3kB,EAAEwK,YAAYxK,EAAE2kB,iBAAiB,MAAyC,QAAQ,MAAM7e,MAAMxG,EAAE,MAAO,CAAC,MAAMypB,GAAG4Y,GAAEjjC,EAAEA,EAAEkT,OAAOmX,EAAE,CAAa,GAAG,QAAfhpB,EAAErB,EAAE0T,SAAoB,CAACrS,EAAE6R,OAAOlT,EAAEkT,OAAO6vB,GAAE1hC,EAAE,KAAK,CAAC0hC,GAAE/iC,EAAEkT,MAAM,CAACvS,EAAEwiC,GAAGA,IAAG,CAAW,CAwCldoF,CAAGlnC,EAAElB,GAAGokC,GAAGpkC,EAAEkB,GAAGykB,GAAG2F,IAAInS,KAAKkS,GAAGC,GAAGD,GAAG,KAAKnqB,EAAEsS,QAAQxT,EAAE0kC,GAAG1kC,EAAEkB,EAAEtB,GAAGqU,KAAKkf,GAAE/yB,EAAEsW,GAAEvW,EAAEklC,GAAGhsB,WAAWnZ,CAAC,MAAMgB,EAAEsS,QAAQxT,EAAsF,GAApF+lC,KAAKA,IAAG,EAAGC,GAAG9kC,EAAE+kC,GAAGrmC,GAAGM,EAAEgB,EAAE4U,aAAa,IAAI5V,IAAI09B,GAAG,MAjOmJ,SAAY18B,GAAG,GAAGgU,IAAI,oBAAoBA,GAAGmzB,kBAAkB,IAAInzB,GAAGmzB,kBAAkBpzB,GAAG/T,OAAE,EAAO,OAAuB,IAAhBA,EAAEsS,QAAQR,OAAW,CAAC,MAAMnT,GAAG,CAAC,CAiOxRyoC,CAAGtoC,EAAEsR,WAAai1B,GAAGrlC,EAAEiT,MAAQ,OAAOtU,EAAE,IAAII,EAAEiB,EAAEqnC,mBAAmBvoC,EAAE,EAAEA,EAAEH,EAAErC,OAAOwC,IAAIJ,EAAEC,EAAEG,GAAGC,EAAEL,EAAEsJ,MAAM,CAAC20B,eAAej+B,EAAEsH,MAAM81B,OAAOp9B,EAAEo9B,SAAS,GAAGQ,GAAG,MAAMA,IAAG,EAAGt8B,EAAEu8B,GAAGA,GAAG,KAAKv8B,EAAE,KAAQ,EAAH+kC,KAAO,IAAI/kC,EAAE2G,KAAKo/B,KAAK/mC,EAAEgB,EAAE4U,aAAa,KAAO,EAAF5V,GAAKgB,IAAIilC,GAAGD,MAAMA,GAAG,EAAEC,GAAGjlC,GAAGglC,GAAG,EAAE5X,IAAgB,CAFxFka,CAAGtnC,EAAErB,EAAEG,EAAEC,EAAE,CAAC,QAAQolC,GAAGhsB,WAAWzZ,EAAE8W,GAAEzW,CAAC,CAAC,OAAO,IAAI,CAGhc,SAASgnC,KAAK,GAAG,OAAOjB,GAAG,CAAC,IAAI9kC,EAAEyV,GAAGsvB,IAAIpmC,EAAEwlC,GAAGhsB,WAAWrZ,EAAE0W,GAAE,IAAmC,GAA/B2uB,GAAGhsB,WAAW,KAAK3C,GAAE,GAAGxV,EAAE,GAAGA,EAAK,OAAO8kC,GAAG,IAAI/lC,GAAE,MAAO,CAAmB,GAAlBiB,EAAE8kC,GAAGA,GAAG,KAAKC,GAAG,EAAK,KAAO,EAAF9S,IAAK,MAAMlsB,MAAMxG,EAAE,MAAM,IAAIb,EAAEuzB,GAAO,IAALA,IAAG,EAAMyP,GAAE1hC,EAAEsS,QAAQ,OAAOovB,IAAG,CAAC,IAAI1iC,EAAE0iC,GAAEziC,EAAED,EAAEoT,MAAM,GAAG,KAAa,GAARsvB,GAAE5vB,OAAU,CAAC,IAAI5S,EAAEF,EAAEyvB,UAAU,GAAG,OAAOvvB,EAAE,CAAC,IAAI,IAAIC,EAAE,EAAEA,EAAED,EAAE5C,OAAO6C,IAAI,CAAC,IAAIC,EAAEF,EAAEC,GAAG,IAAIuiC,GAAEtiC,EAAE,OAAOsiC,IAAG,CAAC,IAAIriC,EAAEqiC,GAAE,OAAOriC,EAAEsH,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAGo7B,GAAG,EAAE1iC,EAAEL,GAAG,IAAIQ,EAAEH,EAAE+S,MAAM,GAAG,OAAO5S,EAAEA,EAAEqS,OAAOxS,EAAEqiC,GAAEliC,OAAO,KAAK,OAAOkiC,IAAG,CAAK,IAAIjiC,GAARJ,EAAEqiC,IAAUrvB,QAAQvS,EAAET,EAAEwS,OAAa,GAANqwB,GAAG7iC,GAAMA,IACnfD,EAAE,CAACsiC,GAAE,KAAK,KAAK,CAAC,GAAG,OAAOjiC,EAAE,CAACA,EAAEoS,OAAO/R,EAAE4hC,GAAEjiC,EAAE,KAAK,CAACiiC,GAAE5hC,CAAC,CAAC,CAAC,CAAC,IAAIR,EAAEN,EAAE4S,UAAU,GAAG,OAAOtS,EAAE,CAAC,IAAII,EAAEJ,EAAE8S,MAAM,GAAG,OAAO1S,EAAE,CAACJ,EAAE8S,MAAM,KAAK,EAAE,CAAC,IAAI2W,EAAErpB,EAAE2S,QAAQ3S,EAAE2S,QAAQ,KAAK3S,EAAEqpB,CAAC,OAAO,OAAOrpB,EAAE,CAAC,CAACgiC,GAAE1iC,CAAC,CAAC,CAAC,GAAG,KAAoB,KAAfA,EAAE2gC,eAAoB,OAAO1gC,EAAEA,EAAE4S,OAAO7S,EAAE0iC,GAAEziC,OAAON,EAAE,KAAK,OAAO+iC,IAAG,CAAK,GAAG,KAAa,MAApB1iC,EAAE0iC,IAAY5vB,OAAY,OAAO9S,EAAE2H,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAGo7B,GAAG,EAAE/iC,EAAEA,EAAE6S,QAAQ,IAAIhS,EAAEb,EAAEqT,QAAQ,GAAG,OAAOxS,EAAE,CAACA,EAAEgS,OAAO7S,EAAE6S,OAAO6vB,GAAE7hC,EAAE,MAAMlB,CAAC,CAAC+iC,GAAE1iC,EAAE6S,MAAM,CAAC,CAAC,IAAIjS,EAAEI,EAAEsS,QAAQ,IAAIovB,GAAE9hC,EAAE,OAAO8hC,IAAG,CAAK,IAAIzhC,GAARhB,EAAEyiC,IAAUtvB,MAAM,GAAG,KAAoB,KAAfnT,EAAE0gC,eAAoB,OAClf1/B,EAAEA,EAAE4R,OAAO5S,EAAEyiC,GAAEzhC,OAAOtB,EAAE,IAAIM,EAAEW,EAAE,OAAO8hC,IAAG,CAAK,GAAG,KAAa,MAApBxiC,EAAEwiC,IAAY5vB,OAAY,IAAI,OAAO5S,EAAEyH,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,GAAGq7B,GAAG,EAAE9iC,GAAG,CAAC,MAAMoqB,GAAIsY,GAAE1iC,EAAEA,EAAE2S,OAAOyX,EAAG,CAAC,GAAGpqB,IAAID,EAAE,CAACyiC,GAAE,KAAK,MAAM/iC,CAAC,CAAC,IAAIqqB,EAAE9pB,EAAEmT,QAAQ,GAAG,OAAO2W,EAAE,CAACA,EAAEnX,OAAO3S,EAAE2S,OAAO6vB,GAAE1Y,EAAE,MAAMrqB,CAAC,CAAC+iC,GAAExiC,EAAE2S,MAAM,CAAC,CAAU,GAATogB,GAAEvzB,EAAE0uB,KAAQpZ,IAAI,oBAAoBA,GAAGuzB,sBAAsB,IAAIvzB,GAAGuzB,sBAAsBxzB,GAAG/T,EAAE,CAAC,MAAMspB,GAAI,CAACvqB,GAAE,CAAE,CAAC,OAAOA,CAAC,CAAC,QAAQyW,GAAE1W,EAAEqlC,GAAGhsB,WAAWxZ,CAAC,CAAC,CAAC,OAAM,CAAE,CAAC,SAAS6oC,GAAGxnC,EAAErB,EAAEG,GAAyBkB,EAAEgyB,GAAGhyB,EAAjBrB,EAAE09B,GAAGr8B,EAAfrB,EAAEi9B,GAAG98B,EAAEH,GAAY,GAAY,GAAGA,EAAEo0B,KAAI,OAAO/yB,IAAIqV,GAAGrV,EAAE,EAAErB,GAAG0mC,GAAGrlC,EAAErB,GAAG,CACze,SAASijC,GAAE5hC,EAAErB,EAAEG,GAAG,GAAG,IAAIkB,EAAE2G,IAAI6gC,GAAGxnC,EAAEA,EAAElB,QAAQ,KAAK,OAAOH,GAAG,CAAC,GAAG,IAAIA,EAAEgI,IAAI,CAAC6gC,GAAG7oC,EAAEqB,EAAElB,GAAG,KAAK,CAAM,GAAG,IAAIH,EAAEgI,IAAI,CAAC,IAAI5H,EAAEJ,EAAEyR,UAAU,GAAG,oBAAoBzR,EAAExC,KAAKJ,0BAA0B,oBAAoBgD,EAAE09B,oBAAoB,OAAOC,KAAKA,GAAGpU,IAAIvpB,IAAI,CAAuBJ,EAAEqzB,GAAGrzB,EAAjBqB,EAAEw8B,GAAG79B,EAAfqB,EAAE47B,GAAG98B,EAAEkB,GAAY,GAAY,GAAGA,EAAE+yB,KAAI,OAAOp0B,IAAI0W,GAAG1W,EAAE,EAAEqB,GAAGqlC,GAAG1mC,EAAEqB,IAAI,KAAK,CAAC,CAACrB,EAAEA,EAAEkT,MAAM,CAAC,CACnV,SAASirB,GAAG98B,EAAErB,EAAEG,GAAG,IAAIC,EAAEiB,EAAE68B,UAAU,OAAO99B,GAAGA,EAAE2X,OAAO/X,GAAGA,EAAEo0B,KAAI/yB,EAAE8U,aAAa9U,EAAE6U,eAAe/V,EAAE85B,KAAI54B,IAAIqkC,GAAEvlC,KAAKA,IAAI,IAAIoiC,IAAG,IAAIA,KAAM,UAAFmD,MAAeA,IAAG,IAAIpxB,KAAIowB,GAAG6C,GAAGlmC,EAAE,GAAGwkC,IAAI1lC,GAAGumC,GAAGrlC,EAAErB,EAAE,CAAC,SAAS8oC,GAAGznC,EAAErB,GAAG,IAAIA,IAAI,KAAY,EAAPqB,EAAEgvB,MAAQrwB,EAAE,GAAGA,EAAE8V,GAAU,KAAQ,WAAfA,KAAK,MAAuBA,GAAG,WAAW,IAAI3V,EAAEi0B,KAAc,QAAV/yB,EAAEgxB,GAAGhxB,EAAErB,MAAc0W,GAAGrV,EAAErB,EAAEG,GAAGumC,GAAGrlC,EAAElB,GAAG,CAAC,SAAS0gC,GAAGx/B,GAAG,IAAIrB,EAAEqB,EAAEgS,cAAclT,EAAE,EAAE,OAAOH,IAAIG,EAAEH,EAAEmwB,WAAW2Y,GAAGznC,EAAElB,EAAE,CACjZ,SAASkkC,GAAGhjC,EAAErB,GAAG,IAAIG,EAAE,EAAE,OAAOkB,EAAE2G,KAAK,KAAK,GAAG,IAAI5H,EAAEiB,EAAEoQ,UAAc1R,EAAEsB,EAAEgS,cAAc,OAAOtT,IAAII,EAAEJ,EAAEowB,WAAW,MAAM,KAAK,GAAG/vB,EAAEiB,EAAEoQ,UAAU,MAAM,QAAQ,MAAMrK,MAAMxG,EAAE,MAAO,OAAOR,GAAGA,EAAE2X,OAAO/X,GAAG8oC,GAAGznC,EAAElB,EAAE,CAQqK,SAAS+mC,GAAG7lC,EAAErB,GAAG,OAAO8T,GAAGzS,EAAErB,EAAE,CACjZ,SAAS+oC,GAAG1nC,EAAErB,EAAEG,EAAEC,GAAGgE,KAAK4D,IAAI3G,EAAE+C,KAAKvE,IAAIM,EAAEiE,KAAKsP,QAAQtP,KAAKqP,MAAMrP,KAAK8O,OAAO9O,KAAKqN,UAAUrN,KAAK5G,KAAK4G,KAAKyrB,YAAY,KAAKzrB,KAAK4xB,MAAM,EAAE5xB,KAAKqxB,IAAI,KAAKrxB,KAAK4rB,aAAahwB,EAAEoE,KAAKqtB,aAAartB,KAAKiP,cAAcjP,KAAKouB,YAAYpuB,KAAKqsB,cAAc,KAAKrsB,KAAKisB,KAAKjwB,EAAEgE,KAAK48B,aAAa58B,KAAK+O,MAAM,EAAE/O,KAAK0rB,UAAU,KAAK1rB,KAAKmtB,WAAWntB,KAAKutB,MAAM,EAAEvtB,KAAK6O,UAAU,IAAI,CAAC,SAAS2c,GAAGvuB,EAAErB,EAAEG,EAAEC,GAAG,OAAO,IAAI2oC,GAAG1nC,EAAErB,EAAEG,EAAEC,EAAE,CAAC,SAASw+B,GAAGv9B,GAAiB,UAAdA,EAAEA,EAAEzD,aAAuByD,EAAE2nC,iBAAiB,CAEpd,SAAS/S,GAAG50B,EAAErB,GAAG,IAAIG,EAAEkB,EAAE4R,UACuB,OADb,OAAO9S,IAAGA,EAAEyvB,GAAGvuB,EAAE2G,IAAIhI,EAAEqB,EAAExB,IAAIwB,EAAEgvB,OAAQR,YAAYxuB,EAAEwuB,YAAY1vB,EAAE3C,KAAK6D,EAAE7D,KAAK2C,EAAEsR,UAAUpQ,EAAEoQ,UAAUtR,EAAE8S,UAAU5R,EAAEA,EAAE4R,UAAU9S,IAAIA,EAAE6vB,aAAahwB,EAAEG,EAAE3C,KAAK6D,EAAE7D,KAAK2C,EAAEgT,MAAM,EAAEhT,EAAE6gC,aAAa,EAAE7gC,EAAE2vB,UAAU,MAAM3vB,EAAEgT,MAAc,SAAR9R,EAAE8R,MAAehT,EAAEoxB,WAAWlwB,EAAEkwB,WAAWpxB,EAAEwxB,MAAMtwB,EAAEswB,MAAMxxB,EAAEsT,MAAMpS,EAAEoS,MAAMtT,EAAEswB,cAAcpvB,EAAEovB,cAActwB,EAAEkT,cAAchS,EAAEgS,cAAclT,EAAEqyB,YAAYnxB,EAAEmxB,YAAYxyB,EAAEqB,EAAEowB,aAAatxB,EAAEsxB,aAAa,OAAOzxB,EAAE,KAAK,CAAC2xB,MAAM3xB,EAAE2xB,MAAMD,aAAa1xB,EAAE0xB,cAC/evxB,EAAEuT,QAAQrS,EAAEqS,QAAQvT,EAAE61B,MAAM30B,EAAE20B,MAAM71B,EAAEs1B,IAAIp0B,EAAEo0B,IAAWt1B,CAAC,CACxD,SAASg2B,GAAG90B,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,GAAG,IAAIC,EAAE,EAAM,GAAJF,EAAEiB,EAAK,oBAAoBA,EAAEu9B,GAAGv9B,KAAKf,EAAE,QAAQ,GAAG,kBAAkBe,EAAEf,EAAE,OAAOe,EAAE,OAAOA,GAAG,KAAK8E,EAAG,OAAOmwB,GAAGn2B,EAAE6K,SAASjL,EAAEM,EAAEL,GAAG,KAAKoG,EAAG9F,EAAE,EAAEP,GAAG,EAAE,MAAM,KAAKsG,EAAG,OAAOhF,EAAEuuB,GAAG,GAAGzvB,EAAEH,EAAI,EAAFD,IAAO8vB,YAAYxpB,EAAGhF,EAAEswB,MAAMtxB,EAAEgB,EAAE,KAAKoF,EAAG,OAAOpF,EAAEuuB,GAAG,GAAGzvB,EAAEH,EAAED,IAAK8vB,YAAYppB,EAAGpF,EAAEswB,MAAMtxB,EAAEgB,EAAE,KAAKqF,EAAG,OAAOrF,EAAEuuB,GAAG,GAAGzvB,EAAEH,EAAED,IAAK8vB,YAAYnpB,EAAGrF,EAAEswB,MAAMtxB,EAAEgB,EAAE,KAAKwF,EAAG,OAAO05B,GAAGpgC,EAAEJ,EAAEM,EAAEL,GAAG,QAAQ,GAAG,kBAAkBqB,GAAG,OAAOA,EAAE,OAAOA,EAAEE,UAAU,KAAK+E,EAAGhG,EAAE,GAAG,MAAMe,EAAE,KAAKkF,EAAGjG,EAAE,EAAE,MAAMe,EAAE,KAAKmF,EAAGlG,EAAE,GACpf,MAAMe,EAAE,KAAKsF,EAAGrG,EAAE,GAAG,MAAMe,EAAE,KAAKuF,EAAGtG,EAAE,GAAGF,EAAE,KAAK,MAAMiB,EAAE,MAAM+F,MAAMxG,EAAE,IAAI,MAAMS,EAAEA,SAASA,EAAE,KAAuD,OAAjDrB,EAAE4vB,GAAGtvB,EAAEH,EAAEH,EAAED,IAAK8vB,YAAYxuB,EAAErB,EAAExC,KAAK4C,EAAEJ,EAAE2xB,MAAMtxB,EAASL,CAAC,CAAC,SAASs2B,GAAGj1B,EAAErB,EAAEG,EAAEC,GAA2B,OAAxBiB,EAAEuuB,GAAG,EAAEvuB,EAAEjB,EAAEJ,IAAK2xB,MAAMxxB,EAASkB,CAAC,CAAC,SAASk/B,GAAGl/B,EAAErB,EAAEG,EAAEC,GAAuE,OAApEiB,EAAEuuB,GAAG,GAAGvuB,EAAEjB,EAAEJ,IAAK6vB,YAAYhpB,EAAGxF,EAAEswB,MAAMxxB,EAAEkB,EAAEoQ,UAAU,CAACgzB,UAAS,GAAWpjC,CAAC,CAAC,SAAS60B,GAAG70B,EAAErB,EAAEG,GAA8B,OAA3BkB,EAAEuuB,GAAG,EAAEvuB,EAAE,KAAKrB,IAAK2xB,MAAMxxB,EAASkB,CAAC,CAC5W,SAASg1B,GAAGh1B,EAAErB,EAAEG,GAA8J,OAA3JH,EAAE4vB,GAAG,EAAE,OAAOvuB,EAAE2J,SAAS3J,EAAE2J,SAAS,GAAG3J,EAAExB,IAAIG,IAAK2xB,MAAMxxB,EAAEH,EAAEyR,UAAU,CAACkH,cAActX,EAAEsX,cAAcswB,gBAAgB,KAAK7S,eAAe/0B,EAAE+0B,gBAAuBp2B,CAAC,CACtL,SAASkpC,GAAG7nC,EAAErB,EAAEG,EAAEC,EAAEL,GAAGqE,KAAK4D,IAAIhI,EAAEoE,KAAKuU,cAActX,EAAE+C,KAAKwjC,aAAaxjC,KAAK85B,UAAU95B,KAAKuP,QAAQvP,KAAK6kC,gBAAgB,KAAK7kC,KAAK2jC,eAAe,EAAE3jC,KAAKuiC,aAAaviC,KAAKy7B,eAAez7B,KAAK0tB,QAAQ,KAAK1tB,KAAK2iC,iBAAiB,EAAE3iC,KAAKuS,WAAWF,GAAG,GAAGrS,KAAKwiC,gBAAgBnwB,IAAI,GAAGrS,KAAKgS,eAAehS,KAAKyjC,cAAczjC,KAAKikC,iBAAiBjkC,KAAKyiC,aAAaziC,KAAK+R,YAAY/R,KAAK8R,eAAe9R,KAAK6R,aAAa,EAAE7R,KAAKiS,cAAcI,GAAG,GAAGrS,KAAK44B,iBAAiB58B,EAAEgE,KAAKskC,mBAAmB3oC,EAAEqE,KAAK+kC,gCAC/e,IAAI,CAAC,SAASC,GAAG/nC,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,EAAEC,EAAEC,GAAgN,OAA7Ma,EAAE,IAAI6nC,GAAG7nC,EAAErB,EAAEG,EAAEI,EAAEC,GAAG,IAAIR,GAAGA,EAAE,GAAE,IAAKK,IAAIL,GAAG,IAAIA,EAAE,EAAEK,EAAEuvB,GAAG,EAAE,KAAK,KAAK5vB,GAAGqB,EAAEsS,QAAQtT,EAAEA,EAAEoR,UAAUpQ,EAAEhB,EAAEgT,cAAc,CAAC+T,QAAQhnB,EAAEsY,aAAavY,EAAEkpC,MAAM,KAAKnK,YAAY,KAAKoK,0BAA0B,MAAM/W,GAAGlyB,GAAUgB,CAAC,CACzP,SAASkoC,GAAGloC,GAAG,IAAIA,EAAE,OAAOisB,GAAuBjsB,EAAE,CAAC,GAAG2R,GAA1B3R,EAAEA,EAAE6yB,mBAA8B7yB,GAAG,IAAIA,EAAE2G,IAAI,MAAMZ,MAAMxG,EAAE,MAAM,IAAIZ,EAAEqB,EAAE,EAAE,CAAC,OAAOrB,EAAEgI,KAAK,KAAK,EAAEhI,EAAEA,EAAEyR,UAAUqgB,QAAQ,MAAMzwB,EAAE,KAAK,EAAE,GAAGwsB,GAAG7tB,EAAExC,MAAM,CAACwC,EAAEA,EAAEyR,UAAU0c,0CAA0C,MAAM9sB,CAAC,EAAErB,EAAEA,EAAEkT,MAAM,OAAO,OAAOlT,GAAG,MAAMoH,MAAMxG,EAAE,KAAM,CAAC,GAAG,IAAIS,EAAE2G,IAAI,CAAC,IAAI7H,EAAEkB,EAAE7D,KAAK,GAAGqwB,GAAG1tB,GAAG,OAAO6tB,GAAG3sB,EAAElB,EAAEH,EAAE,CAAC,OAAOA,CAAC,CACpW,SAASwpC,GAAGnoC,EAAErB,EAAEG,EAAEC,EAAEL,EAAEM,EAAEC,EAAEC,EAAEC,GAAwK,OAArKa,EAAE+nC,GAAGjpC,EAAEC,GAAE,EAAGiB,EAAEtB,EAAEM,EAAEC,EAAEC,EAAEC,IAAKsxB,QAAQyX,GAAG,MAAMppC,EAAEkB,EAAEsS,SAAsBtT,EAAE2yB,GAAhB5yB,EAAEg0B,KAAIr0B,EAAEs0B,GAAGl0B,KAAeizB,cAAS,IAASpzB,GAAG,OAAOA,EAAEA,EAAE,KAAKqzB,GAAGlzB,EAAEE,EAAEN,GAAGsB,EAAEsS,QAAQge,MAAM5xB,EAAE2W,GAAGrV,EAAEtB,EAAEK,GAAGsmC,GAAGrlC,EAAEjB,GAAUiB,CAAC,CAAC,SAASooC,GAAGpoC,EAAErB,EAAEG,EAAEC,GAAG,IAAIL,EAAEC,EAAE2T,QAAQtT,EAAE+zB,KAAI9zB,EAAE+zB,GAAGt0B,GAAsL,OAAnLI,EAAEopC,GAAGppC,GAAG,OAAOH,EAAE8xB,QAAQ9xB,EAAE8xB,QAAQ3xB,EAAEH,EAAE6/B,eAAe1/B,GAAEH,EAAEgzB,GAAG3yB,EAAEC,IAAK6yB,QAAQ,CAAC/L,QAAQ/lB,GAAuB,QAApBjB,OAAE,IAASA,EAAE,KAAKA,KAAaJ,EAAEozB,SAAShzB,GAAe,QAAZiB,EAAEgyB,GAAGtzB,EAAEC,EAAEM,MAAcg0B,GAAGjzB,EAAEtB,EAAEO,EAAED,GAAGkzB,GAAGlyB,EAAEtB,EAAEO,IAAWA,CAAC,CAC3b,SAASopC,GAAGroC,GAAe,OAAZA,EAAEA,EAAEsS,SAAcF,OAAyBpS,EAAEoS,MAAMzL,IAAoD3G,EAAEoS,MAAMhC,WAAhF,IAA0F,CAAC,SAASk4B,GAAGtoC,EAAErB,GAAqB,GAAG,QAArBqB,EAAEA,EAAEgS,gBAA2B,OAAOhS,EAAEiS,WAAW,CAAC,IAAInT,EAAEkB,EAAE8uB,UAAU9uB,EAAE8uB,UAAU,IAAIhwB,GAAGA,EAAEH,EAAEG,EAAEH,CAAC,CAAC,CAAC,SAAS4pC,GAAGvoC,EAAErB,GAAG2pC,GAAGtoC,EAAErB,IAAIqB,EAAEA,EAAE4R,YAAY02B,GAAGtoC,EAAErB,EAAE,CAnB7SmlC,GAAG,SAAS9jC,EAAErB,EAAEG,GAAG,GAAG,OAAOkB,EAAE,GAAGA,EAAEovB,gBAAgBzwB,EAAEgwB,cAAcxC,GAAG7Z,QAAQie,IAAG,MAAO,CAAC,GAAG,KAAKvwB,EAAEswB,MAAMxxB,IAAI,KAAa,IAARH,EAAEmT,OAAW,OAAOye,IAAG,EAzE1I,SAAYvwB,EAAErB,EAAEG,GAAG,OAAOH,EAAEgI,KAAK,KAAK,EAAE43B,GAAG5/B,GAAG2wB,KAAK,MAAM,KAAK,EAAEuG,GAAGl3B,GAAG,MAAM,KAAK,EAAE6tB,GAAG7tB,EAAExC,OAAO0wB,GAAGluB,GAAG,MAAM,KAAK,EAAE+2B,GAAG/2B,EAAEA,EAAEyR,UAAUkH,eAAe,MAAM,KAAK,GAAG,IAAIvY,EAAEJ,EAAExC,KAAK0K,SAASnI,EAAEC,EAAEywB,cAAcpnB,MAAMgkB,GAAE0D,GAAG3wB,EAAEixB,eAAejxB,EAAEixB,cAActxB,EAAE,MAAM,KAAK,GAAqB,GAAG,QAArBK,EAAEJ,EAAEqT,eAA2B,OAAG,OAAOjT,EAAEkT,YAAkB+Z,GAAE+J,GAAY,EAAVA,GAAEzjB,SAAW3T,EAAEmT,OAAO,IAAI,MAAQ,KAAKhT,EAAEH,EAAEyT,MAAM8d,YAAmB8O,GAAGh/B,EAAErB,EAAEG,IAAGktB,GAAE+J,GAAY,EAAVA,GAAEzjB,SAA8B,QAAnBtS,EAAEq9B,GAAGr9B,EAAErB,EAAEG,IAAmBkB,EAAEqS,QAAQ,MAAK2Z,GAAE+J,GAAY,EAAVA,GAAEzjB,SAAW,MAAM,KAAK,GAC7d,GADgevT,EAAE,KAAKD,EACrfH,EAAEuxB,YAAe,KAAa,IAARlwB,EAAE8R,OAAW,CAAC,GAAG/S,EAAE,OAAOqhC,GAAGpgC,EAAErB,EAAEG,GAAGH,EAAEmT,OAAO,GAAG,CAA6F,GAA1E,QAAlBpT,EAAEC,EAAEqT,iBAAyBtT,EAAEqhC,UAAU,KAAKrhC,EAAEwhC,KAAK,KAAKxhC,EAAEo6B,WAAW,MAAM9M,GAAE+J,GAAEA,GAAEzjB,SAAYvT,EAAE,MAAW,OAAO,KAAK,KAAK,GAAG,KAAK,GAAG,OAAOJ,EAAE2xB,MAAM,EAAEoN,GAAG19B,EAAErB,EAAEG,GAAG,OAAOu+B,GAAGr9B,EAAErB,EAAEG,EAAE,CAwE7G0pC,CAAGxoC,EAAErB,EAAEG,GAAGyxB,GAAG,KAAa,OAARvwB,EAAE8R,MAAmB,MAAMye,IAAG,EAAGnC,IAAG,KAAa,QAARzvB,EAAEmT,QAAgBic,GAAGpvB,EAAE6uB,GAAG7uB,EAAEg2B,OAAiB,OAAVh2B,EAAE2xB,MAAM,EAAS3xB,EAAEgI,KAAK,KAAK,EAAE,IAAI5H,EAAEJ,EAAExC,KAAK+hC,GAAGl+B,EAAErB,GAAGqB,EAAErB,EAAEgwB,aAAa,IAAIjwB,EAAE2tB,GAAG1tB,EAAEutB,GAAE5Z,SAAS6d,GAAGxxB,EAAEG,GAAGJ,EAAEw4B,GAAG,KAAKv4B,EAAEI,EAAEiB,EAAEtB,EAAEI,GAAG,IAAIE,EAAEu4B,KACvI,OAD4I54B,EAAEmT,OAAO,EAAE,kBAAkBpT,GAAG,OAAOA,GAAG,oBAAoBA,EAAEvB,aAAQ,IAASuB,EAAEwB,UAAUvB,EAAEgI,IAAI,EAAEhI,EAAEqT,cAAc,KAAKrT,EAAEwyB,YAC1e,KAAK3E,GAAGztB,IAAIC,GAAE,EAAG6tB,GAAGluB,IAAIK,GAAE,EAAGL,EAAEqT,cAAc,OAAOtT,EAAE80B,YAAO,IAAS90B,EAAE80B,MAAM90B,EAAE80B,MAAM,KAAKtC,GAAGvyB,GAAGD,EAAE+0B,QAAQd,GAAGh0B,EAAEyR,UAAU1R,EAAEA,EAAEm0B,gBAAgBl0B,EAAEk1B,GAAGl1B,EAAEI,EAAEiB,EAAElB,GAAGH,EAAE2/B,GAAG,KAAK3/B,EAAEI,GAAE,EAAGC,EAAEF,KAAKH,EAAEgI,IAAI,EAAEynB,IAAGpvB,GAAGgvB,GAAGrvB,GAAGw+B,GAAG,KAAKx+B,EAAED,EAAEI,GAAGH,EAAEA,EAAEyT,OAAczT,EAAE,KAAK,GAAGI,EAAEJ,EAAE6vB,YAAYxuB,EAAE,CAAqF,OAApFk+B,GAAGl+B,EAAErB,GAAGqB,EAAErB,EAAEgwB,aAAuB5vB,GAAVL,EAAEK,EAAEgI,OAAUhI,EAAE+H,UAAUnI,EAAExC,KAAK4C,EAAEL,EAAEC,EAAEgI,IAQtU,SAAY3G,GAAG,GAAG,oBAAoBA,EAAE,OAAOu9B,GAAGv9B,GAAG,EAAE,EAAE,QAAG,IAASA,GAAG,OAAOA,EAAE,CAAc,IAAbA,EAAEA,EAAEE,YAAgBiF,EAAG,OAAO,GAAG,GAAGnF,IAAIsF,EAAG,OAAO,EAAE,CAAC,OAAO,CAAC,CAR2LmjC,CAAG1pC,GAAGiB,EAAEyvB,GAAG1wB,EAAEiB,GAAUtB,GAAG,KAAK,EAAEC,EAAE8+B,GAAG,KAAK9+B,EAAEI,EAAEiB,EAAElB,GAAG,MAAMkB,EAAE,KAAK,EAAErB,EAAEs/B,GAAG,KAAKt/B,EAAEI,EAAEiB,EAAElB,GAAG,MAAMkB,EAAE,KAAK,GAAGrB,EAAEy+B,GAAG,KAAKz+B,EAAEI,EAAEiB,EAAElB,GAAG,MAAMkB,EAAE,KAAK,GAAGrB,EAAE2+B,GAAG,KAAK3+B,EAAEI,EAAE0wB,GAAG1wB,EAAE5C,KAAK6D,GAAGlB,GAAG,MAAMkB,EAAE,MAAM+F,MAAMxG,EAAE,IACvgBR,EAAE,IAAK,CAAC,OAAOJ,EAAE,KAAK,EAAE,OAAOI,EAAEJ,EAAExC,KAAKuC,EAAEC,EAAEgwB,aAA2C8O,GAAGz9B,EAAErB,EAAEI,EAArCL,EAAEC,EAAE6vB,cAAczvB,EAAEL,EAAE+wB,GAAG1wB,EAAEL,GAAcI,GAAG,KAAK,EAAE,OAAOC,EAAEJ,EAAExC,KAAKuC,EAAEC,EAAEgwB,aAA2CsP,GAAGj+B,EAAErB,EAAEI,EAArCL,EAAEC,EAAE6vB,cAAczvB,EAAEL,EAAE+wB,GAAG1wB,EAAEL,GAAcI,GAAG,KAAK,EAAEkB,EAAE,CAAO,GAANu+B,GAAG5/B,GAAM,OAAOqB,EAAE,MAAM+F,MAAMxG,EAAE,MAAMR,EAAEJ,EAAEgwB,aAA+BjwB,GAAlBM,EAAEL,EAAEqT,eAAkB+T,QAAQ2L,GAAG1xB,EAAErB,GAAGyzB,GAAGzzB,EAAEI,EAAE,KAAKD,GAAG,IAAIG,EAAEN,EAAEqT,cAA0B,GAAZjT,EAAEE,EAAE8mB,QAAW/mB,EAAEqY,aAAY,CAAC,GAAGrY,EAAE,CAAC+mB,QAAQhnB,EAAEsY,cAAa,EAAG2wB,MAAM/oC,EAAE+oC,MAAMC,0BAA0BhpC,EAAEgpC,0BAA0BpK,YAAY5+B,EAAE4+B,aAAal/B,EAAEwyB,YAAYC,UAChfpyB,EAAEL,EAAEqT,cAAchT,EAAU,IAARL,EAAEmT,MAAU,CAAuBnT,EAAE8/B,GAAGz+B,EAAErB,EAAEI,EAAED,EAAjCJ,EAAEk9B,GAAG71B,MAAMxG,EAAE,MAAMZ,IAAmB,MAAMqB,CAAC,CAAM,GAAGjB,IAAIL,EAAE,CAAuBC,EAAE8/B,GAAGz+B,EAAErB,EAAEI,EAAED,EAAjCJ,EAAEk9B,GAAG71B,MAAMxG,EAAE,MAAMZ,IAAmB,MAAMqB,CAAC,CAAM,IAAImuB,GAAG/C,GAAGzsB,EAAEyR,UAAUkH,cAAc9M,YAAY0jB,GAAGvvB,EAAEyvB,IAAE,EAAGC,GAAG,KAAKvvB,EAAEs2B,GAAGz2B,EAAE,KAAKI,EAAED,GAAGH,EAAEyT,MAAMtT,EAAEA,GAAGA,EAAEgT,OAAe,EAAThT,EAAEgT,MAAS,KAAKhT,EAAEA,EAAEuT,OAAQ,KAAI,CAAM,GAALid,KAAQvwB,IAAIL,EAAE,CAACC,EAAE0+B,GAAGr9B,EAAErB,EAAEG,GAAG,MAAMkB,CAAC,CAACm9B,GAAGn9B,EAAErB,EAAEI,EAAED,EAAE,CAACH,EAAEA,EAAEyT,KAAK,CAAC,OAAOzT,EAAE,KAAK,EAAE,OAAOk3B,GAAGl3B,GAAG,OAAOqB,GAAGivB,GAAGtwB,GAAGI,EAAEJ,EAAExC,KAAKuC,EAAEC,EAAEgwB,aAAa3vB,EAAE,OAAOgB,EAAEA,EAAEovB,cAAc,KAAKnwB,EAAEP,EAAEiL,SAAS0gB,GAAGtrB,EAAEL,GAAGO,EAAE,KAAK,OAAOD,GAAGqrB,GAAGtrB,EAAEC,KAAKL,EAAEmT,OAAO,IACnfksB,GAAGh+B,EAAErB,GAAGw+B,GAAGn9B,EAAErB,EAAEM,EAAEH,GAAGH,EAAEyT,MAAM,KAAK,EAAE,OAAO,OAAOpS,GAAGivB,GAAGtwB,GAAG,KAAK,KAAK,GAAG,OAAOqgC,GAAGh/B,EAAErB,EAAEG,GAAG,KAAK,EAAE,OAAO42B,GAAG/2B,EAAEA,EAAEyR,UAAUkH,eAAevY,EAAEJ,EAAEgwB,aAAa,OAAO3uB,EAAErB,EAAEyT,MAAM+iB,GAAGx2B,EAAE,KAAKI,EAAED,GAAGq+B,GAAGn9B,EAAErB,EAAEI,EAAED,GAAGH,EAAEyT,MAAM,KAAK,GAAG,OAAOrT,EAAEJ,EAAExC,KAAKuC,EAAEC,EAAEgwB,aAA2CyO,GAAGp9B,EAAErB,EAAEI,EAArCL,EAAEC,EAAE6vB,cAAczvB,EAAEL,EAAE+wB,GAAG1wB,EAAEL,GAAcI,GAAG,KAAK,EAAE,OAAOq+B,GAAGn9B,EAAErB,EAAEA,EAAEgwB,aAAa7vB,GAAGH,EAAEyT,MAAM,KAAK,EAAmD,KAAK,GAAG,OAAO+qB,GAAGn9B,EAAErB,EAAEA,EAAEgwB,aAAahlB,SAAS7K,GAAGH,EAAEyT,MAAM,KAAK,GAAGpS,EAAE,CACxZ,GADyZjB,EAAEJ,EAAExC,KAAK0K,SAASnI,EAAEC,EAAEgwB,aAAa3vB,EAAEL,EAAEywB,cAClfnwB,EAAEP,EAAEsJ,MAAMgkB,GAAE0D,GAAG3wB,EAAEixB,eAAejxB,EAAEixB,cAAc/wB,EAAK,OAAOD,EAAE,GAAGykB,GAAGzkB,EAAEgJ,MAAM/I,IAAI,GAAGD,EAAE2K,WAAWjL,EAAEiL,WAAWwiB,GAAG7Z,QAAQ,CAAC3T,EAAE0+B,GAAGr9B,EAAErB,EAAEG,GAAG,MAAMkB,CAAC,OAAO,IAAc,QAAVhB,EAAEL,EAAEyT,SAAiBpT,EAAE6S,OAAOlT,GAAG,OAAOK,GAAG,CAAC,IAAIE,EAAEF,EAAEoxB,aAAa,GAAG,OAAOlxB,EAAE,CAACD,EAAED,EAAEoT,MAAM,IAAI,IAAIjT,EAAED,EAAEmxB,aAAa,OAAOlxB,GAAG,CAAC,GAAGA,EAAEsxB,UAAU1xB,EAAE,CAAC,GAAG,IAAIC,EAAE2H,IAAI,EAACxH,EAAEwyB,IAAI,EAAE7yB,GAAGA,IAAK6H,IAAI,EAAE,IAAIvH,EAAEJ,EAAEmyB,YAAY,GAAG,OAAO/xB,EAAE,CAAY,IAAIC,GAAfD,EAAEA,EAAEmyB,QAAeC,QAAQ,OAAOnyB,EAAEF,EAAEwxB,KAAKxxB,GAAGA,EAAEwxB,KAAKtxB,EAAEsxB,KAAKtxB,EAAEsxB,KAAKxxB,GAAGC,EAAEoyB,QAAQryB,CAAC,CAAC,CAACH,EAAEsxB,OAAOxxB,EAAgB,QAAdK,EAAEH,EAAE4S,aAAqBzS,EAAEmxB,OAAOxxB,GAAGmxB,GAAGjxB,EAAE6S,OAClf/S,EAAEH,GAAGO,EAAEoxB,OAAOxxB,EAAE,KAAK,CAACK,EAAEA,EAAEwxB,IAAI,CAAC,MAAM,GAAG,KAAK3xB,EAAE2H,IAAI1H,EAAED,EAAE7C,OAAOwC,EAAExC,KAAK,KAAK6C,EAAEoT,WAAW,GAAG,KAAKpT,EAAE2H,IAAI,CAAY,GAAG,QAAd1H,EAAED,EAAE6S,QAAmB,MAAM9L,MAAMxG,EAAE,MAAMN,EAAEqxB,OAAOxxB,EAAgB,QAAdI,EAAED,EAAE2S,aAAqB1S,EAAEoxB,OAAOxxB,GAAGmxB,GAAGhxB,EAAEH,EAAEH,GAAGM,EAAED,EAAEqT,OAAO,MAAMpT,EAAED,EAAEoT,MAAM,GAAG,OAAOnT,EAAEA,EAAE4S,OAAO7S,OAAO,IAAIC,EAAED,EAAE,OAAOC,GAAG,CAAC,GAAGA,IAAIN,EAAE,CAACM,EAAE,KAAK,KAAK,CAAa,GAAG,QAAfD,EAAEC,EAAEoT,SAAoB,CAACrT,EAAE6S,OAAO5S,EAAE4S,OAAO5S,EAAED,EAAE,KAAK,CAACC,EAAEA,EAAE4S,MAAM,CAAC7S,EAAEC,CAAC,CAACk+B,GAAGn9B,EAAErB,EAAED,EAAEiL,SAAS7K,GAAGH,EAAEA,EAAEyT,KAAK,CAAC,OAAOzT,EAAE,KAAK,EAAE,OAAOD,EAAEC,EAAExC,KAAK4C,EAAEJ,EAAEgwB,aAAahlB,SAASwmB,GAAGxxB,EAAEG,GAAWC,EAAEA,EAAVL,EAAE8xB,GAAG9xB,IAAUC,EAAEmT,OAAO,EAAEqrB,GAAGn9B,EAAErB,EAAEI,EAAED,GACpfH,EAAEyT,MAAM,KAAK,GAAG,OAAgB1T,EAAE+wB,GAAX1wB,EAAEJ,EAAExC,KAAYwC,EAAEgwB,cAA6B2O,GAAGt9B,EAAErB,EAAEI,EAAtBL,EAAE+wB,GAAG1wB,EAAE5C,KAAKuC,GAAcI,GAAG,KAAK,GAAG,OAAO0+B,GAAGx9B,EAAErB,EAAEA,EAAExC,KAAKwC,EAAEgwB,aAAa7vB,GAAG,KAAK,GAAG,OAAOC,EAAEJ,EAAExC,KAAKuC,EAAEC,EAAEgwB,aAAajwB,EAAEC,EAAE6vB,cAAczvB,EAAEL,EAAE+wB,GAAG1wB,EAAEL,GAAGw/B,GAAGl+B,EAAErB,GAAGA,EAAEgI,IAAI,EAAE6lB,GAAGztB,IAAIiB,GAAE,EAAG6sB,GAAGluB,IAAIqB,GAAE,EAAGmwB,GAAGxxB,EAAEG,GAAGy0B,GAAG50B,EAAEI,EAAEL,GAAGm1B,GAAGl1B,EAAEI,EAAEL,EAAEI,GAAGw/B,GAAG,KAAK3/B,EAAEI,GAAE,EAAGiB,EAAElB,GAAG,KAAK,GAAG,OAAOshC,GAAGpgC,EAAErB,EAAEG,GAAG,KAAK,GAAG,OAAO4+B,GAAG19B,EAAErB,EAAEG,GAAG,MAAMiH,MAAMxG,EAAE,IAAIZ,EAAEgI,KAAM,EAYxC,IAAI+hC,GAAG,oBAAoBC,YAAYA,YAAY,SAAS3oC,GAAGi8B,QAAQC,MAAMl8B,EAAE,EAAE,SAAS4oC,GAAG5oC,GAAG+C,KAAK8lC,cAAc7oC,CAAC,CACjI,SAAS8oC,GAAG9oC,GAAG+C,KAAK8lC,cAAc7oC,CAAC,CAC5J,SAAS+oC,GAAG/oC,GAAG,SAASA,GAAG,IAAIA,EAAE+K,UAAU,IAAI/K,EAAE+K,UAAU,KAAK/K,EAAE+K,SAAS,CAAC,SAASi+B,GAAGhpC,GAAG,SAASA,GAAG,IAAIA,EAAE+K,UAAU,IAAI/K,EAAE+K,UAAU,KAAK/K,EAAE+K,WAAW,IAAI/K,EAAE+K,UAAU,iCAAiC/K,EAAEgL,WAAW,CAAC,SAASi+B,KAAK,CAExa,SAASC,GAAGlpC,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,IAAIM,EAAEF,EAAEyjC,oBAAoB,GAAGvjC,EAAE,CAAC,IAAIC,EAAED,EAAE,GAAG,oBAAoBN,EAAE,CAAC,IAAIQ,EAAER,EAAEA,EAAE,WAAW,IAAIsB,EAAEqoC,GAAGppC,GAAGC,EAAEgF,KAAKlE,EAAE,CAAC,CAACooC,GAAGzpC,EAAEM,EAAEe,EAAEtB,EAAE,MAAMO,EADxJ,SAAYe,EAAErB,EAAEG,EAAEC,EAAEL,GAAG,GAAGA,EAAE,CAAC,GAAG,oBAAoBK,EAAE,CAAC,IAAIC,EAAED,EAAEA,EAAE,WAAW,IAAIiB,EAAEqoC,GAAGppC,GAAGD,EAAEkF,KAAKlE,EAAE,CAAC,CAAC,IAAIf,EAAEkpC,GAAGxpC,EAAEI,EAAEiB,EAAE,EAAE,MAAK,EAAG,EAAG,GAAGipC,IAAmF,OAA/EjpC,EAAEuiC,oBAAoBtjC,EAAEe,EAAEkpB,IAAIjqB,EAAEqT,QAAQqW,GAAG,IAAI3oB,EAAE+K,SAAS/K,EAAE8P,WAAW9P,GAAG4mC,KAAY3nC,CAAC,CAAC,KAAKP,EAAEsB,EAAE8K,WAAW9K,EAAEyK,YAAY/L,GAAG,GAAG,oBAAoBK,EAAE,CAAC,IAAIG,EAAEH,EAAEA,EAAE,WAAW,IAAIiB,EAAEqoC,GAAGlpC,GAAGD,EAAEgF,KAAKlE,EAAE,CAAC,CAAC,IAAIb,EAAE4oC,GAAG/nC,EAAE,GAAE,EAAG,KAAK,GAAK,EAAG,EAAG,GAAGipC,IAA0G,OAAtGjpC,EAAEuiC,oBAAoBpjC,EAAEa,EAAEkpB,IAAI/pB,EAAEmT,QAAQqW,GAAG,IAAI3oB,EAAE+K,SAAS/K,EAAE8P,WAAW9P,GAAG4mC,IAAG,WAAWwB,GAAGzpC,EAAEQ,EAAEL,EAAEC,EAAE,IAAUI,CAAC,CACpUgqC,CAAGrqC,EAAEH,EAAEqB,EAAEtB,EAAEK,GAAG,OAAOspC,GAAGppC,EAAE,CAHpL6pC,GAAGvsC,UAAUY,OAAOyrC,GAAGrsC,UAAUY,OAAO,SAAS6C,GAAG,IAAIrB,EAAEoE,KAAK8lC,cAAc,GAAG,OAAOlqC,EAAE,MAAMoH,MAAMxG,EAAE,MAAM6oC,GAAGpoC,EAAErB,EAAE,KAAK,KAAK,EAAEmqC,GAAGvsC,UAAU6sC,QAAQR,GAAGrsC,UAAU6sC,QAAQ,WAAW,IAAIppC,EAAE+C,KAAK8lC,cAAc,GAAG,OAAO7oC,EAAE,CAAC+C,KAAK8lC,cAAc,KAAK,IAAIlqC,EAAEqB,EAAEsX,cAAcsvB,IAAG,WAAWwB,GAAG,KAAKpoC,EAAE,KAAK,KAAK,IAAGrB,EAAEuqB,IAAI,IAAI,CAAC,EACzT4f,GAAGvsC,UAAU8sC,2BAA2B,SAASrpC,GAAG,GAAGA,EAAE,CAAC,IAAIrB,EAAEkX,KAAK7V,EAAE,CAAC8W,UAAU,KAAKnH,OAAO3P,EAAEoX,SAASzY,GAAG,IAAI,IAAIG,EAAE,EAAEA,EAAEyX,GAAGja,QAAQ,IAAIqC,GAAGA,EAAE4X,GAAGzX,GAAGsY,SAAStY,KAAKyX,GAAG+yB,OAAOxqC,EAAE,EAAEkB,GAAG,IAAIlB,GAAGoY,GAAGlX,EAAE,CAAC,EAEX0V,GAAG,SAAS1V,GAAG,OAAOA,EAAE2G,KAAK,KAAK,EAAE,IAAIhI,EAAEqB,EAAEoQ,UAAU,GAAGzR,EAAE2T,QAAQN,cAAcqF,aAAa,CAAC,IAAIvY,EAAE4V,GAAG/V,EAAEiW,cAAc,IAAI9V,IAAIyW,GAAG5W,EAAI,EAAFG,GAAKumC,GAAG1mC,EAAEsU,MAAK,KAAO,EAAFgf,MAAOkP,GAAGluB,KAAI,IAAIma,MAAM,CAAC,MAAM,KAAK,GAAGwZ,IAAG,WAAW,IAAIjoC,EAAEqyB,GAAGhxB,EAAE,GAAG,GAAG,OAAOrB,EAAE,CAAC,IAAIG,EAAEi0B,KAAIE,GAAGt0B,EAAEqB,EAAE,EAAElB,EAAE,CAAC,IAAGypC,GAAGvoC,EAAE,GAAG,EAC/b2V,GAAG,SAAS3V,GAAG,GAAG,KAAKA,EAAE2G,IAAI,CAAC,IAAIhI,EAAEqyB,GAAGhxB,EAAE,WAAW,GAAG,OAAOrB,EAAas0B,GAAGt0B,EAAEqB,EAAE,UAAX+yB,MAAwBwV,GAAGvoC,EAAE,UAAU,CAAC,EAAE4V,GAAG,SAAS5V,GAAG,GAAG,KAAKA,EAAE2G,IAAI,CAAC,IAAIhI,EAAEq0B,GAAGhzB,GAAGlB,EAAEkyB,GAAGhxB,EAAErB,GAAG,GAAG,OAAOG,EAAam0B,GAAGn0B,EAAEkB,EAAErB,EAAXo0B,MAAgBwV,GAAGvoC,EAAErB,EAAE,CAAC,EAAEkX,GAAG,WAAW,OAAOL,EAAC,EAAEM,GAAG,SAAS9V,EAAErB,GAAG,IAAIG,EAAE0W,GAAE,IAAI,OAAOA,GAAExV,EAAErB,GAAG,CAAC,QAAQ6W,GAAE1W,CAAC,CAAC,EAClSiR,GAAG,SAAS/P,EAAErB,EAAEG,GAAG,OAAOH,GAAG,IAAK,QAAyB,GAAjBkK,EAAG7I,EAAElB,GAAGH,EAAEG,EAAEzC,KAAQ,UAAUyC,EAAE3C,MAAM,MAAMwC,EAAE,CAAC,IAAIG,EAAEkB,EAAElB,EAAEgR,YAAYhR,EAAEA,EAAEgR,WAAsF,IAA3EhR,EAAEA,EAAEyqC,iBAAiB,cAAcC,KAAKC,UAAU,GAAG9qC,GAAG,mBAAuBA,EAAE,EAAEA,EAAEG,EAAExC,OAAOqC,IAAI,CAAC,IAAII,EAAED,EAAEH,GAAG,GAAGI,IAAIiB,GAAGjB,EAAE2qC,OAAO1pC,EAAE0pC,KAAK,CAAC,IAAIhrC,EAAE2R,GAAGtR,GAAG,IAAIL,EAAE,MAAMqH,MAAMxG,EAAE,KAAKuI,EAAG/I,GAAG8J,EAAG9J,EAAEL,EAAE,CAAC,CAAC,CAAC,MAAM,IAAK,WAAWmL,GAAG7J,EAAElB,GAAG,MAAM,IAAK,SAAmB,OAAVH,EAAEG,EAAEkJ,QAAeoB,GAAGpJ,IAAIlB,EAAE4hC,SAAS/hC,GAAE,GAAI,EAAE8R,GAAGk2B,GAAGj2B,GAAGk2B,GACpa,IAAI+C,GAAG,CAACC,uBAAsB,EAAGC,OAAO,CAAC15B,GAAGuS,GAAGrS,GAAGC,GAAGE,GAAGm2B,KAAKmD,GAAG,CAACC,wBAAwB5yB,GAAG6yB,WAAW,EAAEC,QAAQ,SAASC,oBAAoB,aAC1IC,GAAG,CAACH,WAAWF,GAAGE,WAAWC,QAAQH,GAAGG,QAAQC,oBAAoBJ,GAAGI,oBAAoBE,eAAeN,GAAGM,eAAeC,kBAAkB,KAAKC,4BAA4B,KAAKC,4BAA4B,KAAKC,cAAc,KAAKC,wBAAwB,KAAKC,wBAAwB,KAAKC,gBAAgB,KAAKC,mBAAmB,KAAKC,eAAe,KAAKC,qBAAqBpmC,EAAG4xB,uBAAuByU,wBAAwB,SAAS/qC,GAAW,OAAO,QAAfA,EAAEmS,GAAGnS,IAAmB,KAAKA,EAAEoQ,SAAS,EAAE25B,wBAAwBD,GAAGC,yBARjN,WAAc,OAAO,IAAI,EASpUiB,4BAA4B,KAAKC,gBAAgB,KAAKC,aAAa,KAAKC,kBAAkB,KAAKC,gBAAgB,KAAKC,kBAAkB,kCAAkC,GAAG,qBAAqBC,+BAA+B,CAAC,IAAIC,GAAGD,+BAA+B,IAAIC,GAAGC,YAAYD,GAAGE,cAAc,IAAI13B,GAAGw3B,GAAGG,OAAOvB,IAAIn2B,GAAGu3B,EAAE,CAAC,MAAMvrC,IAAG,CAAC,CAACnC,EAAQ8G,mDAAmDglC,GAC9Y9rC,EAAQ8tC,aAAa,SAAS3rC,EAAErB,GAAG,IAAIG,EAAE,EAAEpC,UAAUJ,aAAQ,IAASI,UAAU,GAAGA,UAAU,GAAG,KAAK,IAAIqsC,GAAGpqC,GAAG,MAAMoH,MAAMxG,EAAE,MAAM,OAbuH,SAAYS,EAAErB,EAAEG,GAAG,IAAIC,EAAE,EAAErC,UAAUJ,aAAQ,IAASI,UAAU,GAAGA,UAAU,GAAG,KAAK,MAAM,CAACwD,SAAS2E,EAAGrG,IAAI,MAAMO,EAAE,KAAK,GAAGA,EAAE4K,SAAS3J,EAAEsX,cAAc3Y,EAAEo2B,eAAej2B,EAAE,CAa1R8sC,CAAG5rC,EAAErB,EAAE,KAAKG,EAAE,EAAEjB,EAAQguC,WAAW,SAAS7rC,EAAErB,GAAG,IAAIoqC,GAAG/oC,GAAG,MAAM+F,MAAMxG,EAAE,MAAM,IAAIT,GAAE,EAAGC,EAAE,GAAGL,EAAEgqC,GAA4P,OAAzP,OAAO/pC,QAAG,IAASA,KAAI,IAAKA,EAAEmtC,sBAAsBhtC,GAAE,QAAI,IAASH,EAAEg9B,mBAAmB58B,EAAEJ,EAAEg9B,uBAAkB,IAASh9B,EAAE0oC,qBAAqB3oC,EAAEC,EAAE0oC,qBAAqB1oC,EAAEopC,GAAG/nC,EAAE,GAAE,EAAG,KAAK,EAAKlB,EAAE,EAAGC,EAAEL,GAAGsB,EAAEkpB,IAAIvqB,EAAE2T,QAAQqW,GAAG,IAAI3oB,EAAE+K,SAAS/K,EAAE8P,WAAW9P,GAAU,IAAI4oC,GAAGjqC,EAAE,EACrfd,EAAQkuC,YAAY,SAAS/rC,GAAG,GAAG,MAAMA,EAAE,OAAO,KAAK,GAAG,IAAIA,EAAE+K,SAAS,OAAO/K,EAAE,IAAIrB,EAAEqB,EAAE6yB,gBAAgB,QAAG,IAASl0B,EAAE,CAAC,GAAG,oBAAoBqB,EAAE7C,OAAO,MAAM4I,MAAMxG,EAAE,MAAiC,MAA3BS,EAAE1C,OAAOa,KAAK6B,GAAGw0B,KAAK,KAAWzuB,MAAMxG,EAAE,IAAIS,GAAI,CAAqC,OAA5BA,EAAE,QAAVA,EAAEmS,GAAGxT,IAAc,KAAKqB,EAAEoQ,SAAkB,EAAEvS,EAAQmuC,UAAU,SAAShsC,GAAG,OAAO4mC,GAAG5mC,EAAE,EAAEnC,EAAQouC,QAAQ,SAASjsC,EAAErB,EAAEG,GAAG,IAAIkqC,GAAGrqC,GAAG,MAAMoH,MAAMxG,EAAE,MAAM,OAAO2pC,GAAG,KAAKlpC,EAAErB,GAAE,EAAGG,EAAE,EAC/YjB,EAAQquC,YAAY,SAASlsC,EAAErB,EAAEG,GAAG,IAAIiqC,GAAG/oC,GAAG,MAAM+F,MAAMxG,EAAE,MAAM,IAAIR,EAAE,MAAMD,GAAGA,EAAEqtC,iBAAiB,KAAKztC,GAAE,EAAGM,EAAE,GAAGC,EAAEypC,GAAyO,GAAtO,OAAO5pC,QAAG,IAASA,KAAI,IAAKA,EAAEgtC,sBAAsBptC,GAAE,QAAI,IAASI,EAAE68B,mBAAmB38B,EAAEF,EAAE68B,uBAAkB,IAAS78B,EAAEuoC,qBAAqBpoC,EAAEH,EAAEuoC,qBAAqB1oC,EAAEwpC,GAAGxpC,EAAE,KAAKqB,EAAE,EAAE,MAAMlB,EAAEA,EAAE,KAAKJ,EAAE,EAAGM,EAAEC,GAAGe,EAAEkpB,IAAIvqB,EAAE2T,QAAQqW,GAAG3oB,GAAMjB,EAAE,IAAIiB,EAAE,EAAEA,EAAEjB,EAAEzC,OAAO0D,IAA2BtB,GAAhBA,GAAPI,EAAEC,EAAEiB,IAAOosC,aAAgBttC,EAAEutC,SAAS,MAAM1tC,EAAEmpC,gCAAgCnpC,EAAEmpC,gCAAgC,CAAChpC,EAAEJ,GAAGC,EAAEmpC,gCAAgCv3B,KAAKzR,EACvhBJ,GAAG,OAAO,IAAIoqC,GAAGnqC,EAAE,EAAEd,EAAQV,OAAO,SAAS6C,EAAErB,EAAEG,GAAG,IAAIkqC,GAAGrqC,GAAG,MAAMoH,MAAMxG,EAAE,MAAM,OAAO2pC,GAAG,KAAKlpC,EAAErB,GAAE,EAAGG,EAAE,EAAEjB,EAAQyuC,uBAAuB,SAAStsC,GAAG,IAAIgpC,GAAGhpC,GAAG,MAAM+F,MAAMxG,EAAE,KAAK,QAAOS,EAAEuiC,sBAAqBqE,IAAG,WAAWsC,GAAG,KAAK,KAAKlpC,GAAE,GAAG,WAAWA,EAAEuiC,oBAAoB,KAAKviC,EAAEkpB,IAAI,IAAI,GAAE,KAAG,EAAM,EAAErrB,EAAQ0uC,wBAAwB5F,GAC/U9oC,EAAQ2uC,oCAAoC,SAASxsC,EAAErB,EAAEG,EAAEC,GAAG,IAAIiqC,GAAGlqC,GAAG,MAAMiH,MAAMxG,EAAE,MAAM,GAAG,MAAMS,QAAG,IAASA,EAAE6yB,gBAAgB,MAAM9sB,MAAMxG,EAAE,KAAK,OAAO2pC,GAAGlpC,EAAErB,EAAEG,GAAE,EAAGC,EAAE,EAAElB,EAAQosC,QAAQ,6DChU7L,IAAI5qC,EAAI9D,EAAQ,KAEdsC,EAAQguC,WAAaxsC,EAAEwsC,WACvBhuC,EAAQquC,YAAc7sC,EAAE6sC,yCCH1B,SAASO,IAEP,GAC4C,qBAAnCnB,gCAC4C,oBAA5CA,+BAA+BmB,SAcxC,IAEEnB,+BAA+BmB,SAASA,EAC1C,CAAE,MAAOC,GAGPzQ,QAAQC,MAAMwQ,EAChB,CACF,CAKED,GACA7uC,EAAOC,QAAU,EAAjBD,mCCzBucqC,EAAxbtB,EAAEC,OAAOC,IAAI,iBAAiBC,EAAEF,OAAOC,IAAI,gBAAgBE,EAAEH,OAAOC,IAAI,kBAAkBH,EAAEE,OAAOC,IAAI,qBAAqBG,EAAEJ,OAAOC,IAAI,kBAAkBI,EAAEL,OAAOC,IAAI,kBAAkBK,EAAEN,OAAOC,IAAI,iBAAiBM,EAAEP,OAAOC,IAAI,wBAAwBO,EAAER,OAAOC,IAAI,qBAAqBQ,EAAET,OAAOC,IAAI,kBAAkBS,EAAEV,OAAOC,IAAI,uBAAuBU,EAAEX,OAAOC,IAAI,cAAcW,EAAEZ,OAAOC,IAAI,cAAca,EAAEd,OAAOC,IAAI,mBACtb,SAASc,EAAEK,GAAG,GAAG,kBAAkBA,GAAG,OAAOA,EAAE,CAAC,IAAIP,EAAEO,EAAEE,SAAS,OAAOT,GAAG,KAAKd,EAAE,OAAOqB,EAAEA,EAAE7D,MAAQ,KAAK4C,EAAE,KAAKC,EAAE,KAAKN,EAAE,KAAKW,EAAE,KAAKC,EAAE,OAAOU,EAAE,QAAQ,OAAOA,EAAEA,GAAGA,EAAEE,UAAY,KAAKf,EAAE,KAAKD,EAAE,KAAKE,EAAE,KAAKI,EAAE,KAAKD,EAAE,KAAKN,EAAE,OAAOe,EAAE,QAAQ,OAAOP,GAAG,KAAKX,EAAE,OAAOW,EAAE,CAAC,CADkMQ,EAAErB,OAAOC,IAAI,0BAIxdhB,EAAQ8D,mBAAmB,SAAS3B,GAAG,MAAM,kBAAkBA,GAAG,oBAAoBA,GAAGA,IAAIjB,GAAGiB,IAAIhB,GAAGgB,IAAItB,GAAGsB,IAAIX,GAAGW,IAAIV,GAAGU,IAAIN,GAAG,kBAAkBM,GAAG,OAAOA,IAAIA,EAAEE,WAAWV,GAAGQ,EAAEE,WAAWX,GAAGS,EAAEE,WAAWjB,GAAGe,EAAEE,WAAWhB,GAAGc,EAAEE,WAAWd,GAAGY,EAAEE,WAAWD,QAAG,IAASD,EAAE2sC,YAAkB,EAAE9uC,EAAQ+D,OAAOjC,8BCV/S/B,EAAOC,QAAU,EAAjBD,qCCMeoB,EAAEzD,EAAQ,KAAS4D,EAAEP,OAAOC,IAAI,iBAAiBO,EAAER,OAAOC,IAAI,kBAAkBQ,EAAE/B,OAAOf,UAAUoG,eAAerD,EAAEN,EAAE2F,mDAAmDu4B,kBAAkB39B,EAAE,CAACf,KAAI,EAAG41B,KAAI,EAAGwY,QAAO,EAAGC,UAAS,GAChP,SAASrtC,EAAEV,EAAEkB,EAAEf,GAAG,IAAIN,EAAEI,EAAE,CAAC,EAAEL,EAAE,KAAKQ,EAAE,KAAiF,IAAIP,UAAhF,IAASM,IAAIP,EAAE,GAAGO,QAAG,IAASe,EAAExB,MAAME,EAAE,GAAGsB,EAAExB,UAAK,IAASwB,EAAEo0B,MAAMl1B,EAAEc,EAAEo0B,KAAcp0B,EAAEX,EAAE6E,KAAKlE,EAAErB,KAAKY,EAAEoD,eAAehE,KAAKI,EAAEJ,GAAGqB,EAAErB,IAAI,GAAGG,GAAGA,EAAElD,aAAa,IAAI+C,KAAKqB,EAAElB,EAAElD,kBAAe,IAASmD,EAAEJ,KAAKI,EAAEJ,GAAGqB,EAAErB,IAAI,MAAM,CAACuB,SAASf,EAAEhD,KAAK2C,EAAEN,IAAIE,EAAE01B,IAAIl1B,EAAE40B,MAAM/0B,EAAEs1B,OAAO/0B,EAAEgT,QAAQ,CAAoBzU,EAAQivC,IAAIttC,4BCD9U,IAAIJ,EAAER,OAAOC,IAAI,iBAAiBS,EAAEV,OAAOC,IAAI,gBAAgBU,EAAEX,OAAOC,IAAI,kBAAkBW,EAAEZ,OAAOC,IAAI,qBAAqBY,EAAEb,OAAOC,IAAI,kBAAkBa,EAAEd,OAAOC,IAAI,kBAAkBoB,EAAErB,OAAOC,IAAI,iBAAiBc,EAAEf,OAAOC,IAAI,qBAAqBe,EAAEhB,OAAOC,IAAI,kBAAkBgB,EAAEjB,OAAOC,IAAI,cAAciB,EAAElB,OAAOC,IAAI,cAAckB,EAAEnB,OAAO8G,SACzW,IAAIuN,EAAE,CAAC2f,UAAU,WAAW,OAAM,CAAE,EAAEO,mBAAmB,WAAW,EAAED,oBAAoB,WAAW,EAAEJ,gBAAgB,WAAW,GAAGtd,EAAElY,OAAOuI,OAAOuiB,EAAE,CAAC,EAAE,SAAS2D,EAAE/rB,EAAErB,EAAED,GAAGqE,KAAK+wB,MAAM9zB,EAAE+C,KAAK0tB,QAAQ9xB,EAAEoE,KAAK0vB,KAAKrK,EAAErlB,KAAK0wB,QAAQ/0B,GAAGuU,CAAC,CACwI,SAAS+V,IAAI,CAAyB,SAASgD,EAAEhsB,EAAErB,EAAED,GAAGqE,KAAK+wB,MAAM9zB,EAAE+C,KAAK0tB,QAAQ9xB,EAAEoE,KAAK0vB,KAAKrK,EAAErlB,KAAK0wB,QAAQ/0B,GAAGuU,CAAC,CADxP8Y,EAAExvB,UAAUorC,iBAAiB,CAAC,EACpQ5b,EAAExvB,UAAUwwC,SAAS,SAAS/sC,EAAErB,GAAG,GAAG,kBAAkBqB,GAAG,oBAAoBA,GAAG,MAAMA,EAAE,MAAM+F,MAAM,yHAAyHhD,KAAK0wB,QAAQX,gBAAgB/vB,KAAK/C,EAAErB,EAAE,WAAW,EAAEotB,EAAExvB,UAAUywC,YAAY,SAAShtC,GAAG+C,KAAK0wB,QAAQN,mBAAmBpwB,KAAK/C,EAAE,cAAc,EAAgBgpB,EAAEzsB,UAAUwvB,EAAExvB,UAAsF,IAAI2vB,EAAEF,EAAEzvB,UAAU,IAAIysB,EACrfkD,EAAE5kB,YAAY0kB,EAAExW,EAAE0W,EAAEH,EAAExvB,WAAW2vB,EAAEoH,sBAAqB,EAAG,IAAIlF,EAAEllB,MAAMC,QAAQ4f,EAAEzrB,OAAOf,UAAUoG,eAAesvB,EAAE,CAAC3f,QAAQ,MAAMygB,EAAE,CAACv0B,KAAI,EAAG41B,KAAI,EAAGwY,QAAO,EAAGC,UAAS,GACtK,SAAS9W,EAAE/1B,EAAErB,EAAED,GAAG,IAAIK,EAAED,EAAE,CAAC,EAAEK,EAAE,KAAKD,EAAE,KAAK,GAAG,MAAMP,EAAE,IAAII,UAAK,IAASJ,EAAEy1B,MAAMl1B,EAAEP,EAAEy1B,UAAK,IAASz1B,EAAEH,MAAMW,EAAE,GAAGR,EAAEH,KAAKG,EAAEoqB,EAAE7kB,KAAKvF,EAAEI,KAAKg0B,EAAEpwB,eAAe5D,KAAKD,EAAEC,GAAGJ,EAAEI,IAAI,IAAIE,EAAEvC,UAAUJ,OAAO,EAAE,GAAG,IAAI2C,EAAEH,EAAE6K,SAASjL,OAAO,GAAG,EAAEO,EAAE,CAAC,IAAI,IAAID,EAAEkK,MAAMjK,GAAGI,EAAE,EAAEA,EAAEJ,EAAEI,IAAIL,EAAEK,GAAG3C,UAAU2C,EAAE,GAAGP,EAAE6K,SAAS3K,CAAC,CAAC,GAAGgB,GAAGA,EAAEpE,aAAa,IAAImD,KAAKE,EAAEe,EAAEpE,kBAAe,IAASkD,EAAEC,KAAKD,EAAEC,GAAGE,EAAEF,IAAI,MAAM,CAACmB,SAASd,EAAEjD,KAAK6D,EAAExB,IAAIW,EAAEi1B,IAAIl1B,EAAE40B,MAAMh1B,EAAEu1B,OAAOpC,EAAE3f,QAAQ,CAChV,SAASokB,EAAE12B,GAAG,MAAM,kBAAkBA,GAAG,OAAOA,GAAGA,EAAEE,WAAWd,CAAC,CAAoG,IAAIu3B,EAAE,OAAO,SAASK,EAAEh3B,EAAErB,GAAG,MAAM,kBAAkBqB,GAAG,OAAOA,GAAG,MAAMA,EAAExB,IAA7K,SAAgBwB,GAAG,IAAIrB,EAAE,CAAC,IAAI,KAAK,IAAI,MAAM,MAAM,IAAIqB,EAAEwE,QAAQ,SAAQ,SAASxE,GAAG,OAAOrB,EAAEqB,EAAE,GAAE,CAA+EitC,CAAO,GAAGjtC,EAAExB,KAAKG,EAAE4L,SAAS,GAAG,CAC/W,SAASquB,EAAE54B,EAAErB,EAAED,EAAEK,EAAED,GAAG,IAAIK,SAASa,EAAK,cAAcb,GAAG,YAAYA,IAAEa,EAAE,MAAK,IAAId,GAAE,EAAG,GAAG,OAAOc,EAAEd,GAAE,OAAQ,OAAOC,GAAG,IAAK,SAAS,IAAK,SAASD,GAAE,EAAG,MAAM,IAAK,SAAS,OAAOc,EAAEE,UAAU,KAAKd,EAAE,KAAKE,EAAEJ,GAAE,GAAI,GAAGA,EAAE,OAAWJ,EAAEA,EAANI,EAAEc,GAASA,EAAE,KAAKjB,EAAE,IAAIi4B,EAAE93B,EAAE,GAAGH,EAAEqvB,EAAEtvB,IAAIJ,EAAE,GAAG,MAAMsB,IAAItB,EAAEsB,EAAEwE,QAAQmyB,EAAE,OAAO,KAAKiC,EAAE95B,EAAEH,EAAED,EAAE,IAAG,SAASsB,GAAG,OAAOA,CAAC,KAAI,MAAMlB,IAAI43B,EAAE53B,KAAKA,EADnW,SAAWkB,EAAErB,GAAG,MAAM,CAACuB,SAASd,EAAEjD,KAAK6D,EAAE7D,KAAKqC,IAAIG,EAAEy1B,IAAIp0B,EAAEo0B,IAAIN,MAAM9zB,EAAE8zB,MAAMO,OAAOr0B,EAAEq0B,OAAO,CACyQoC,CAAE33B,EAAEJ,IAAII,EAAEN,KAAKU,GAAGA,EAAEV,MAAMM,EAAEN,IAAI,IAAI,GAAGM,EAAEN,KAAKgG,QAAQmyB,EAAE,OAAO,KAAK32B,IAAIrB,EAAE4R,KAAKzR,IAAI,EAAyB,GAAvBI,EAAE,EAAEH,EAAE,KAAKA,EAAE,IAAIA,EAAE,IAAOqvB,EAAEpuB,GAAG,IAAI,IAAIf,EAAE,EAAEA,EAAEe,EAAE1D,OAAO2C,IAAI,CAC/e,IAAID,EAAED,EAAEi4B,EADwe73B,EACrfa,EAAEf,GAAeA,GAAGC,GAAG05B,EAAEz5B,EAAER,EAAED,EAAEM,EAAEF,EAAE,MAAM,GAAGE,EAPsU,SAAWgB,GAAG,OAAG,OAAOA,GAAG,kBAAkBA,EAAS,KAAsC,oBAAjCA,EAAED,GAAGC,EAAED,IAAIC,EAAE,eAA0CA,EAAE,IAAI,CAO5bG,CAAEH,GAAG,oBAAoBhB,EAAE,IAAIgB,EAAEhB,EAAEkF,KAAKlE,GAAGf,EAAE,IAAIE,EAAEa,EAAE2wB,QAAQuE,MAA6Bh2B,GAAG05B,EAA1Bz5B,EAAEA,EAAE6I,MAA0BrJ,EAAED,EAAtBM,EAAED,EAAEi4B,EAAE73B,EAAEF,KAAkBH,QAAQ,GAAG,WAAWK,EAAE,MAAMR,EAAE2f,OAAOte,GAAG+F,MAAM,mDAAmD,oBAAoBpH,EAAE,qBAAqBrB,OAAOa,KAAK6B,GAAGw0B,KAAK,MAAM,IAAI71B,GAAG,6EAA6E,OAAOO,CAAC,CACzZ,SAASohC,EAAEtgC,EAAErB,EAAED,GAAG,GAAG,MAAMsB,EAAE,OAAOA,EAAE,IAAIjB,EAAE,GAAGD,EAAE,EAAmD,OAAjD85B,EAAE54B,EAAEjB,EAAE,GAAG,IAAG,SAASiB,GAAG,OAAOrB,EAAEuF,KAAKxF,EAAEsB,EAAElB,IAAI,IAAUC,CAAC,CAAC,SAASmiC,EAAElhC,GAAG,IAAI,IAAIA,EAAEktC,QAAQ,CAAC,IAAIvuC,EAAEqB,EAAEmtC,SAAQxuC,EAAEA,KAAMqsB,MAAK,SAASrsB,GAAM,IAAIqB,EAAEktC,UAAU,IAAIltC,EAAEktC,UAAQltC,EAAEktC,QAAQ,EAAEltC,EAAEmtC,QAAQxuC,EAAC,IAAE,SAASA,GAAM,IAAIqB,EAAEktC,UAAU,IAAIltC,EAAEktC,UAAQltC,EAAEktC,QAAQ,EAAEltC,EAAEmtC,QAAQxuC,EAAC,KAAI,IAAIqB,EAAEktC,UAAUltC,EAAEktC,QAAQ,EAAEltC,EAAEmtC,QAAQxuC,EAAE,CAAC,GAAG,IAAIqB,EAAEktC,QAAQ,OAAOltC,EAAEmtC,QAAQC,QAAQ,MAAMptC,EAAEmtC,OAAQ,CAC5Z,IAAI5L,EAAE,CAACjvB,QAAQ,MAAMovB,EAAE,CAACvpB,WAAW,MAAMypB,EAAE,CAACtL,uBAAuBiL,EAAEvpB,wBAAwB0pB,EAAExE,kBAAkBjL,GAAGp0B,EAAQwvC,SAAS,CAACC,IAAIhN,EAAE98B,QAAQ,SAASxD,EAAErB,EAAED,GAAG4hC,EAAEtgC,GAAE,WAAWrB,EAAEwS,MAAMpO,KAAKrG,UAAU,GAAEgC,EAAE,EAAE6uC,MAAM,SAASvtC,GAAG,IAAIrB,EAAE,EAAuB,OAArB2hC,EAAEtgC,GAAE,WAAWrB,GAAG,IAAUA,CAAC,EAAE6uC,QAAQ,SAASxtC,GAAG,OAAOsgC,EAAEtgC,GAAE,SAASA,GAAG,OAAOA,CAAC,KAAI,EAAE,EAAEytC,KAAK,SAASztC,GAAG,IAAI02B,EAAE12B,GAAG,MAAM+F,MAAM,yEAAyE,OAAO/F,CAAC,GAAGnC,EAAQ20B,UAAUzG,EAAEluB,EAAQ4C,SAASlB,EACne1B,EAAQ+C,SAASnB,EAAE5B,EAAQ6vC,cAAc1hB,EAAEnuB,EAAQgD,WAAWrB,EAAE3B,EAAQiD,SAASlB,EAAE/B,EAAQ8G,mDAAmDi9B,EAC9I/jC,EAAQ8vC,aAAa,SAAS3tC,EAAErB,EAAED,GAAG,GAAG,OAAOsB,QAAG,IAASA,EAAE,MAAM+F,MAAM,iFAAiF/F,EAAE,KAAK,IAAIjB,EAAEyW,EAAE,CAAC,EAAExV,EAAE8zB,OAAOh1B,EAAEkB,EAAExB,IAAIW,EAAEa,EAAEo0B,IAAIl1B,EAAEc,EAAEq0B,OAAO,GAAG,MAAM11B,EAAE,CAAoE,QAAnE,IAASA,EAAEy1B,MAAMj1B,EAAER,EAAEy1B,IAAIl1B,EAAE+yB,EAAE3f,cAAS,IAAS3T,EAAEH,MAAMM,EAAE,GAAGH,EAAEH,KAAQwB,EAAE7D,MAAM6D,EAAE7D,KAAKP,aAAa,IAAIqD,EAAEe,EAAE7D,KAAKP,aAAa,IAAIoD,KAAKL,EAAEoqB,EAAE7kB,KAAKvF,EAAEK,KAAK+zB,EAAEpwB,eAAe3D,KAAKD,EAAEC,QAAG,IAASL,EAAEK,SAAI,IAASC,EAAEA,EAAED,GAAGL,EAAEK,GAAG,CAAC,IAAIA,EAAEtC,UAAUJ,OAAO,EAAE,GAAG,IAAI0C,EAAED,EAAE4K,SAASjL,OAAO,GAAG,EAAEM,EAAE,CAACC,EAAEiK,MAAMlK,GACrf,IAAI,IAAIK,EAAE,EAAEA,EAAEL,EAAEK,IAAIJ,EAAEI,GAAG3C,UAAU2C,EAAE,GAAGN,EAAE4K,SAAS1K,CAAC,CAAC,MAAM,CAACiB,SAASd,EAAEjD,KAAK6D,EAAE7D,KAAKqC,IAAIM,EAAEs1B,IAAIj1B,EAAE20B,MAAM/0B,EAAEs1B,OAAOn1B,EAAE,EAAErB,EAAQ+vC,cAAc,SAAS5tC,GAAqK,OAAlKA,EAAE,CAACE,SAASD,EAAE+vB,cAAchwB,EAAE6tC,eAAe7tC,EAAE8tC,aAAa,EAAEC,SAAS,KAAKC,SAAS,KAAKC,cAAc,KAAKC,YAAY,OAAQH,SAAS,CAAC7tC,SAASR,EAAEmH,SAAS7G,GAAUA,EAAEguC,SAAShuC,CAAC,EAAEnC,EAAQ4E,cAAcszB,EAAEl4B,EAAQswC,cAAc,SAASnuC,GAAG,IAAIrB,EAAEo3B,EAAEnN,KAAK,KAAK5oB,GAAY,OAATrB,EAAExC,KAAK6D,EAASrB,CAAC,EAAEd,EAAQuwC,UAAU,WAAW,MAAM,CAAC97B,QAAQ,KAAK,EAC9dzU,EAAQwwC,WAAW,SAASruC,GAAG,MAAM,CAACE,SAASP,EAAExC,OAAO6C,EAAE,EAAEnC,EAAQywC,eAAe5X,EAAE74B,EAAQ0wC,KAAK,SAASvuC,GAAG,MAAM,CAACE,SAASJ,EAAEgH,SAAS,CAAComC,SAAS,EAAEC,QAAQntC,GAAG+G,MAAMm6B,EAAE,EAAErjC,EAAQ2wC,KAAK,SAASxuC,EAAErB,GAAG,MAAM,CAACuB,SAASL,EAAE1D,KAAK6D,EAAEnD,aAAQ,IAAS8B,EAAE,KAAKA,EAAE,EAAEd,EAAQ4wC,gBAAgB,SAASzuC,GAAG,IAAIrB,EAAE+iC,EAAEvpB,WAAWupB,EAAEvpB,WAAW,CAAC,EAAE,IAAInY,GAAG,CAAC,QAAQ0hC,EAAEvpB,WAAWxZ,CAAC,CAAC,EAAEd,EAAQ6wC,aAAa,WAAW,MAAM3oC,MAAM,2DAA4D,EAC1clI,EAAQ68B,YAAY,SAAS16B,EAAErB,GAAG,OAAO4iC,EAAEjvB,QAAQooB,YAAY16B,EAAErB,EAAE,EAAEd,EAAQ88B,WAAW,SAAS36B,GAAG,OAAOuhC,EAAEjvB,QAAQqoB,WAAW36B,EAAE,EAAEnC,EAAQu9B,cAAc,WAAW,EAAEv9B,EAAQw9B,iBAAiB,SAASr7B,GAAG,OAAOuhC,EAAEjvB,QAAQ+oB,iBAAiBr7B,EAAE,EAAEnC,EAAQ+8B,UAAU,SAAS56B,EAAErB,GAAG,OAAO4iC,EAAEjvB,QAAQsoB,UAAU56B,EAAErB,EAAE,EAAEd,EAAQ49B,MAAM,WAAW,OAAO8F,EAAEjvB,QAAQmpB,OAAO,EAAE59B,EAAQg9B,oBAAoB,SAAS76B,EAAErB,EAAED,GAAG,OAAO6iC,EAAEjvB,QAAQuoB,oBAAoB76B,EAAErB,EAAED,EAAE,EAC7bb,EAAQi9B,mBAAmB,SAAS96B,EAAErB,GAAG,OAAO4iC,EAAEjvB,QAAQwoB,mBAAmB96B,EAAErB,EAAE,EAAEd,EAAQk9B,gBAAgB,SAAS/6B,EAAErB,GAAG,OAAO4iC,EAAEjvB,QAAQyoB,gBAAgB/6B,EAAErB,EAAE,EAAEd,EAAQm9B,QAAQ,SAASh7B,EAAErB,GAAG,OAAO4iC,EAAEjvB,QAAQ0oB,QAAQh7B,EAAErB,EAAE,EAAEd,EAAQo9B,WAAW,SAASj7B,EAAErB,EAAED,GAAG,OAAO6iC,EAAEjvB,QAAQ2oB,WAAWj7B,EAAErB,EAAED,EAAE,EAAEb,EAAQq9B,OAAO,SAASl7B,GAAG,OAAOuhC,EAAEjvB,QAAQ4oB,OAAOl7B,EAAE,EAAEnC,EAAQs9B,SAAS,SAASn7B,GAAG,OAAOuhC,EAAEjvB,QAAQ6oB,SAASn7B,EAAE,EAAEnC,EAAQ29B,qBAAqB,SAASx7B,EAAErB,EAAED,GAAG,OAAO6iC,EAAEjvB,QAAQkpB,qBAAqBx7B,EAAErB,EAAED,EAAE,EAC/eb,EAAQy9B,cAAc,WAAW,OAAOiG,EAAEjvB,QAAQgpB,eAAe,EAAEz9B,EAAQosC,QAAQ,qCCtBjFrsC,EAAOC,QAAU,EAAjBD,iCCAAA,EAAOC,QAAU,EAAjBD,+BCMW,SAASoB,EAAEgB,EAAErB,GAAG,IAAIG,EAAEkB,EAAE1D,OAAO0D,EAAEuQ,KAAK5R,GAAGqB,EAAE,KAAK,EAAElB,GAAG,CAAC,IAAIC,EAAED,EAAE,IAAI,EAAEJ,EAAEsB,EAAEjB,GAAG,KAAG,EAAEE,EAAEP,EAAEC,IAA0B,MAAMqB,EAA7BA,EAAEjB,GAAGJ,EAAEqB,EAAElB,GAAGJ,EAAEI,EAAEC,CAAc,CAAC,CAAC,SAASG,EAAEc,GAAG,OAAO,IAAIA,EAAE1D,OAAO,KAAK0D,EAAE,EAAE,CAAC,SAASb,EAAEa,GAAG,GAAG,IAAIA,EAAE1D,OAAO,OAAO,KAAK,IAAIqC,EAAEqB,EAAE,GAAGlB,EAAEkB,EAAE2uC,MAAM,GAAG7vC,IAAIH,EAAE,CAACqB,EAAE,GAAGlB,EAAEkB,EAAE,IAAI,IAAIjB,EAAE,EAAEL,EAAEsB,EAAE1D,OAAOsD,EAAElB,IAAI,EAAEK,EAAEa,GAAG,CAAC,IAAIP,EAAE,GAAGN,EAAE,GAAG,EAAEyW,EAAExV,EAAEX,GAAGC,EAAED,EAAE,EAAEQ,EAAEG,EAAEV,GAAG,GAAG,EAAEL,EAAEuW,EAAE1W,GAAGQ,EAAEZ,GAAG,EAAEO,EAAEY,EAAE2V,IAAIxV,EAAEjB,GAAGc,EAAEG,EAAEV,GAAGR,EAAEC,EAAEO,IAAIU,EAAEjB,GAAGyW,EAAExV,EAAEX,GAAGP,EAAEC,EAAEM,OAAQ,MAAGC,EAAEZ,GAAG,EAAEO,EAAEY,EAAEf,IAA0B,MAAMkB,EAA7BA,EAAEjB,GAAGc,EAAEG,EAAEV,GAAGR,EAAEC,EAAEO,CAAc,EAAC,CAAC,OAAOX,CAAC,CAC3c,SAASM,EAAEe,EAAErB,GAAG,IAAIG,EAAEkB,EAAE4uC,UAAUjwC,EAAEiwC,UAAU,OAAO,IAAI9vC,EAAEA,EAAEkB,EAAEuY,GAAG5Z,EAAE4Z,EAAE,CAAC,GAAG,kBAAkBs2B,aAAa,oBAAoBA,YAAYp0B,IAAI,CAAC,IAAIrb,EAAEyvC,YAAYhxC,EAAQqV,aAAa,WAAW,OAAO9T,EAAEqb,KAAK,CAAC,KAAK,CAAC,IAAIlb,EAAEib,KAAKhb,EAAED,EAAEkb,MAAM5c,EAAQqV,aAAa,WAAW,OAAO3T,EAAEkb,MAAMjb,CAAC,CAAC,CAAC,IAAIC,EAAE,GAAGC,EAAE,GAAGO,EAAE,EAAEN,EAAE,KAAKG,EAAE,EAAEC,GAAE,EAAGI,GAAE,EAAG8S,GAAE,EAAGmV,EAAE,oBAAoBoC,WAAWA,WAAW,KAAKuB,EAAE,oBAAoBrB,aAAaA,aAAa,KAAK1B,EAAE,qBAAqB8lB,aAAaA,aAAa,KACnT,SAAS9iB,EAAEhsB,GAAG,IAAI,IAAIrB,EAAEO,EAAEQ,GAAG,OAAOf,GAAG,CAAC,GAAG,OAAOA,EAAEozB,SAAS5yB,EAAEO,OAAQ,MAAGf,EAAEowC,WAAW/uC,GAAgD,MAA9Cb,EAAEO,GAAGf,EAAEiwC,UAAUjwC,EAAEqwC,eAAehwC,EAAES,EAAEd,EAAa,CAACA,EAAEO,EAAEQ,EAAE,CAAC,CAAC,SAASwsB,EAAElsB,GAAa,GAAViT,GAAE,EAAG+Y,EAAEhsB,IAAOG,EAAE,GAAG,OAAOjB,EAAEO,GAAGU,GAAE,EAAGiuB,EAAErF,OAAO,CAAC,IAAIpqB,EAAEO,EAAEQ,GAAG,OAAOf,GAAGszB,EAAE/F,EAAEvtB,EAAEowC,UAAU/uC,EAAE,CAAC,CACra,SAAS+oB,EAAE/oB,EAAErB,GAAGwB,GAAE,EAAG8S,IAAIA,GAAE,EAAG8Y,EAAEgH,GAAGA,GAAG,GAAGhzB,GAAE,EAAG,IAAIjB,EAAEgB,EAAE,IAAS,IAALksB,EAAErtB,GAAOgB,EAAET,EAAEO,GAAG,OAAOE,MAAMA,EAAEqvC,eAAerwC,IAAIqB,IAAI+1B,MAAM,CAAC,IAAIh3B,EAAEY,EAAEoyB,SAAS,GAAG,oBAAoBhzB,EAAE,CAACY,EAAEoyB,SAAS,KAAKjyB,EAAEH,EAAEsvC,cAAc,IAAIvwC,EAAEK,EAAEY,EAAEqvC,gBAAgBrwC,GAAGA,EAAEd,EAAQqV,eAAe,oBAAoBxU,EAAEiB,EAAEoyB,SAASrzB,EAAEiB,IAAIT,EAAEO,IAAIN,EAAEM,GAAGusB,EAAErtB,EAAE,MAAMQ,EAAEM,GAAGE,EAAET,EAAEO,EAAE,CAAC,GAAG,OAAOE,EAAE,IAAIC,GAAE,MAAO,CAAC,IAAIP,EAAEH,EAAEQ,GAAG,OAAOL,GAAG4yB,EAAE/F,EAAE7sB,EAAE0vC,UAAUpwC,GAAGiB,GAAE,CAAE,CAAC,OAAOA,CAAC,CAAC,QAAQD,EAAE,KAAKG,EAAEhB,EAAEiB,GAAE,CAAE,CAAC,CAD1a,qBAAqBmvC,gBAAW,IAASA,UAAUC,iBAAY,IAASD,UAAUC,WAAWC,gBAAgBF,UAAUC,WAAWC,eAAexmB,KAAKsmB,UAAUC,YAC2Q,IACzP7O,EAD6P7J,GAAE,EAAGC,EAAE,KAAK3D,GAAG,EAAE4D,EAAE,EAAEK,GAAG,EACvc,SAASjB,IAAI,QAAOl4B,EAAQqV,eAAe8jB,EAAEL,EAAO,CAAC,SAASiC,IAAI,GAAG,OAAOlC,EAAE,CAAC,IAAI12B,EAAEnC,EAAQqV,eAAe8jB,EAAEh3B,EAAE,IAAIrB,GAAE,EAAG,IAAIA,EAAE+3B,GAAE,EAAG12B,EAAE,CAAC,QAAQrB,EAAE2hC,KAAK7J,GAAE,EAAGC,EAAE,KAAK,CAAC,MAAMD,GAAE,CAAE,CAAO,GAAG,oBAAoBzN,EAAEsX,EAAE,WAAWtX,EAAE4P,EAAE,OAAO,GAAG,qBAAqByW,eAAe,CAAC,IAAInO,EAAE,IAAImO,eAAe9N,EAAEL,EAAEoO,MAAMpO,EAAEqO,MAAMC,UAAU5W,EAAE0H,EAAE,WAAWiB,EAAEkO,YAAY,KAAK,CAAC,MAAMnP,EAAE,WAAWlY,EAAEwQ,EAAE,EAAE,EAAE,SAASxK,EAAEpuB,GAAG02B,EAAE12B,EAAEy2B,IAAIA,GAAE,EAAG6J,IAAI,CAAC,SAASrO,EAAEjyB,EAAErB,GAAGo0B,EAAE3K,GAAE,WAAWpoB,EAAEnC,EAAQqV,eAAe,GAAEvU,EAAE,CAC5dd,EAAQiW,sBAAsB,EAAEjW,EAAQyV,2BAA2B,EAAEzV,EAAQ+V,qBAAqB,EAAE/V,EAAQ6V,wBAAwB,EAAE7V,EAAQ6xC,mBAAmB,KAAK7xC,EAAQ2V,8BAA8B,EAAE3V,EAAQ+U,wBAAwB,SAAS5S,GAAGA,EAAE+xB,SAAS,IAAI,EAAEl0B,EAAQ8xC,2BAA2B,WAAWxvC,GAAGJ,IAAII,GAAE,EAAGiuB,EAAErF,GAAG,EAC1UlrB,EAAQ+xC,wBAAwB,SAAS5vC,GAAG,EAAEA,GAAG,IAAIA,EAAEi8B,QAAQC,MAAM,mHAAmHvF,EAAE,EAAE32B,EAAEkU,KAAK27B,MAAM,IAAI7vC,GAAG,CAAC,EAAEnC,EAAQuV,iCAAiC,WAAW,OAAOtT,CAAC,EAAEjC,EAAQiyC,8BAA8B,WAAW,OAAO5wC,EAAEO,EAAE,EAAE5B,EAAQkyC,cAAc,SAAS/vC,GAAG,OAAOF,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAInB,EAAE,EAAE,MAAM,QAAQA,EAAEmB,EAAE,IAAIhB,EAAEgB,EAAEA,EAAEnB,EAAE,IAAI,OAAOqB,GAAG,CAAC,QAAQF,EAAEhB,CAAC,CAAC,EAAEjB,EAAQmyC,wBAAwB,WAAW,EAC9fnyC,EAAQmV,sBAAsB,WAAW,EAAEnV,EAAQoyC,yBAAyB,SAASjwC,EAAErB,GAAG,OAAOqB,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQA,EAAE,EAAE,IAAIlB,EAAEgB,EAAEA,EAAEE,EAAE,IAAI,OAAOrB,GAAG,CAAC,QAAQmB,EAAEhB,CAAC,CAAC,EAChMjB,EAAQ6U,0BAA0B,SAAS1S,EAAErB,EAAEG,GAAG,IAAIC,EAAElB,EAAQqV,eAA8F,OAA/E,kBAAkBpU,GAAG,OAAOA,EAAaA,EAAE,kBAAZA,EAAEA,EAAEoxC,QAA6B,EAAEpxC,EAAEC,EAAED,EAAEC,EAAGD,EAAEC,EAASiB,GAAG,KAAK,EAAE,IAAItB,GAAG,EAAE,MAAM,KAAK,EAAEA,EAAE,IAAI,MAAM,KAAK,EAAEA,EAAE,WAAW,MAAM,KAAK,EAAEA,EAAE,IAAI,MAAM,QAAQA,EAAE,IAAmN,OAAzMsB,EAAE,CAACuY,GAAGtY,IAAI8xB,SAASpzB,EAAEswC,cAAcjvC,EAAE+uC,UAAUjwC,EAAEkwC,eAAvDtwC,EAAEI,EAAEJ,EAAoEkwC,WAAW,GAAG9vC,EAAEC,GAAGiB,EAAE4uC,UAAU9vC,EAAEE,EAAEU,EAAEM,GAAG,OAAOd,EAAEO,IAAIO,IAAId,EAAEQ,KAAKuT,GAAG8Y,EAAEgH,GAAGA,GAAG,GAAG9f,GAAE,EAAGgf,EAAE/F,EAAEptB,EAAEC,MAAMiB,EAAE4uC,UAAUlwC,EAAEM,EAAES,EAAEO,GAAGG,GAAGJ,IAAII,GAAE,EAAGiuB,EAAErF,KAAY/oB,CAAC,EACnenC,EAAQiV,qBAAqBijB,EAAEl4B,EAAQsyC,sBAAsB,SAASnwC,GAAG,IAAIrB,EAAEmB,EAAE,OAAO,WAAW,IAAIhB,EAAEgB,EAAEA,EAAEnB,EAAE,IAAI,OAAOqB,EAAEmR,MAAMpO,KAAKrG,UAAU,CAAC,QAAQoD,EAAEhB,CAAC,CAAC,CAAC,8BCf7JlB,EAAOC,QAAU,EAAjBD,cCDFA,EAAOC,QAAU,SAAsBuyC,EAAMC,EAAMxzC,EAASyzC,GAC1D,IAAIC,EAAM1zC,EAAUA,EAAQqH,KAAKosC,EAAgBF,EAAMC,QAAQ,EAE/D,QAAY,IAARE,EACF,QAASA,EAGX,GAAIH,IAASC,EACX,OAAO,EAGT,GAAoB,kBAATD,IAAsBA,GAAwB,kBAATC,IAAsBA,EACpE,OAAO,EAGT,IAAIG,EAAQlzC,OAAOa,KAAKiyC,GACpBK,EAAQnzC,OAAOa,KAAKkyC,GAExB,GAAIG,EAAMl0C,SAAWm0C,EAAMn0C,OACzB,OAAO,EAMT,IAHA,IAAIo0C,EAAkBpzC,OAAOf,UAAUoG,eAAeimB,KAAKynB,GAGlDM,EAAM,EAAGA,EAAMH,EAAMl0C,OAAQq0C,IAAO,CAC3C,IAAInyC,EAAMgyC,EAAMG,GAEhB,IAAKD,EAAgBlyC,GACnB,OAAO,EAGT,IAAIoyC,EAASR,EAAK5xC,GACdqyC,EAASR,EAAK7xC,GAIlB,IAAY,KAFZ+xC,EAAM1zC,EAAUA,EAAQqH,KAAKosC,EAAgBM,EAAQC,EAAQryC,QAAO,SAEtC,IAAR+xC,GAAkBK,IAAWC,EACjD,OAAO,CAEX,CAEA,OAAO,CACT,IC5CIC,EAA2B,CAAC,EAGhC,SAASC,EAAoBC,GAE5B,IAAIC,EAAeH,EAAyBE,GAC5C,QAAqBE,IAAjBD,EACH,OAAOA,EAAapzC,QAGrB,IAAID,EAASkzC,EAAyBE,GAAY,CAGjDnzC,QAAS,CAAC,GAOX,OAHAszC,EAAoBH,GAAUpzC,EAAQA,EAAOC,QAASkzC,GAG/CnzC,EAAOC,OACf,CCrBAkzC,EAAoBzxC,EAAK1B,IACxB,IAAIwzC,EAASxzC,GAAUA,EAAOyzC,WAC7B,IAAOzzC,EAAiB,QACxB,IAAM,EAEP,OADAmzC,EAAoBhyC,EAAEqyC,EAAQ,CAAEpxC,EAAGoxC,IAC5BA,CAAM,ECLdL,EAAoBhyC,EAAI,CAAClB,EAASyzC,KACjC,IAAI,IAAI9yC,KAAO8yC,EACXP,EAAoBQ,EAAED,EAAY9yC,KAASuyC,EAAoBQ,EAAE1zC,EAASW,IAC5ElB,OAAOD,eAAeQ,EAASW,EAAK,CAAEiJ,YAAY,EAAMF,IAAK+pC,EAAW9yC,IAE1E,ECNDuyC,EAAoBQ,EAAI,CAACC,EAAKC,IAAUn0C,OAAOf,UAAUoG,eAAeuB,KAAKstC,EAAKC,GCAlFV,EAAoBW,QAAKR,6DCsmBzB,QAtmBA,SAAqBtP,GACnB,SAAS7L,EAAEh3B,EAAGD,EAAGJ,EAAGQ,EAAGc,GACrB,IAAK,IAAgCR,EAAGP,EAAiBE,EAAuEW,EAAmC0V,EAA1JnW,EAAI,EAAGV,EAAI,EAAGgB,EAAI,EAAGL,EAAI,EAASO,EAAI,EAAGoyB,EAAI,EAAMhyB,EAAId,EAAIK,EAAI,EAAGJ,EAAI,EAAGK,EAAI,EAAG2uB,EAAI,EAAG1uB,EAAI,EAAGuT,EAAIvU,EAAEpC,OAAQysB,EAAI9V,EAAI,EAAMjU,EAAI,GAAIO,EAAI,GAAIypB,EAAI,GAAIgD,EAAI,GAAO5sB,EAAI6T,GAAI,CAI5K,GAHAhU,EAAIP,EAAEizC,WAAWvyC,GACjBA,IAAM2pB,GAAK,IAAMpqB,EAAIW,EAAIK,EAAIN,IAAM,IAAMV,IAAMM,EAAI,KAAON,EAAI,GAAK,IAAKW,EAAIK,EAAIN,EAAI,EAAG4T,IAAK8V,KAExF,IAAMpqB,EAAIW,EAAIK,EAAIN,EAAG,CACvB,GAAID,IAAM2pB,IAAM,EAAItpB,IAAMT,EAAIA,EAAEwF,QAAQiyB,EAAG,KAAM,EAAIz3B,EAAEiH,OAAO3J,QAAS,CACrE,OAAQ2C,GACN,KAAK,GACL,KAAK,EACL,KAAK,GACL,KAAK,GACL,KAAK,GACH,MAEF,QACED,GAAKN,EAAEyP,OAAO/O,GAGlBH,EAAI,EACN,CAEA,OAAQA,GACN,KAAK,IAKH,IAHAO,GADAR,EAAIA,EAAEiH,QACA0rC,WAAW,GACjBxyC,EAAI,EAECO,IAAMN,EAAGA,EAAI6T,GAAI,CACpB,OAAQhU,EAAIP,EAAEizC,WAAWvyC,IACvB,KAAK,IACHD,IACA,MAEF,KAAK,IACHA,IACA,MAEF,KAAK,GACH,OAAQF,EAAIP,EAAEizC,WAAWvyC,EAAI,IAC3B,KAAK,GACL,KAAK,GACHY,EAAG,CACD,IAAKC,EAAIb,EAAI,EAAGa,EAAI8oB,IAAK9oB,EACvB,OAAQvB,EAAEizC,WAAW1xC,IACnB,KAAK,GACH,GAAI,KAAOhB,GAAK,KAAOP,EAAEizC,WAAW1xC,EAAI,IAAMb,EAAI,IAAMa,EAAG,CACzDb,EAAIa,EAAI,EACR,MAAMD,CACR,CAEA,MAEF,KAAK,GACH,GAAI,KAAOf,EAAG,CACZG,EAAIa,EAAI,EACR,MAAMD,CACR,EAKNZ,EAAIa,CACN,EAIJ,MAEF,KAAK,GACHhB,IAEF,KAAK,GACHA,IAEF,KAAK,GACL,KAAK,GACH,KAAOG,IAAM2pB,GAAKrqB,EAAEizC,WAAWvyC,KAAOH,KAK1C,GAAI,IAAME,EAAG,MACbC,GACF,CAKA,GAHAD,EAAIT,EAAE0P,UAAU1O,EAAGN,GACnB,IAAMI,IAAMA,GAAKR,EAAIA,EAAEwF,QAAQ1C,EAAI,IAAImE,QAAQ0rC,WAAW,IAGnD,KADCnyC,EACN,CAIE,OAHA,EAAIC,IAAMT,EAAIA,EAAEwF,QAAQiyB,EAAG,KAC3Bx3B,EAAID,EAAE2yC,WAAW,IAGf,KAAK,IACL,KAAK,IACL,KAAK,IACL,KAAK,GACHlyC,EAAIX,EACJ,MAEF,QACEW,EAAIi3B,EAMR,GAFAh3B,GADAP,EAAI42B,EAAEj3B,EAAGW,EAAGN,EAAGF,EAAGe,EAAI,IAChB1D,OACN,EAAI6D,IAAsBqV,EAAI0W,EAAE,EAAG/sB,EAAzBM,EAAIgjC,EAAE/L,EAAG13B,EAAGovB,GAAmBtvB,EAAGspB,EAAGroB,EAAGL,EAAGT,EAAGe,EAAGd,GAAIF,EAAIS,EAAE+0B,KAAK,SAAK,IAAWhf,GAAK,KAAO9V,GAAKP,EAAIqW,EAAEvP,QAAQ3J,UAAY2C,EAAI,EAAGE,EAAI,KAC5I,EAAIO,EAAG,OAAQT,GACjB,KAAK,IACHD,EAAIA,EAAEwF,QAAQxC,EAAIE,GAEpB,KAAK,IACL,KAAK,IACL,KAAK,GACH/C,EAAIH,EAAI,IAAMG,EAAI,IAClB,MAEF,KAAK,IAEHA,GADAH,EAAIA,EAAEwF,QAAQrC,EAAI,UACV,IAAMhD,EAAI,IAClBA,EAAI,IAAMS,GAAK,IAAMA,GAAKmzB,EAAE,IAAM5zB,EAAG,GAAK,YAAcA,EAAI,IAAMA,EAAI,IAAMA,EAC5E,MAEF,QACEA,EAAIH,EAAIG,EAAG,MAAQD,IAAWK,GAAKJ,EAAVA,EAAa,SACnCA,EAAI,EACN,MAGLA,EAAI42B,EAAEj3B,EAAG2jC,EAAE3jC,EAAGE,EAAGovB,GAAIjvB,EAAGD,EAAGc,EAAI,GAGnCgpB,GAAK7pB,EACLA,EAAIivB,EAAI3uB,EAAIQ,EAAIT,EAAI,EACpBR,EAAI,GACJC,EAAIP,EAAEizC,aAAavyC,GACnB,MAEF,KAAK,IACL,KAAK,GAEH,GAAI,GAAKM,GADTV,GAAK,EAAIS,EAAIT,EAAEwF,QAAQiyB,EAAG,IAAMz3B,GAAGiH,QACpB3J,QAAS,OAAQ,IAAM2D,IAAMT,EAAIR,EAAE2yC,WAAW,GAAI,KAAOnyC,GAAK,GAAKA,GAAK,IAAMA,KAAOE,GAAKV,EAAIA,EAAEwF,QAAQ,IAAK,MAAMlI,QAAS,EAAI6D,QAAK,KAAYqV,EAAI0W,EAAE,EAAGltB,EAAGF,EAAGC,EAAGqpB,EAAGroB,EAAGR,EAAEjD,OAAQ4C,EAAGc,EAAGd,KAAO,KAAOQ,GAAKV,EAAIwW,EAAEvP,QAAQ3J,UAAY0C,EAAI,QAAaQ,EAAIR,EAAE2yC,WAAW,GAAI1yC,EAAID,EAAE2yC,WAAW,GAAInyC,GAC9S,KAAK,EACH,MAEF,KAAK,GACH,GAAI,MAAQP,GAAK,KAAOA,EAAG,CACzB+sB,GAAKhtB,EAAIN,EAAEyP,OAAO/O,GAClB,KACF,CAEF,QACE,KAAOJ,EAAE2yC,WAAWjyC,EAAI,KAAOH,GAAKo3B,EAAE33B,EAAGQ,EAAGP,EAAGD,EAAE2yC,WAAW,KAEhEvjB,EAAI3uB,EAAIQ,EAAIT,EAAI,EAChBR,EAAI,GACJC,EAAIP,EAAEizC,aAAavyC,GAEzB,CAEA,OAAQH,GACN,KAAK,GACL,KAAK,GACH,KAAON,EAAIA,EAAI,EAAI,IAAM,EAAIa,GAAK,MAAQN,GAAK,EAAIF,EAAE1C,SAAWmD,EAAI,EAAGT,GAAK,MAC5E,EAAImB,EAAIikC,GAAKlY,EAAE,EAAGltB,EAAGF,EAAGC,EAAGqpB,EAAGroB,EAAGR,EAAEjD,OAAQ4C,EAAGc,EAAGd,GACjDa,EAAI,EACJqoB,IACA,MAEF,KAAK,GACL,KAAK,IACH,GAAI,IAAMzpB,EAAIW,EAAIK,EAAIN,EAAG,CACvBU,IACA,KACF,CAEF,QAIE,OAHAA,IACAD,EAAIpB,EAAEyP,OAAO/O,GAELH,GACN,KAAK,EACL,KAAK,GACH,GAAI,IAAMK,EAAID,EAAIV,EAAG,OAAQkB,GAC3B,KAAK,GACL,KAAK,GACL,KAAK,EACL,KAAK,GACHC,EAAI,GACJ,MAEF,QACE,KAAOb,IAAMa,EAAI,KAErB,MAEF,KAAK,EACHA,EAAI,MACJ,MAEF,KAAK,GACHA,EAAI,MACJ,MAEF,KAAK,GACHA,EAAI,MACJ,MAEF,KAAK,GACH,IAAMR,EAAIX,EAAIU,IAAMI,EAAI2uB,EAAI,EAAGtuB,EAAI,KAAOA,GAC1C,MAEF,KAAK,IACH,GAAI,IAAMR,EAAIX,EAAIU,EAAI0sB,GAAK,EAAI9rB,EAAG,OAAQb,EAAIa,GAC5C,KAAK,EACH,MAAQJ,GAAK,KAAOnB,EAAEizC,WAAWvyC,EAAI,KAAO2sB,EAAIlsB,GAElD,KAAK,EACH,MAAQoyB,IAAMlG,EAAIkG,GAEtB,MAEF,KAAK,GACH,IAAM3yB,EAAIX,EAAIU,IAAMY,EAAIb,GACxB,MAEF,KAAK,GACH,IAAMT,EAAIgB,EAAIL,EAAID,IAAMI,EAAI,EAAGK,GAAK,MACpC,MAEF,KAAK,GACL,KAAK,GACH,IAAMnB,IAAMW,EAAIA,IAAML,EAAI,EAAI,IAAMK,EAAIL,EAAIK,GAC5C,MAEF,KAAK,GACH,IAAMA,EAAIX,EAAIgB,GAAKN,IACnB,MAEF,KAAK,GACH,IAAMC,EAAIX,EAAIgB,GAAKN,IACnB,MAEF,KAAK,GACH,IAAMC,EAAIX,EAAIU,GAAKM,IACnB,MAEF,KAAK,GACH,GAAI,IAAML,EAAIX,EAAIU,EAAG,CACnB,GAAI,IAAMG,EAAG,GAAQ,EAAIK,EAAI,EAAIoyB,IAC1B,UAIHzyB,EAAI,EAERG,GACF,CAEA,MAEF,KAAK,GACH,IAAMhB,EAAIgB,EAAIL,EAAID,EAAIY,EAAId,IAAMA,EAAI,GACpC,MAEF,KAAK,GACL,KAAK,GACH,KAAM,EAAIG,EAAID,EAAIM,GAAI,OAAQhB,GAC5B,KAAK,EACH,OAAQ,EAAIM,EAAI,EAAIP,EAAEizC,WAAWvyC,EAAI,IACnC,KAAK,IACHT,EAAI,GACJ,MAEF,KAAK,IACHe,EAAIN,EAAGT,EAAI,GAGf,MAEF,KAAK,GACH,KAAOM,GAAK,KAAOY,GAAKH,EAAI,IAAMN,IAAM,KAAOV,EAAEizC,WAAWjyC,EAAI,KAAOH,GAAKb,EAAE0P,UAAU1O,EAAGN,EAAI,IAAKU,EAAI,GAAInB,EAAI,IAIxH,IAAMA,IAAMK,GAAKc,GAGrBmyB,EAAIpyB,EACJA,EAAIZ,EACJG,GACF,CAIA,GAAI,GAFJM,EAAIH,EAAEjD,QAEK,CAET,GADAmD,EAAIX,EACA,EAAIqB,SAA2C,KAArCqV,EAAI0W,EAAE,EAAG3sB,EAAGE,EAAGV,EAAGqpB,EAAGroB,EAAGL,EAAGR,EAAGc,EAAGd,KAAoB,KAAOK,EAAIiW,GAAGlZ,QAAS,OAAO0vB,EAAIzsB,EAAIypB,EAGzG,GAFAzpB,EAAIE,EAAE+0B,KAAK,KAAO,IAAMj1B,EAAI,IAExB,IAAMK,EAAImsB,EAAG,CAGf,OAFA,IAAMnsB,GAAKmzB,EAAExzB,EAAG,KAAOwsB,EAAI,GAEnBA,GACN,KAAK,IACHxsB,EAAIA,EAAEiF,QAAQpC,EAAI,YAAc7C,EAChC,MAEF,KAAK,IACHA,EAAIA,EAAEiF,QAAQwyB,EAAG,sBAAwBz3B,EAAEiF,QAAQwyB,EAAG,aAAez3B,EAAEiF,QAAQwyB,EAAG,iBAAmBz3B,EAGzGwsB,EAAI,CACN,CACF,CAEA,OAAOC,EAAIzsB,EAAIypB,CACjB,CAEA,SAASyZ,EAAE1jC,EAAGD,EAAGJ,GACf,IAAIQ,EAAIJ,EAAEmH,OAAO1C,MAAMjB,GACvBxD,EAAII,EACJ,IAAIc,EAAId,EAAE5C,OACN+C,EAAIN,EAAEzC,OAEV,OAAQ+C,GACN,KAAK,EACL,KAAK,EACH,IAAIV,EAAI,EAER,IAAKI,EAAI,IAAMM,EAAI,GAAKN,EAAE,GAAK,IAAKJ,EAAIqB,IAAKrB,EAC3CG,EAAEH,GAAK0lC,EAAEtlC,EAAGD,EAAEH,GAAID,GAAGuH,OAGvB,MAEF,QACE,IAAItG,EAAIhB,EAAI,EAEZ,IAAKG,EAAI,GAAIH,EAAIqB,IAAKrB,EACpB,IAAK,IAAIW,EAAI,EAAGA,EAAID,IAAKC,EACvBR,EAAEa,KAAO0kC,EAAEtlC,EAAEO,GAAK,IAAKJ,EAAEP,GAAID,GAAGuH,OAMxC,OAAOnH,CACT,CAEA,SAASulC,EAAEtlC,EAAGD,EAAGJ,GACf,IAAIQ,EAAIJ,EAAE6yC,WAAW,GAGrB,OAFA,GAAKzyC,IAAMA,GAAKJ,EAAIA,EAAEmH,QAAQ0rC,WAAW,IAEjCzyC,GACN,KAAK,GACH,OAAOJ,EAAE0F,QAAQwkB,EAAG,KAAOjqB,EAAEkH,QAE/B,KAAK,GACH,OAAOlH,EAAEkH,OAASnH,EAAE0F,QAAQwkB,EAAG,KAAOjqB,EAAEkH,QAE1C,QACE,GAAI,EAAI,EAAIvH,GAAK,EAAII,EAAEmP,QAAQ,MAAO,OAAOnP,EAAE0F,QAAQwkB,GAAI,KAAOjqB,EAAE4yC,WAAW,GAAK,GAAK,MAAQ5yC,EAAEkH,QAGvG,OAAOlH,EAAID,CACb,CAEA,SAAS63B,EAAE53B,EAAGD,EAAGJ,EAAGQ,GAClB,IAAIc,EAAIjB,EAAI,IACRM,EAAI,EAAIP,EAAI,EAAIJ,EAAI,EAAIQ,EAE5B,GAAI,MAAQG,EAAG,CACbN,EAAIiB,EAAEiO,QAAQ,IAAK,GAAK,EACxB,IAAItP,EAAIqB,EAAEoO,UAAUrP,EAAGiB,EAAE1D,OAAS,GAAG2J,OAErC,OADAtH,EAAIqB,EAAEoO,UAAU,EAAGrP,GAAGkH,OAAStH,EAAI,IAC5B,IAAMiB,GAAK,IAAMA,GAAKmzB,EAAEp0B,EAAG,GAAK,WAAaA,EAAIA,EAAIA,CAC9D,CAEA,GAAI,IAAMiB,GAAK,IAAMA,IAAMmzB,EAAE/yB,EAAG,GAAI,OAAOA,EAE3C,OAAQX,GACN,KAAK,KACH,OAAO,KAAOW,EAAE2xC,WAAW,IAAM,WAAa3xC,EAAIA,EAAIA,EAExD,KAAK,IACH,OAAO,MAAQA,EAAE2xC,WAAW,GAAK,WAAa3xC,EAAIA,EAAIA,EAExD,KAAK,IACH,OAAO,MAAQA,EAAE2xC,WAAW,GAAK,WAAa3xC,EAAIA,EAAIA,EAExD,KAAK,KACH,GAAI,MAAQA,EAAE2xC,WAAW,GAAI,MAE/B,KAAK,IACL,KAAK,IACH,MAAO,WAAa3xC,EAAIA,EAE1B,KAAK,IACH,MAAO,WAAaA,EAAI,QAAUA,EAAIA,EAExC,KAAK,KACL,KAAK,IACH,MAAO,WAAaA,EAAI,QAAUA,EAAI,OAASA,EAAIA,EAErD,KAAK,IACH,GAAI,KAAOA,EAAE2xC,WAAW,GAAI,MAAO,WAAa3xC,EAAIA,EACpD,GAAI,EAAIA,EAAEiO,QAAQ,aAAc,IAAK,OAAOjO,EAAEwE,QAAQ9B,EAAI,gBAAkB1C,EAC5E,MAEF,KAAK,IACH,GAAI,KAAOA,EAAE2xC,WAAW,GAAI,OAAQ3xC,EAAE2xC,WAAW,IAC/C,KAAK,IACH,MAAO,eAAiB3xC,EAAEwE,QAAQ,QAAS,IAAM,WAAaxE,EAAI,OAASA,EAAEwE,QAAQ,OAAQ,YAAcxE,EAE7G,KAAK,IACH,MAAO,WAAaA,EAAI,OAASA,EAAEwE,QAAQ,SAAU,YAAcxE,EAErE,KAAK,GACH,MAAO,WAAaA,EAAI,OAASA,EAAEwE,QAAQ,QAAS,kBAAoBxE,EAE5E,MAAO,WAAaA,EAAI,OAASA,EAAIA,EAEvC,KAAK,IACH,MAAO,WAAaA,EAAI,YAAcA,EAAIA,EAE5C,KAAK,KACH,GAAI,KAAOA,EAAE2xC,WAAW,GAAI,MAE5B,MAAO,oBADPhzC,EAAIqB,EAAEoO,UAAUpO,EAAEiO,QAAQ,IAAK,KAAKzJ,QAAQ,QAAS,IAAIA,QAAQ,gBAAiB,YAClD,WAAaxE,EAAI,gBAAkBrB,EAAIqB,EAEzE,KAAK,KACH,OAAO4C,EAAGuB,KAAKnE,GAAKA,EAAEwE,QAAQ3C,EAAI,aAAe7B,EAAEwE,QAAQ3C,EAAI,UAAY7B,EAAIA,EAEjF,KAAK,IAIH,OAFAlB,GADAH,EAAIqB,EAAEoO,UAAU,IAAInI,QACdgI,QAAQ,KAAO,EAEbtP,EAAEgzC,WAAW,GAAKhzC,EAAEgzC,WAAW7yC,IACrC,KAAK,IACHH,EAAIqB,EAAEwE,QAAQwnB,EAAG,MACjB,MAEF,KAAK,IACHrtB,EAAIqB,EAAEwE,QAAQwnB,EAAG,SACjB,MAEF,KAAK,IACHrtB,EAAIqB,EAAEwE,QAAQwnB,EAAG,MACjB,MAEF,QACE,OAAOhsB,EAGX,MAAO,WAAaA,EAAI,OAASrB,EAAIqB,EAEvC,KAAK,KACH,IAAK,IAAMA,EAAEiO,QAAQ,SAAU,GAAI,MAErC,KAAK,IAIH,OAHAnP,GAAKkB,EAAIjB,GAAGzC,OAAS,GAGb+C,GAFRV,GAAK,KAAOqB,EAAE2xC,WAAW7yC,GAAKkB,EAAEoO,UAAU,EAAGtP,GAAKkB,GAAGoO,UAAUrP,EAAEkP,QAAQ,IAAK,GAAK,GAAGhI,QAExE0rC,WAAW,IAAwB,EAAlBhzC,EAAEgzC,WAAW,KAC1C,KAAK,IACH,GAAI,IAAMhzC,EAAEgzC,WAAW,GAAI,MAE7B,KAAK,IACH3xC,EAAIA,EAAEwE,QAAQ7F,EAAG,WAAaA,GAAK,IAAMqB,EACzC,MAEF,KAAK,IACL,KAAK,IACHA,EAAIA,EAAEwE,QAAQ7F,EAAG,YAAc,IAAMU,EAAI,UAAY,IAAM,OAAS,IAAMW,EAAEwE,QAAQ7F,EAAG,WAAaA,GAAK,IAAMqB,EAAEwE,QAAQ7F,EAAG,OAASA,EAAI,OAAS,IAAMqB,EAG5J,OAAOA,EAAI,IAEb,KAAK,IACH,GAAI,KAAOA,EAAE2xC,WAAW,GAAI,OAAQ3xC,EAAE2xC,WAAW,IAC/C,KAAK,IACH,OAAOhzC,EAAIqB,EAAEwE,QAAQ,SAAU,IAAK,WAAaxE,EAAI,eAAiBrB,EAAI,YAAcA,EAAIqB,EAE9F,KAAK,IACH,MAAO,WAAaA,EAAI,iBAAmBA,EAAEwE,QAAQilB,EAAI,IAAMzpB,EAEjE,QACE,MAAO,WAAaA,EAAI,qBAAuBA,EAAEwE,QAAQ,gBAAiB,IAAIA,QAAQilB,EAAI,IAAMzpB,EAEpG,MAEF,KAAK,IACL,KAAK,IACH,GAAI,KAAOA,EAAE2xC,WAAW,IAAM,MAAQ3xC,EAAE2xC,WAAW,GAAI,MAEzD,KAAK,IACL,KAAK,IACH,IAAI,IAAO9uC,EAAGsB,KAAKpF,GAAI,OAAO,OAASJ,EAAII,EAAEqP,UAAUrP,EAAEkP,QAAQ,KAAO,IAAI0jC,WAAW,GAAKhb,EAAE53B,EAAEyF,QAAQ,UAAW,kBAAmB1F,EAAGJ,EAAGQ,GAAGsF,QAAQ,kBAAmB,YAAcxE,EAAEwE,QAAQ7F,EAAG,WAAaA,GAAKqB,EAAEwE,QAAQ7F,EAAG,QAAUA,EAAE6F,QAAQ,QAAS,KAAOxE,EACxQ,MAEF,KAAK,IACH,GAAIA,EAAI,WAAaA,GAAK,MAAQA,EAAE2xC,WAAW,GAAK,OAAS3xC,EAAI,IAAMA,EAAG,MAAQtB,EAAIQ,GAAK,MAAQc,EAAE2xC,WAAW,KAAO,EAAI3xC,EAAEiO,QAAQ,YAAa,IAAK,OAAOjO,EAAEoO,UAAU,EAAGpO,EAAEiO,QAAQ,IAAK,IAAM,GAAGzJ,QAAQ1B,EAAI,gBAAkB9C,EAGvO,OAAOA,CACT,CAEA,SAAS+yB,EAAEh0B,EAAGD,GACZ,IAAIJ,EAAIK,EAAEkP,QAAQ,IAAMnP,EAAI,IAAM,KAC9BI,EAAIH,EAAEqP,UAAU,EAAG,IAAMtP,EAAIJ,EAAI,IAErC,OADAA,EAAIK,EAAEqP,UAAU1P,EAAI,EAAGK,EAAEzC,OAAS,GAC3Bs8B,EAAE,IAAM95B,EAAII,EAAIA,EAAEsF,QAAQ8kB,EAAI,MAAO5qB,EAAGI,EACjD,CAEA,SAASoD,EAAGnD,EAAGD,GACb,IAAIJ,EAAIi4B,EAAE73B,EAAGA,EAAE6yC,WAAW,GAAI7yC,EAAE6yC,WAAW,GAAI7yC,EAAE6yC,WAAW,IAC5D,OAAOjzC,IAAMI,EAAI,IAAMJ,EAAE8F,QAAQJ,EAAI,YAAYgK,UAAU,GAAK,IAAMtP,EAAI,GAC5E,CAEA,SAASotB,EAAEntB,EAAGD,EAAGJ,EAAGQ,EAAGc,EAAGX,EAAGV,EAAGgB,EAAGL,EAAGE,GACpC,IAAK,IAAkBI,EAAdX,EAAI,EAAGY,EAAIf,EAAMG,EAAIkB,IAAKlB,EACjC,OAAQW,EAAI0gC,EAAErhC,GAAGiF,KAAK+O,EAAGlU,EAAGc,EAAGnB,EAAGQ,EAAGc,EAAGX,EAAGV,EAAGgB,EAAGL,EAAGE,IAClD,UAAK,EACL,KAAK,EACL,KAAK,EACL,KAAK,KACH,MAEF,QACEK,EAAID,EAIV,GAAIC,IAAMf,EAAG,OAAOe,CACtB,CAkBA,SAAS0hC,EAAExiC,GAGT,YADA,KADAA,EAAIA,EAAE6yC,UACWhZ,EAAI,KAAM75B,EAAI,oBAAsBA,EAAIa,EAAI,GAAKA,EAAI,EAAGg5B,EAAI75B,GAAKa,EAAI,GAC/E2hC,CACT,CAEA,SAAStuB,EAAElU,EAAGD,GACZ,IAAIJ,EAAIK,EAKR,GAJA,GAAKL,EAAEizC,WAAW,KAAOjzC,EAAIA,EAAEuH,QAE/BvH,EAAI,CADAA,GAGA,EAAIyB,EAAG,CACT,IAAIjB,EAAIgtB,GAAG,EAAGptB,EAAGJ,EAAGA,EAAG0pB,EAAGroB,EAAG,EAAG,EAAG,EAAG,QACtC,IAAWb,GAAK,kBAAoBA,IAAMJ,EAAII,EAChD,CAEA,IAAIc,EAAI+1B,EAAEW,EAAGh4B,EAAGI,EAAG,EAAG,GAKtB,OAJA,EAAIqB,SAAmD,KAA7CjB,EAAIgtB,GAAG,EAAGlsB,EAAGtB,EAAGA,EAAG0pB,EAAGroB,EAAGC,EAAE1D,OAAQ,EAAG,EAAG,MAAqB0D,EAAId,IACxE,GACJ6sB,EAAI,EACJhsB,EAAIqoB,EAAI,EACDpoB,CACT,CAEA,IAAI8B,EAAK,QACL20B,EAAI,YACJ50B,EAAK,OACLe,EAAK,UACLE,EAAK,sBACLR,EAAK,SACL0mB,EAAI,oBACJ7mB,EAAK,qBACL60B,EAAI,aACJ50B,EAAK,gBACL4pB,EAAI,qBACJhqB,EAAK,kBACLoC,EAAK,eACLqlB,EAAK,eACLH,EAAK,8BACLzmB,EAAK,mCACLH,EAAK,sBACL3C,EAAI,EACJqoB,EAAI,EACJ2D,EAAI,EACJnsB,EAAI,EACJ82B,EAAI,GACJ4J,EAAI,GACJngC,EAAI,EACJy4B,EAAI,KACJwL,EAAI,EAKR,OAHAnxB,EAAE4+B,IApEF,SAAS3Q,EAAEniC,GACT,OAAQA,GACN,UAAK,EACL,KAAK,KACHoB,EAAImgC,EAAEhkC,OAAS,EACf,MAEF,QACE,GAAI,oBAAsByC,EAAGuhC,EAAEngC,KAAOpB,OAAO,GAAI,kBAAoBA,EAAG,IAAK,IAAID,EAAI,EAAGJ,EAAIK,EAAEzC,OAAQwC,EAAIJ,IAAKI,EAC7GoiC,EAAEniC,EAAED,SACCslC,EAAU,IAAJrlC,EAGjB,OAAOmiC,CACT,EAuDAjuB,EAAE3M,IAAMi7B,OACR,IAAWK,GAAKL,EAAEK,GACX3uB,CACT,ECnjBA,QAjDmB,CACjB/H,wBAAyB,EACzBE,kBAAmB,EACnBC,iBAAkB,EAClBC,iBAAkB,EAClBC,QAAS,EACTC,aAAc,EACdC,gBAAiB,EACjBC,YAAa,EACbC,QAAS,EACTC,KAAM,EACNC,SAAU,EACVC,aAAc,EACdC,WAAY,EACZC,aAAc,EACdC,UAAW,EACXE,QAAS,EACTC,WAAY,EACZC,YAAa,EACbC,aAAc,EACdC,WAAY,EACZC,cAAe,EACfC,eAAgB,EAChBC,gBAAiB,EACjBolC,UAAW,EACXC,cAAe,EACfC,aAAc,EACdC,iBAAkB,EAClBtlC,WAAY,EACZE,WAAY,EACZC,QAAS,EACTC,MAAO,EACPC,QAAS,EACTC,QAAS,EACTC,OAAQ,EACRC,OAAQ,EACRC,KAAM,EACN8kC,gBAAiB,EAEjB7kC,YAAa,EACbC,aAAc,EACdC,YAAa,EACbC,gBAAiB,EACjBC,iBAAkB,EAClBC,iBAAkB,EAClBC,cAAe,EACfC,YAAa,GC9Cf,SAASukC,EAAQC,GACf,IAAIpK,EAAQ1qC,OAAO87B,OAAO,MAC1B,OAAO,SAAUiZ,GAEf,YADmBnB,IAAflJ,EAAMqK,KAAoBrK,EAAMqK,GAAOD,EAAGC,IACvCrK,EAAMqK,EACf,CACF,CCJA,IAAIC,EAAkB,o9HAElBC,EAA6BJ,GAAQ,SAAUV,GACjD,OAAOa,EAAgBnuC,KAAKstC,IAAgC,MAAvBA,EAAKE,WAAW,IAE3B,MAAvBF,EAAKE,WAAW,IAEhBF,EAAKE,WAAW,GAAK,EAC1B,qOCPA,IAAAhyC,EAAA,SACEjB,EACAgB,GAAA,QAEMJ,EAAS,CAACZ,EAAQ,IAEfe,EAAI,EAAG8xC,EAAM7xC,EAAepD,OAAQmD,EAAI8xC,EAAK9xC,GAAK,EACzDH,EAAOiR,KAAK7Q,EAAeD,GAAIf,EAAQe,EAAI,WAGtCH,CAAA,EAAAL,EAAA,SCVOS,GAAA,OACR,OAANA,GACa,iBAANA,GAC6D,qBAAnEA,EAAE6K,SAAW7K,EAAE6K,WAAajN,OAAOf,UAAUgO,SAASrG,KAAKxE,OAC3DhB,EAAAA,EAAAA,QAAOgB,EAAA,ECNG4gC,EAAchjC,OAAOk1C,OAAO,IAC5B5yC,EAAetC,OAAOk1C,OAAO,CAAC,GCD5B,SAASzmB,EAAWrtB,GAAA,MACV,mBAATA,CAAA,CCCD,SAASC,EACtBD,GAAA,OAKEA,EAAO7C,aAEP6C,EAAOrC,MACP,YCXW,SAASo2C,EAAkB/zC,GAAA,OACjCA,GAA8C,iBAA7BA,EAAOg0C,iBAAA,CCG1B,IAAMjc,EACS,oBAAZkc,cAAA,IACCA,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,KACNA,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYC,mBAAqBD,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYE,UAChD,cAOWr9B,EAA+B,oBAAXjT,QAA0B,gBAAiBA,OAE/D6rB,EAAiB0kB,QACC,kBAAtBC,kBACHA,kBACmB,oBAAZJ,cAAA,IAAkCA,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,UAAQ,IAC1CA,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYK,6BACyB,KAA5CL,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYK,4BACkC,UAA5CL,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYK,6BAEVL,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYK,iCAAA,IACPL,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYI,mBAAuE,KAAlCJ,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYI,oBAClC,UAAlCJ,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYI,mBAEVJ,CAAAA,SAAAA,aAAAA,WAAAA,GAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,qBAAAA,EAAAA,cAAAA,GAAYI,qBCHP,SAAS3qB,EACtB1pB,GAAA,QAAAgB,EAAAhD,UAAAJ,OACGgD,EAAA,IAAA4J,MAAAxJ,EAAA,EAAAA,EAAA,KAAAD,EAAA,EAAAA,EAAAC,EAAAD,IAAAH,EAAAG,EAAA,GAAA/C,UAAA+C,GAAA,MAGK,IAAIsG,MAAA,+CACuCrH,EAAA,0BAC7CY,EAAehD,OAAS,EAAI,UAAUgD,EAAek1B,KAAK,MAAU,IAIhB,CC9BrD,IAMDye,EAAA,oBAAAv0C,EAOQA,GAAA,KACLw0C,WAAa,IAAIC,YAVR,UAWT72C,OAXS,SAYTqK,IAAMjI,CAAA,KAAAgB,EAAAhB,EAAAnC,UAAA,OAAAmD,EAGb0zC,aAAA,SAAa10C,GAAA,QACPgB,EAAQ,EACHJ,EAAI,EAAGA,EAAIZ,EAAOY,IACzBI,GAASqD,KAAKmwC,WAAW5zC,GAAA,OAGpBI,CAAA,EAAAA,EAGT2zC,YAAA,SAAY30C,EAAegB,GAAA,GACrBhB,GAASqE,KAAKmwC,WAAW52C,OAAQ,SAC7BgD,EAAYyD,KAAKmwC,WACjBzzC,EAAUH,EAAUhD,OAEtBi1C,EAAU9xC,EACPf,GAAS6yC,IACdA,IAAY,GACE,GACZnpB,EAAiB,GAAI,GAAG1pB,GAAA,KAIvBw0C,WAAa,IAAIC,YAAY5B,GAAA,KAC7B2B,WAAW5sC,IAAIhH,GAAA,KACfhD,OAASi1C,EAAA,IAET,IAAI+B,EAAI7zC,EAAS6zC,EAAI/B,EAAS+B,IAAA,KAC5BJ,WAAWI,GAAK,UAIrB/0C,EAAYwE,KAAKqwC,aAAa10C,EAAQ,GACjCsB,EAAI,EAAGlB,EAAIY,EAAMpD,OAAQ0D,EAAIlB,EAAGkB,IACnC+C,KAAK4D,IAAI4sC,WAAWh1C,EAAWmB,EAAMM,MAAA,KAClCkzC,WAAWx0C,KAChBH,IAAA,EAAAmB,EAKN8zC,WAAA,SAAW90C,GAAA,GACLA,EAAQqE,KAAKzG,OAAQ,KACjBoD,EAASqD,KAAKmwC,WAAWx0C,GACzBY,EAAayD,KAAKqwC,aAAa10C,GAC/Be,EAAWH,EAAaI,EAAA,KAEzBwzC,WAAWx0C,GAAS,MAEpB,IAAI6yC,EAAIjyC,EAAYiyC,EAAI9xC,EAAU8xC,IAAA,KAChC5qC,IAAI8sC,WAAWn0C,EAAA,GAAAI,EAK1Bg0C,SAAA,SAASh1C,GAAA,IACHgB,EAAM,MACNhB,GAASqE,KAAKzG,QAAqC,IAA3ByG,KAAKmwC,WAAWx0C,GAAA,OACnCgB,EAAA,QAGHJ,EAASyD,KAAKmwC,WAAWx0C,GACzBe,EAAasD,KAAKqwC,aAAa10C,GAC/B6yC,EAAW9xC,EAAaH,EAErBg0C,EAAI7zC,EAAY6zC,EAAI/B,EAAU+B,IACrC5zC,GAAUqD,KAAK4D,IAAIgtC,QAAQL,GF9ET,mBEiFb5zC,CAAA,EAAAhB,CAAA,CAjFL,GCRFwiC,EAAuC,IAAI7qB,IAC3CxW,EAAuC,IAAIwW,IAC3ClX,EAAgB,EAQPuiC,EAAgB,SAAChjC,GAAA,GACxBwiC,EAAgB5Y,IAAI5pB,GAAA,OACdwiC,EAAgB35B,IAAI7I,GAAA,KAGvBmB,EAAgByoB,IAAInpB,IACzBA,IAAA,IAGIO,EAAQP,IAAA,OASd+hC,EAAgB56B,IAAI5H,EAAIgB,GACxBG,EAAgByG,IAAI5G,EAAOhB,GACpBgB,CAAA,EAGIuT,EAAgB,SAACvU,GAAA,OACrBmB,EAAgB0H,IAAI7I,EAAA,EAGhBqB,EAAgB,SAACrB,EAAYgB,GACpCA,GAASP,IACXA,EAAgBO,EAAQ,GAG1BwhC,EAAgB56B,IAAI5H,EAAIgB,GACxBG,EAAgByG,IAAI5G,EAAOhB,EAAA,EC3CvBq3B,EAAA,SAAoBU,EAAA,kCACpBzK,EAAY,IAAI4nB,OAAA,IAAWnd,EAAA,gDAkC3B1D,EAA4B,SAACr0B,EAAcgB,EAAYJ,GAAA,QAEvDG,EADE8xC,EAAQjyC,EAAQiE,MAAM,KAGnB+vC,EAAI,EAAG/0C,EAAIgzC,EAAMj1C,OAAQg3C,EAAI/0C,EAAG+0C,KAElC7zC,EAAO8xC,EAAM+B,KAChB50C,EAAMm1C,aAAan0C,EAAID,EAAA,EAKvBupB,EAAwB,SAACtqB,EAAcgB,GAAA,QACrCJ,GAASI,EAAMqK,aAAe,IAAIxG,MJxClB,aIyChB9D,EAAkB,GAEf8xC,EAAI,EAAG+B,EAAIh0C,EAAMhD,OAAQi1C,EAAI+B,EAAG/B,IAAK,KACtChzC,EAAOe,EAAMiyC,GAAGtrC,OAAA,GACjB1H,EAAA,KAECyB,EAASzB,EAAK2H,MAAM8lB,GAAA,GAEtBhsB,EAAQ,KACJlB,EAAkC,EAA1Bg1C,SAAS9zC,EAAO,GAAI,IAC5BC,EAAKD,EAAO,GAEJ,IAAVlB,IAEFiB,EAAcE,EAAInB,GAGlBi0B,EAA0Br0B,EAAOuB,EAAID,EAAO,IAC5CtB,EAAMq1C,SAASV,YAAYv0C,EAAOW,IAGpCA,EAAMnD,OAAS,OAEfmD,EAAM8Q,KAAKhS,EAAA,ICzEX6lC,EAAW,kBACmC4P,EAAAA,EAAoB,ECiB3Dx0C,EAAe,SAACd,GAAA,IACrBgB,EAAS8C,SAASyxC,KAClB30C,EAASZ,GAAUgB,EACnBD,EAAQ+C,SAASC,cAAc,SAC/B8uC,EAlBiB,SAAC7yC,GAAA,QAChBgB,EAAehB,EAAfw1C,WAEC50C,EAAII,EAAWpD,OAAQgD,GAAK,EAAGA,IAAK,KACrCG,EAAUC,EAAWJ,GAAA,GACvBG,GARa,IAQJA,EAAMsL,UAA6BtL,EAAM00C,aAAa1d,GAAA,OACxDh3B,CAAA,EANU,CAkBYH,GAC7Bg0C,OAAA,IAAc/B,EAA0BA,EAAUxtB,YAAc,KAEtEtkB,EAAM6E,aAAamyB,ENnBS,UMoB5Bh3B,EAAM6E,aNnBuB,sBACL,cMoBlB/F,EAAQ6lC,IAAA,OAEV7lC,GAAOkB,EAAM6E,aAAa,QAAS/F,GAEvCe,EAAOgjC,aAAa7iC,EAAO6zC,GAEpB7zC,CAAA,ECtBIysB,EAAA,oBAAAxtB,EAOCA,GAAA,IACJgB,EAAWqD,KAAKgjB,QAAUvmB,EAAad,GAG7CgB,EAAQgL,YAAYlI,SAASy+B,eAAe,UAEvCmT,MDae,SAAC11C,GAAA,GACnBA,EAAI01C,MAAA,OACG11C,EAAI01C,MAAA,QAIP10C,EAAgB8C,SAAhB6xC,YACC/0C,EAAI,EAAGG,EAAIC,EAAYpD,OAAQgD,EAAIG,EAAGH,IAAK,KAC5CiyC,EAAQ7xC,EAAYJ,GAAA,GACtBiyC,EAAM+C,YAAc51C,EAAA,OACb6yC,CAAA,CAIbnpB,EAAiB,IAdK,CCbE1oB,GAAA,KACjBpD,OAAS,MAAAoD,EAAAhB,EAAAnC,UAAA,OAAAmD,EAGhB6zC,WAAA,SAAW70C,EAAegB,GAAA,gBAEjB00C,MAAMb,WAAW7zC,EAAMhB,GAAA,KACvBpC,UAAA,CACE,CACP,MAAOoC,GAAA,QACA,GAAAgB,EAIX+zC,WAAA,SAAW/0C,GAAA,KACJ01C,MAAMX,WAAW/0C,GAAA,KACjBpC,QAAA,EAAAoD,EAGPi0C,QAAA,SAAQj1C,GAAA,IACAgB,EAAOqD,KAAKqxC,MAAMG,SAAS71C,GAAA,gBAE7BgB,GAA8C,iBAAjBA,EAAK80C,QAC7B90C,EAAK80C,QAEL,IAAA91C,CAAA,CAtCA,GA4CA+1C,EAAA,oBAAA/1C,EAOCA,GAAA,IACJgB,EAAWqD,KAAKgjB,QAAUvmB,EAAad,GAAA,KACxCg2C,MAAQh1C,EAAQw0C,WAAA,KAChB53C,OAAS,MAAAoD,EAAAhB,EAAAnC,UAAA,OAAAmD,EAGhB6zC,WAAA,SAAW70C,EAAegB,GAAA,GACpBhB,GAASqE,KAAKzG,QAAUoC,GAAS,EAAG,KAChCY,EAAOkD,SAASy+B,eAAevhC,GAC/BD,EAAUsD,KAAK2xC,MAAMh2C,GAAA,YACtBqnB,QAAQuc,aAAahjC,EAAMG,GAAW,WACtCnD,UAAA,CACE,SAEA,EAAAoD,EAIX+zC,WAAA,SAAW/0C,GAAA,KACJqnB,QAAQtb,YAAY1H,KAAK2xC,MAAMh2C,IAAA,KAC/BpC,QAAA,EAAAoD,EAGPi0C,QAAA,SAAQj1C,GAAA,OACFA,EAAQqE,KAAKzG,OACRyG,KAAK2xC,MAAMh2C,GAAOqL,YAElB,IAAArL,CAAA,CAlCA,GAwCAkjC,EAAA,oBAAAljC,EAKCA,GAAA,KACLi2C,MAAQ,QACRr4C,OAAS,MAAAoD,EAAAhB,EAAAnC,UAAA,OAAAmD,EAGhB6zC,WAAA,SAAW70C,EAAegB,GAAA,OACpBhB,GAASqE,KAAKzG,SAAA,KACXq4C,MAAMrL,OAAO5qC,EAAO,EAAGgB,GAAA,KACvBpD,UAAA,EACE,EAAAoD,EAMX+zC,WAAA,SAAW/0C,GAAA,KACJi2C,MAAMrL,OAAO5qC,EAAO,QACpBpC,QAAA,EAAAoD,EAGPi0C,QAAA,SAAQj1C,GAAA,OACFA,EAAQqE,KAAKzG,OACRyG,KAAK4xC,MAAMj2C,GAEX,IAAAA,CAAA,CA7BA,GC5FT6iC,EAAmB/rB,EAWjBuT,EAA+B,CACnC6rB,UAAWp/B,EACXq/B,mBAAoBzmB,GAIDqU,EAAA,oBAAA/jC,EAiBjBA,EACAgB,EACAJ,QAAA,IAFAZ,IAAAA,EAAgCkB,QAAA,IAChCF,IAAAA,EAA2C,CAAC,GAAD,KAGtC2J,QAAAvJ,EAAA,GACAipB,EAAA,GACArqB,GAAA,KAGAo2C,GAAKp1C,EAAA,KACLq1C,MAAQ,IAAI1+B,IAAI/W,GAAA,KAChB01C,SAAWt2C,EAAQk2C,UAGnB7xC,KAAKiyC,QAAUx/B,GAAc+rB,IAChCA,GAAA,EJyBwB,SAAC7iC,GAAA,QACvBgB,EAAQ8C,SAAS+mC,iBAAiBxT,GAE/Bz2B,EAAI,EAAGG,EAAIC,EAAMpD,OAAQgD,EAAIG,EAAGH,IAAK,KACtCiyC,EAAS7xC,EAAMJ,GACjBiyC,GJ7EsB,WI6EdA,EAAK0D,aAAaxe,KAC5BzN,EAAsBtqB,EAAO6yC,GAEzBA,EAAKzhC,YACPyhC,EAAKzhC,WAAWrF,YAAY8mC,GAAA,EATN,CIxBTxuC,MAAA,CAAArE,EArBZw2C,WAAP,SAAkBx2C,GAAA,OACTgjC,EAAchjC,EAAA,MAAAgB,EAAAhB,EAAAnC,UAAA,OAAAmD,EAwBvBy1C,uBAAA,SAAuBz1C,EAA+BJ,GAAA,gBAAAA,IAAAA,GAAA,GAC7C,IAAIZ,EAAAoB,EAAA,GACJiD,KAAKsG,QAAA,GAAY3J,GACtBqD,KAAK+xC,GACJx1C,GAAayD,KAAKgyC,YAAA,EAAU,EAAAr1C,EAIjC01C,mBAAA,SAAmB12C,GAAA,OACTqE,KAAK+xC,GAAGp2C,IAAOqE,KAAK+xC,GAAGp2C,IAAO,GAAK,GAAAgB,EAI7Cq0C,OAAA,kBACShxC,KAAK4D,MAAQ5D,KAAK4D,KDtEHrH,GAAAI,ECsEgCqD,KAAKsG,SDtErCurC,SAAUn1C,EAAAC,EAAAm1C,kBAAmBtD,EAAA7xC,EAAAiQ,OLCxBjR,EKAzBY,EACK,IAAIsiC,EAAW2P,GACb9xC,EACF,IAAIysB,EAASqlB,GAEb,IAAIkD,EAAQlD,GLJd,IAAI0B,EAAkBv0C,KADD,IAACA,EAAAgB,EKDLJ,EAAUG,EAAmB8xC,CAAA,EAAA7xC,EC0ErD21C,aAAA,SAAa32C,EAAYgB,GAAA,OAChBqD,KAAKgyC,MAAMzsB,IAAI5pB,IAAQqE,KAAKgyC,MAAMxtC,IAAI7I,GAAU4pB,IAAI5oB,EAAA,EAAAA,EAI7Dm0C,aAAA,SAAan1C,EAAYgB,GAAA,GACvBgiC,EAAchjC,GAETqE,KAAKgyC,MAAMzsB,IAAI5pB,GAAA,KAKZq2C,MAAMxtC,IAAI7I,GAAU2D,IAAI3C,OALP,KACjBJ,EAAa,IAAI2C,IACvB3C,EAAW+C,IAAI3C,GAAA,KACVq1C,MAAMzuC,IAAI5H,EAAIY,EAAA,GAAAI,EAOvB2zC,YAAA,SAAY30C,EAAYgB,EAAcJ,GAAA,KAC/Bu0C,aAAan1C,EAAIgB,GAAA,KACjBq0C,SAASV,YAAY3R,EAAchjC,GAAKY,EAAA,EAAAI,EAI/C41C,WAAA,SAAW52C,GACLqE,KAAKgyC,MAAMzsB,IAAI5pB,IAAA,KACXq2C,MAAMxtC,IAAI7I,GAAU62C,OAAA,EAAA71C,EAK9B81C,WAAA,SAAW92C,GAAA,KACJq1C,SAASP,WAAW9R,EAAchjC,IAAA,KAClC42C,WAAW52C,EAAA,EAAAgB,EAIlB+1C,SAAA,gBAGO9uC,SAAA,CAAM,EAAAjH,EAIb6K,SAAA,kBJpHyB,SAAC7L,GAAA,QACpBgB,EAAMhB,EAAMq1C,SACVz0C,EAAWI,EAAXpD,OAEJmD,EAAM,GACD8xC,EAAQ,EAAGA,EAAQjyC,EAAQiyC,IAAS,KACrC+B,EAAKrgC,EAAcs+B,GAAA,YACrB+B,EAAA,KAEE/0C,EAAQG,EAAMq2C,MAAMxtC,IAAI+rC,GACxBtzC,EAAQN,EAAIg0C,SAASnC,GAAA,GACtBhzC,GAAUyB,GAAUzB,EAAMuiC,KAAA,KAEzBhiC,EAAc23B,EAAA,KAAY8a,EAAA,QAAa+B,EAAA,KAEzCrzC,EAAU,YACV1B,GACFA,EAAMiF,SAAQ,SAAA9E,GACRA,EAAKpC,OAAS,IAChB2D,GAAcvB,EAAA,QAOpBe,GAAA,GAAUO,EAAQlB,EAAA,aAAqBmB,EAAA,uBAGlCR,CAAA,CA7BkB,CIqHJsD,KAAA,EAAArE,CAAA,CApGF,GCvBf2lC,EAAgB,WAOhBpS,EAAoB,SAACvzB,GAAA,OACzB4f,OAAOC,aAAa7f,GAAQA,EAAO,GAAK,GAAK,MAGhC,SAASs4B,EAAuBt4B,GAAA,IAEzCgB,EADAJ,EAAO,OAINI,EAAIwU,KAAKwhC,IAAIh3C,GAAOgB,EAZP,GAYwBA,EAAKA,EAZ7B,GAYgD,EAChEJ,EAAO2yB,EAAkBvyB,EAbT,IAa4BJ,EAAA,OAGtC2yB,EAAkBvyB,EAhBR,IAgB2BJ,GAAMkF,QAAQ6/B,EAAe,SCpBrE,IAKMzjB,EAAQ,SAACliB,EAAWgB,GAAA,QAC3BJ,EAAII,EAAEpD,OAEHgD,GACLZ,EAAS,GAAJA,EAAUgB,EAAEiyC,aAAaryC,GAAA,OAGzBZ,CAAA,EAII+jB,EAAO,SAAC/jB,GAAA,OACZkiB,EAjBW,KAiBCliB,EAAA,ECfN,SAASujB,EAAcvjB,GAAA,IAC/B,IAAIgB,EAAI,EAAGA,EAAIhB,EAAMpC,OAAQoD,GAAK,EAAG,KAClCJ,EAAOZ,EAAMgB,GAAA,GAEfqsB,EAAWzsB,KAAUmzC,EAAkBnzC,GAAA,QAGlC,SAIJ,CCPT,IAAMijB,EAAOE,EZIa,UYCLP,EAAA,oBAAAxjB,EAaPA,EAAgBgB,EAAqBJ,GAAA,KAC1Cq1C,MAAQj2C,EAAA,KACRi3C,cAAgB,QAChBC,eAAuB,IACzBt2C,GAA2BA,EAAUs2C,WACtC3zB,EAAcvjB,GAAA,KACXm3C,YAAcn2C,EAAA,KAIdo2C,SAAWl1B,EAAM2B,EAAM7iB,GAAA,KAEvBq2C,UAAYz2C,EAIjBmjC,EAAWyS,WAAWx1C,EAAA,QAAAhB,EAAAnC,UAQxBy5C,wBAAA,SAAwBt3C,EAA0BgB,EAAwBJ,GAAA,IAChEG,EAAgBsD,KAAhB8yC,YAEFtE,EAAQ,MAEVxuC,KAAKgzC,WACPxE,EAAMhhC,KAAKxN,KAAKgzC,UAAUC,wBAAwBt3C,EAAkBgB,EAAYJ,IAI9EyD,KAAK6yC,WAAat2C,EAAO22C,KAAA,GACvBlzC,KAAK4yC,eAAiBj2C,EAAW21C,aAAa51C,EAAasD,KAAK4yC,eAClEpE,EAAMhhC,KAAKxN,KAAK4yC,mBACX,KACCrC,EAAY4C,GAAQnzC,KAAK4xC,MAAOj2C,EAAkBgB,EAAYJ,GAAQk1B,KAAK,IAC3Ej2B,EAAOy4B,EAAapW,EAAM7d,KAAK+yC,SAAUxC,KAAe,OAEzD5zC,EAAW21C,aAAa51C,EAAalB,GAAO,KACzCyB,EAAqBV,EAAOg0C,EAAA,IAAe/0C,OAAA,EAAmBkB,GAEpEC,EAAW2zC,YAAY5zC,EAAalB,EAAMyB,EAAA,CAG5CuxC,EAAMhhC,KAAKhS,GAAA,KACNo3C,cAAgBp3C,CAAA,KAElB,SACGO,EAAWiE,KAAK4xC,MAAhBr4C,OACJ2D,EAAc2gB,EAAM7d,KAAK+yC,SAAUx2C,EAAO22C,MAC1C72C,EAAM,GAEDL,EAAI,EAAGA,EAAID,EAAQC,IAAK,KACzBG,EAAW6D,KAAK4xC,MAAM51C,GAAA,GAEJ,iBAAbG,EACTE,GAAOF,OAGF,GAAIA,EAAU,KACbK,EAAY22C,GAAQh3C,EAAUR,EAAkBgB,EAAYJ,GAC5DN,EAAakK,MAAMC,QAAQ5J,GAAaA,EAAUi1B,KAAK,IAAMj1B,EACnEU,EAAc2gB,EAAM3gB,EAAajB,EAAaD,GAC9CK,GAAOJ,CAAA,KAIPI,EAAK,KACDC,EAAO23B,EAAa/2B,IAAgB,OAErCP,EAAW21C,aAAa51C,EAAaJ,GAAO,KACzCS,EAAeR,EAAOF,EAAA,IAASC,OAAA,EAAmBI,GACxDC,EAAW2zC,YAAY5zC,EAAaJ,EAAMS,EAAA,CAG5CyxC,EAAMhhC,KAAKlR,EAAA,SAIRkyC,EAAM/c,KAAK,MAAA91B,CAAA,CA/FD,GCPf8jB,EAAgB,gBAChBxB,EAA0B,CAAC,IAAK,IAAK,IAAK,KAOjC,SAAST,EAAA7hB,GAAA,IAyBlBgB,EACAJ,EACAG,EACA8xC,EAAA+B,OAAA,IAAA50C,EAzB6BkB,EAAAlB,EAAAH,EAAA+0C,EAFjCjqC,QAAArJ,OAAA,IAAAzB,EAAUqB,EAAArB,EAAAO,EAAAw0C,EACV6C,QAAAl2C,OAAA,IAAAnB,EAAUwhC,EAAAxhC,EAEJM,EAAS,IAAIF,EAAOc,GAMtBjB,EAAe,GAWbQ,ECdR,SAAwBb,GAAA,SAIbgB,EAAQA,GAAA,GACXA,EAAA,IAEAhB,EAAcgB,EAAA,KACd,MAAOhB,GAAA,SAIN,SACLY,EACAG,EACA8xC,EACA+B,EACA/0C,EACAyB,EACAlB,EACAmB,EACAb,EACAL,GAAA,OAEQO,GAAA,KAED,KAEW,IAAVF,GAAyC,KAA1BK,EAAQkyC,WAAW,GAAW,OAAOjzC,EAAce,EAAA,KAAa,cAGhF,KACQ,IAAPQ,EAAU,OAAOR,EA/BT,mBAkCT,SACKQ,GAAA,KAED,SACA,WACIvB,EAAW6yC,EAAU,GAAK9xC,GAAU,kBAEpCA,GAAkB,IAAPV,EAzCV,QAyCiC,SAEzC,EACJU,EAAQ8D,MA3CI,UA2CUC,QAAQ9D,GAAA,EA7CtC,EDc4C,SAAAhB,GACxCK,EAAawR,KAAK7R,EAAA,IAQdM,EAAwB,SAACN,EAAOe,EAAQ6zC,GAAA,OAG9B,IAAX7zC,IAA8E,IAA/DuhB,EAAwB/S,QAAQqlC,EAAOh0C,EAAUhD,UAEhEg3C,EAAOptC,MAAMqrC,GAKT7yC,EAAA,IAHMgB,CAAA,WA4BNL,EAAeX,EAAK40C,EAAU/0C,EAAQyB,QAAA,IAAAA,IAAAA,EAAc,SACrDlB,EAAUJ,EAAI8F,QAAQge,EAAe,IACrCviB,EAASqzC,GAAY/0C,EAAYA,EAAA,IAAU+0C,EAAA,MAAcx0C,EAAA,KAAcA,EAAA,OAK7EY,EAAeM,EACfV,EAAYg0C,EACZ7zC,EAAkB,IAAIm0C,OAAA,KAAYt0C,EAAA,MAAgB,KAClDiyC,EAA4B,IAAIqC,OAAA,MAAat0C,EAAA,YAEtCF,EAAOb,IAAW+0C,EAAW,GAAKA,EAAUrzC,EAAA,QAdrDb,EAAOyyC,IAAA,GAAAzzC,OAAQ6B,EAAA,CAPwB,SAACvB,EAASgB,EAAG6xC,GAClC,IAAZ7yC,GAAiB6yC,EAAUj1C,QAAUi1C,EAAU,GAAG6E,YAAY92C,GAAa,IAE7EiyC,EAAU,GAAKA,EAAU,GAAG/sC,QAAQ/E,EAAiBT,GAAA,EAIDO,EAlD9B,SAAAb,GAAA,IACP,IAAbA,EAAgB,KACZgB,EAAcX,EAAA,OACpBA,EAAe,GACRW,CAAA,MA+DXL,EAAe42C,KAAOh2C,EAAQ3D,OAC1B2D,EACGo2C,QAAO,SAAC33C,EAAKgB,GAAA,OACPA,EAAOrD,MACV+rB,EAAiB,IAGZxH,EAAMliB,EAAKgB,EAAOrD,KAAA,GHnGf,MGqGXkO,WACH,GAEGlL,CAAA,KE3FIqhB,GAAgDjhB,EAAAA,gBAEhDwhB,IADqBP,GAAkBstB,SACMvuC,EAAAA,iBAG7CkhB,IAFiBM,GAAc+sB,SAEL,IAAIvL,GAC9B1hB,GAA4BR,IAEzC,SAAgB8B,KAAA,OACPixB,EAAAA,EAAAA,YAAW5yB,KAAsBC,EAAA,CAG1C,SAAgBE,KAAA,OACPyyB,EAAAA,EAAAA,YAAWryB,KAAkBF,EAAA,CAGvB,SAASiB,GAAkBtjB,GAAA,IAAAgB,GACV6xC,EAAAA,EAAAA,UAAS7yC,EAAM43C,eAAtCh3C,EAAAI,EAAA,GAAS4zC,EAAA5zC,EAAA,GACVZ,EAAoBujB,KAEpBpiB,GAAa1B,EAAAA,EAAAA,UAAQ,eACrBmB,EAAQZ,EAAA,OAERJ,EAAM01C,MAER10C,EAAQhB,EAAM01C,MACL11C,EAAMiR,SACfjQ,EAAQA,EAAMy1C,uBAAuB,CAAExlC,OAAQjR,EAAMiR,SAAA,IAGnDjR,EAAM63C,wBACR72C,EAAQA,EAAMy1C,uBAAuB,CAAEN,mBAAA,KAGlCn1C,CAAA,GACN,CAAChB,EAAM63C,sBAAuB73C,EAAM01C,MAAO11C,EAAMiR,SAE9CvQ,GAASb,EAAAA,EAAAA,UACb,kBACEgiB,EAAqB,CACnBlX,QAAS,CAAEuoC,QAASlzC,EAAM83C,uBAC1BL,QAAA72C,GAAA,GAEJ,CAACZ,EAAM83C,sBAAuBl3C,IAAA,OAGhCU,EAAAA,EAAAA,YAAU,WACHjB,IAAaO,EAASZ,EAAM43C,gBAAgBhD,EAAW50C,EAAM43C,cAAA,GACjE,CAAC53C,EAAM43C,gBAGR72C,EAAAA,cAACihB,GAAkBqtB,SAAA,CAAS/lC,MAAO/H,GACjCR,EAAAA,cAACwhB,GAAc8sB,SAAA,CAAS/lC,MAAO5I,GAGzBV,EAAMiL,UAAA,KCjEGmZ,GAAA,oBAAApkB,EAOPA,EAAcgB,GAAA,IAAAJ,EAAA,UAM1BosC,OAAS,SAAChtC,EAAwBgB,QAAA,IAAAA,IAAAA,EAA8BqhB,IAAA,IACxDthB,EAAeH,EAAKjD,KAAOqD,EAAeu2C,KAE3Cv3C,EAAW22C,aAAa/1C,EAAKiZ,GAAI9Y,IACpCf,EAAW20C,YACT/zC,EAAKiZ,GACL9Y,EACAC,EAAeJ,EAAKq1C,MAAOl1C,EAAc,qBAK/C8K,SAAW,kBACF6d,EAAiB,GAAI9J,OAAOhf,EAAKjD,MAAA,OAlBnCA,KAAOqC,EAAA,KACP6Z,GAAA,gBAAqB7Z,EAAA,KACrBi2C,MAAQj1C,CAAA,QAAAhB,EAAAnC,UAmBfk6C,QAAA,SAAQ/3C,GAAA,gBAAAA,IAAAA,EAA8BqiB,IAC7Bhe,KAAK1G,KAAOqC,EAAeu3C,IAAA,EAAAv3C,CAAA,CA9BjB,GCCfikB,GAAiB,UACjB7B,GAAmB,WACnB0F,GAAY,OACZ5D,GAAqB,SAAClkB,GAAA,UAA6BA,EAAK+E,aAAA,EAkB/C,SAAS8f,GAAmB7kB,GAAA,OAClCikB,GAAexe,KAAKzF,GACzBA,EACC8F,QAAQsc,GAAkB8B,IAC1Bpe,QAAQgiB,GAAW,QACpB9nB,CAAA,CClBJ,IAAM8hB,GAAY,SAAA9hB,GAAA,OAAS,MAAAA,IAAA,IAAyCA,GAA6B,KAAVA,CAAA,EAoBvF,SAAwBw3C,GACtBx3C,EACAY,EACAG,EACA8xC,GAAA,GAEIroC,MAAMC,QAAQzK,GAAQ,SAGY40C,EAF9B/0C,EAAU,GAEPyB,EAAI,EAAGlB,EAAMJ,EAAMpC,OAAgB0D,EAAIlB,EAAKkB,GAAK,EAGzC,MAFfszC,EAAS4C,GAAQx3C,EAAMsB,GAAIV,EAAkBG,EAAY8xC,MAGhDroC,MAAMC,QAAQmqC,GAAS/0C,EAAQgS,KAAAY,MAAR5S,EAAgB+0C,GAC3C/0C,EAAQgS,KAAK+iC,IAAA,OAGb/0C,CAAA,QAGLiiB,GAAU9hB,GACL,GAIL+zC,EAAkB/zC,GAAA,IACTA,EAAMg0C,kBAIf3mB,EAAWrtB,GC9DG,mBAFwBU,EDiEhBV,IC7DtBU,EAAK7C,WACF6C,EAAK7C,UAAUorC,mBD4DcroC,EAapBZ,EADLw3C,GAXQx3C,EAAMY,GAWEA,EAAkBG,EAAY8xC,GAIrD7yC,aAAiBokB,GACfrjB,GACFf,EAAMgtC,OAAOjsC,EAAY8xC,GAClB7yC,EAAM+3C,QAAQlF,IACT7yC,EAITO,EAAcP,GAzEM,SAAhBA,EAAiBgB,EAAaJ,GAAA,IEbHG,EAAc8xC,EFc9C+B,EAAQ,OAET,IAAM/0C,KAAOmB,EACXA,EAAIiD,eAAepE,KAAQiiB,GAAU9gB,EAAInB,MAEzC2K,MAAMC,QAAQzJ,EAAInB,KAASmB,EAAInB,GAAKm4C,OAAU3qB,EAAWrsB,EAAInB,IAChE+0C,EAAM/iC,KAAQgT,GAAUhlB,GAAA,IAASmB,EAAInB,GAAM,KAClCU,EAAcS,EAAInB,IAC3B+0C,EAAM/iC,KAAAY,MAANmiC,EAAc50C,EAAcgB,EAAInB,GAAMA,IAEtC+0C,EAAM/iC,KAAQgT,GAAUhlB,GAAA,MExBUkB,EFwBelB,GErBxC,OAHuCgzC,EFwBM7xC,EAAInB,KErBxB,kBAAVgzC,GAAiC,KAAVA,EAC1C,GAGY,iBAAVA,GAAgC,IAAVA,GAAiB9xC,KAAQF,GAAcE,EAAKk3C,WAAW,MAIjFr4B,OAAOizB,GAAOtrC,OAHTsrC,EAAA,oBFoBLjyC,EAAA,CAAcA,EAAA,MAAAlB,OAAgBk1C,EAAA,CAAO,MAAOA,CAAA,CAfxB,CAyEiB50C,GAASA,EAAM6L,WAX3C,IC9E0BnL,CDyFiB,CG9E7D,IAAMmlB,GAAS,SAAA7lB,GAAA,OACTwK,MAAMC,QAAQzK,KAEhBA,EAAIg4C,OAAA,GAECh4C,CAAA,EAGM,SAASukB,GAAIvkB,GAAA,QAAAgB,EAAAhD,UAAAJ,OAAmBgD,EAAA,IAAA4J,MAAAxJ,EAAA,EAAAA,EAAA,KAAAD,EAAA,EAAAA,EAAAC,EAAAD,IAAAH,EAAAG,EAAA,GAAA/C,UAAA+C,GAAA,OACzCssB,EAAWrtB,IAAWO,EAAcP,GAE/B6lB,GAAO2xB,GAAQv2C,EAAW2gC,EAAA,CAAc5hC,GAAAN,OAAWkB,MAG9B,IAA1BA,EAAehD,QAAkC,IAAlBoC,EAAOpC,QAAqC,iBAAdoC,EAAO,GAE/DA,EAIF6lB,GAAO2xB,GAAQv2C,EAAWjB,EAAQY,IAAA,CC3B9B,IAAI2C,IADjB,IAiDsBwiB,GAAA,SC9CN/lB,EAAcgB,EAAoBJ,GAAA,gBAAAA,IAAAA,EAAoBM,GAC5DlB,EAAMk4C,QAAUt3C,EAAas3C,OAASl4C,EAAMk4C,OAAUl3C,GAAiBJ,EAAas3C,KAAA,ECJxFrwB,GAAc,wCAEdjD,GAAe,WAMN,SAASoG,GAAOhrB,GAAA,OAE3BA,EAEG8F,QAAQ+hB,GAAa,KAGrB/hB,QAAQ8e,GAAc,ICd7B,IAAAmD,GAAA,SAAgB/nB,GAAA,OACPs4B,EAAuBvU,EAAK/jB,KAAS,ICH/B,SAASmkB,GAAMnkB,GAAA,MAER,iBAAXA,IACmB,CACgB,CCqB9C,IAAMkrB,GAAW,SAAAlrB,GAAA,MAEE,mBAARA,GAAsC,iBAARA,GAA4B,OAARA,IAAiBwK,MAAMC,QAAQzK,EAAA,EAItFioB,GAAa,SAAAjoB,GAAA,MACF,cAARA,GAA+B,gBAARA,GAAiC,cAARA,CAAA,EAGzD,SAASykB,GAAMzkB,EAAQgB,EAAKJ,GAAA,IACpBG,EAAMf,EAAOY,GACfsqB,GAASlqB,IAAQkqB,GAASnqB,GAC5BsjB,GAAUtjB,EAAKC,GAEfhB,EAAOY,GAAOI,CAAA,CAIH,SAASqjB,GAAUrkB,GAAA,QAAAgB,EAAAhD,UAAAJ,OAAWgD,EAAA,IAAA4J,MAAAxJ,EAAA,EAAAA,EAAA,KAAAD,EAAA,EAAAA,EAAAC,EAAAD,IAAAH,EAAAG,EAAA,GAAA/C,UAAA+C,GAAA,QAAA8xC,EAAA,EAAA+B,EACzBh0C,EAAAiyC,EAAA+B,EAAAh3C,OAAAi1C,IAAM,KAAbhzC,EAAA+0C,EAAA/B,GAAA,GACL3nB,GAASrrB,GAAA,IACN,IAAMyB,KAAOzB,EACZooB,GAAW3mB,IACbmjB,GAAMzkB,EAAQH,EAAIyB,GAAMA,EAAA,QAMzBtB,CAAA,KC5CIylB,GAAsC1kB,EAAAA,gBAEtB0kB,GAAa6pB,SCc1C,IAAMxqB,GAAc,CAAC,EA4IrB,SAAwB0D,GACtBxoB,EACAgB,EAOAJ,GAAA,IAEMiyC,EAAqBkB,EAAkB/zC,GACvCH,GAAwBskB,GAAMnkB,GAAAsB,EAMhCN,EAHFm3C,MAAA/3C,OAAA,IAAAkB,EAAQsgC,EAAAtgC,EAAAZ,EAGNM,EAFFm2C,YAAA92C,OAAA,IAAAK,EAzJJ,SAAoBV,EAAsBgB,GAAA,IAClCJ,EAA8B,iBAAhBZ,EAA2B,KAAOgrB,GAAOhrB,GAE7D8kB,GAAYlkB,IAASkkB,GAAYlkB,IAAS,GAAK,MAEzCG,EAAiBH,EAAA,IAAQmnB,G7BzBP,S6B4BTnnB,EAAOkkB,GAAYlkB,IAAA,OAG3BI,EAAuBA,EAAA,IAAqBD,EAAgBA,CAAA,CAXrE,CAyJ6BC,EAAQ7D,YAAa6D,EAAQo3C,mBAAA13C,EAAAF,EAEpDQ,EADF7D,YAAA0D,OAAA,IAAAL,ECtLW,SACbR,GAAA,OAEOmkB,GAAMnkB,GAAA,UAAoBA,EAAA,UAAqBC,EAAiBD,GAAA,IAH1D,CDsLuBA,GAAAQ,EAG9BS,EACJD,EAAQ7D,aAAe6D,EAAQm2C,YACxBnsB,GAAOhqB,EAAQ7D,aAAA,IAAgB6D,EAAQm2C,YAC1Cn2C,EAAQm2C,aAAe92C,EAGvBE,EACJsyC,GAAwB7yC,EAAgCm4C,MACpD3tC,MAAM3M,UAAU6B,OAASM,EAAgCm4C,MAAO/3C,GAAOi4C,OAAOjE,SAC9Eh0C,EAGF23B,EAAoB/2B,EAAQs3C,kBAE5BzF,GAAsB7yC,EAAOs4C,oBAG7BvgB,EAFE/2B,EAAQs3C,kBAEU,SAAC13C,EAAMG,EAAU8xC,GAAA,OAC/B7yC,EAAgCs4C,kBAClC13C,EACAG,EACA8xC,IAEA7xC,EAAQs3C,kBAA4C13C,EAAMG,EAAU8xC,EAAA,EAGlD7yC,EAAgCs4C,mBAAA,IAkBtD72C,EAdEqV,EAAiB,IAAI0M,EACzB5iB,EACAK,EACA4xC,EAAuB7yC,EAAgBu4C,oBAAA,GAKnC7oB,EAAW5Y,EAAeogC,UAA6B,IAAjB92C,EAAMxC,OAQ5Cq6B,EAAa,SAACj4B,EAAOgB,GAAA,OA7I7B,SACEhB,EACAgB,EACAJ,EACAG,GAAA,IAGS8xC,EAOL7yC,EAPFm4C,MACAt4C,EAMEG,EANFu4C,eACAj3C,EAKEtB,EALF9C,aACAkD,EAIEJ,EAJFw4C,mBACA93C,EAGEV,EAHFs4C,kBACAj4C,EAEEL,EAFFg0C,kBACAxzC,EACER,EADFiR,OAAApQ,EA7DJ,SAAkCb,EAA2BgB,EAAeJ,QAAA,IAA1CZ,IAAAA,EAAakB,GAAA,IAIvCH,EAAAK,EAAA,GAAeJ,EAAA,CAAOk3C,MAAAl4C,IACtB6yC,EAAgB,CAAC,EAAD,OAEtBjyC,EAAMkE,SAAQ,SAAA9E,GAAA,IAERgB,EErD4BJ,EAAYg0C,EFoDxC/0C,EAAkBG,EAAA,IAQjBgB,KALDqsB,EAAWxtB,KACbA,EAAkBA,EAAgBkB,IAIxBlB,EACVkB,EAAQC,GAAO6xC,EAAc7xC,GACnB,cAARA,GE9D4BJ,EF+DZiyC,EAAc7xC,GE/DU4zC,EF+DJ/0C,EAAgBmB,GE9DnDJ,GAAKg0C,EAAOh0C,EAAA,IAAKg0C,EAAMh0C,GAAKg0C,GF+DzB/0C,EAAgBmB,EAAA,IAKnB,CAACD,EAAS8xC,EAAA,CAzBnB,CAmEgB9sB,GAAe/kB,GAAO4zC,EAAAA,EAAAA,YAAWnvB,IAAenkB,IAEXJ,EAAcF,EAAO6xC,GAAjElyC,EAAAE,EAAA,GAASI,EAAAJ,EAAA,GAEVN,EA3CR,SACEP,EACAgB,EACAJ,EACAG,GAAA,IAEM8xC,EAAalvB,KACbixB,EAASzyB,KAIuD,OAFpDnhB,EACdhB,EAAes3C,wBAAwBp2C,EAAc2xC,EAAY+B,GACjE50C,EAAes3C,wBAAwB12C,EAAeiyC,EAAY+B,EAM/D,CAjBT,CA4CI/0C,EACAkB,EACAJ,GAIIihC,EAAehhC,EAEfX,EAA6BgB,EAAMw3C,KAAOz3C,EAAMy3C,KAAOx3C,EAAMy3C,IAAM13C,EAAM03C,IAAMl4C,EAE/EuzC,EAAc5vB,GAAMlkB,GACpB83B,EAAgB92B,IAAUD,EAAAI,EAAA,GAAaJ,EAAA,GAAUC,GAAUD,EAC3DS,EAAkB,CAAC,EAAD,IAGnB,IAAMqV,KAAOihB,EACD,MAAXjhB,EAAI,IAAsB,OAARA,IACL,gBAARA,EACPrV,EAAgBi3C,GAAK3gB,EAAcjhB,IAEnCpW,EACIA,EAAkBoW,EAAKxW,EAAWL,IAClC8zC,GACAzzC,EAAUwW,MAIdrV,EAAgBqV,GAAOihB,EAAcjhB,KAAA,OAIrC9V,EAAMsO,OAASrO,EAAMqO,QAAUtO,EAAMsO,QACvC7N,EAAgB6N,MAAAlO,EAAA,GAAaJ,EAAMsO,MAAA,GAAUrO,EAAMqO,QAGrD7N,EAAgBk3C,UAAYnuC,MAAM3M,UAC/B6B,OACCU,EACAC,EACAE,IAAuBF,EAAoBE,EAAqB,KAChES,EAAM23C,UACN13C,EAAM03C,WAEPN,OAAOjE,SACPte,KAAK,KAERr0B,EAAgBi0B,IAAMkM,GAEfrgC,EAAAA,EAAAA,eAActB,EAAoBwB,EAAA,CAxE3C,CA+I2BA,EAAwBzB,EAAOgB,EAAK0uB,EAAA,SAE7DuI,EAAW96B,YAAc0D,GAEzBY,EAA2BV,EAAAA,WAAiBk3B,IACrBkgB,MAAQ53C,EAC/BkB,EAAuB82C,eAAiBzhC,EACxCrV,EAAuBtE,YAAc0D,EACrCY,EAAuB62C,kBAAoBvgB,EAI3Ct2B,EAAuB+2C,mBAAqB3F,EACxCroC,MAAM3M,UAAU6B,OACZM,EAAgCw4C,mBAChCx4C,EAAgCg0C,mBAEpCpS,EAEJngC,EAAuBuyC,kBAAoB/yC,EAG3CQ,EAAuBwP,OAAS4hC,EAC1B7yC,EAAgCiR,OAClCjR,EAEJyB,EAAuBm3C,cAAgB,SAAuB54C,GAAA,IACvCe,EAA0CC,EAAvDm2C,YAAqCtE,EAAA,SAAA7yC,EAAAgB,GAAA,SAAAhB,EAAA,aAAAY,EAAAG,EAAA8xC,EAAA,GAAA+B,EAAAh2C,OAAAa,KAAAO,GAAA,IAAAe,EAAA,EAAAA,EAAA6zC,EAAAh3C,OAAAmD,IAAAH,EAAAg0C,EAAA7zC,GAAAC,EAAAuO,QAAA3O,IAAA,IAAAiyC,EAAAjyC,GAAAZ,EAAAY,IAAA,OAAAiyC,CAAA,EAAkB7xC,EAAA,iBAEzD4zC,EACJ7zC,GACGA,EAAA,KAAuBojB,GAAMnkB,GAAOA,EAAMgrB,GAAO/qB,EAAiBD,KAAA,OAQhEwoB,GAAsBxoB,EAAAoB,EAAA,GALxByxC,EAAA,CACHsF,MAAO53C,EACP42C,YAAavC,IAG+Bh0C,EAAA,EAGhDhC,OAAOD,eAAe8C,EAAwB,eAAgB,CAC5DoH,IAAA,kBACSxE,KAAKw0C,mBAAA,EAGdjxC,IAAA,SAAI5G,GAAA,KACG63C,oBAAsBhG,EACvBxuB,GAAM,CAAC,EAAKrkB,EAAgC9C,aAAc8D,GAC1DA,CAAA,IAiBRpC,OAAOD,eAAe8C,EAAwB,WAAY,CAAE6H,MAAO,qBAAU7H,EAAuBuyC,iBAAA,IAEhGn0C,GACFc,IAIEc,EAA0BzB,EAA0D,CAEpFm4C,OAAA,EACAI,gBAAA,EACAp7C,aAAA,EACAq7C,oBAAA,EACAF,mBAAA,EACAtE,mBAAA,EACA/iC,QAAA,EACA2nC,eAAA,IAIGn3C,CAAA,CGlUT,ICIMmiB,GAAS,SAAC5jB,GAAA,gBCCQA,EACtBgB,EACAD,EACA8xC,GAAA,YAAAA,IAAAA,EAAkB3xC,KAEbN,EAAAA,EAAAA,oBAAmBG,GAAA,OACf2oB,EAAiB,EAAG9J,OAAO7e,IAAA,IAK9B6zC,EAAmB,kBAAa5zC,EAAqBD,EAAK8xC,EAAStuB,GAAA9R,WAAA,EAAAzU,WAAA,SAGzE42C,EAAiBkE,WAAa,SAAAl4C,GAAA,OAC5BZ,EAAqBgB,EAAsBD,EAAAK,EAAA,GAAUyxC,EAAA,GAAYjyC,GAAA,EAGnEg0C,EAAiBuD,MAAQ,SAAAv3C,GAAA,OACvBZ,EAAqBgB,EAAsBD,EAAAK,EAAA,GACtCyxC,EAAA,CACHsF,MAAO3tC,MAAM3M,UAAU6B,OAAOmzC,EAAQsF,MAAOv3C,GAAOy3C,OAAOjE,WAAA,EAGxDQ,CAAA,CDzBO,CAAqCpsB,GAAiBxoB,EAAA,EDJvD,CACb,IACA,OACA,UACA,OACA,UACA,QACA,QACA,IACA,OACA,MACA,MACA,MACA,aACA,OACA,KACA,SACA,SACA,UACA,OACA,OACA,MACA,WACA,OACA,WACA,KACA,MACA,UACA,MACA,SACA,MACA,KACA,KACA,KACA,QACA,WACA,aACA,SACA,SACA,OACA,KACA,KACA,KACA,KACA,KACA,KACA,OACA,SACA,SACA,KACA,OACA,IACA,SACA,MACA,QACA,MACA,MACA,SACA,QACA,SACA,KACA,OACA,OACA,MACA,OACA,UACA,OACA,WACA,OACA,QACA,MACA,WACA,SACA,KACA,WACA,SACA,SACA,IACA,QACA,UACA,MACA,WACA,IACA,KACA,KACA,OACA,IACA,OACA,SACA,UACA,SACA,QACA,SACA,OACA,SACA,QACA,MACA,UACA,MACA,QACA,QACA,KACA,WACA,QACA,KACA,QACA,OACA,QACA,KACA,QACA,IACA,KACA,MACA,QACA,MAGA,SACA,WACA,OACA,UACA,gBACA,IACA,QACA,OACA,iBACA,SACA,OACA,OACA,UACA,UACA,WACA,iBACA,OACA,OACA,MACA,OACA,WACA,SCnIU8E,SAAQ,SAAA9E,GAClB4jB,GAAO5jB,GAAc4jB,GAAO5jB,EAAA,KELT,oBAAAA,EAOPA,EAAgBgB,GAAA,KACrBi1C,MAAQj2C,EAAA,KACRm3C,YAAcn2C,EAAA,KACdk2C,SAAW3zB,EAAcvjB,GAI9B+jC,EAAWyS,WAAWnyC,KAAK8yC,YAAc,OAAAn2C,EAAAhB,EAAAnC,UAAAmD,EAG3C+3C,aAAA,SACE/4C,EACAgB,EACAJ,EACAG,GAAA,IAGM8xC,EAAM9xC,EADIy2C,GAAQnzC,KAAK4xC,MAAOj1C,EAAkBJ,EAAYG,GACvC+0B,KAAK,IAAK,IAC/B8e,EAAKvwC,KAAK8yC,YAAcn3C,EAG9BY,EAAW+zC,YAAYC,EAAIA,EAAI/B,EAAA,EAAA7xC,EAGjCg4C,aAAA,SAAah5C,EAAkBgB,GAC7BA,EAAW81C,WAAWzyC,KAAK8yC,YAAcn3C,EAAA,EAAAgB,EAG3Ci4C,aAAA,SACEj5C,EACAgB,EACAJ,EACAG,GAEIf,EAAW,GAAG+jC,EAAWyS,WAAWnyC,KAAK8yC,YAAcn3C,GAAA,KAGtDg5C,aAAah5C,EAAUY,GAAA,KACvBm4C,aAAa/4C,EAAUgB,EAAkBJ,EAAYG,EAAA,EA7CzC,ICOA,oBAAAf,IAAA,IAAAA,EAAA,UAYnBk5C,cAAgB,eACRl4C,EAAMhB,EAAKwpB,SAAS3d,WAAA,IACrB7K,EAAK,MAAO,OAEXJ,EAAQ8kC,IAAA,gBACA,CAAC9kC,GAAA,UAAmBA,EAAA,IAAam3B,EAAA,UAAqB,gCAC7CsgB,OAAOjE,SAASte,KAAK,SAEf90B,EAAA,iBAW/Bm4C,aAAe,kBACTn5C,EAAKo5C,OACA1vB,EAAiB,GAGnB1pB,EAAKk5C,eAAA,OAGdG,gBAAkB,eAAAr4C,EAAA,GACZhB,EAAKo5C,OAAA,OACA1vB,EAAiB,OAGpB9oB,IAAAI,EAAA,IACH+2B,GAAU,GAAA/2B,EpC9Cc,uBACL,SAAAA,EoC+CpBgK,wBAAyB,CACvB4gB,OAAQ5rB,EAAKwpB,SAAS3d,YAAA7K,GAIpB6xC,EAAQnN,IAAA,OACVmN,IACDjyC,EAAY04C,MAAQzG,GAIhB,CAAC9xC,EAAAA,cAAA,QAAAK,EAAA,GAAWR,EAAA,CAAOd,IAAI,mBAsDhCy5C,KAAO,WACLv5C,EAAKo5C,QAAA,CAAS,OAzGT5vB,SAAW,IAAIua,EAAW,CAAEmS,UAAA,IAAU,KACtCkD,QAAA,CAAS,KAAAp4C,EAAAhB,EAAAnC,UAAAmD,EAchBw4C,cAAA,SAAcx5C,GAAA,OACRqE,KAAK+0C,OACA1vB,EAAiB,GAGnB3oB,EAAAA,cAACuiB,GAAA,CAAkBoyB,MAAOrxC,KAAKmlB,UAAWxpB,EAAA,EAAAgB,EAkCnDy4C,yBAAA,SAAyBz5C,GAAA,OAEd0pB,EAAiB,IAhET,GCwCqB,0BCnD1C,MAAMgwB,GAAoBpqC,IACxB,MAAMqqC,EAAW71C,SAASC,cAAc,YAExC,OADA41C,EAAS/zC,aAAa,QAAS0J,GACxB1Q,OAAOg7C,QAAQD,EAASrqC,OAC5B+oC,QAAOwB,IAAA,IAAE/5C,GAAI+5C,EAAA,OAAM,WAAWp0C,KAAK3F,EAAI,IACvCu4C,QAAOyB,IAAA,IAAE,CAAExwC,GAAMwwC,EAAA,OAAK1F,QAAQ9qC,EAAM,IACpCquC,QAAO,CAACoC,EAAGC,KAAA,IAAGl6C,EAAKwJ,GAAM0wC,EAAA,MAAM,IAAKD,EAAK,CAACj6C,GAAMwJ,EAAO,GAAG,CAAC,EAAE,EAG5D2wC,GAAeC,GAAO54C,CAAE;;;;;;;;;;;;;;;;;;;;EAkC9B,GAZkB64C,IAAoC,IAAnC,MAAE7qC,GAA2B6qC,EAC9C,OACEC,EAAAA,GAAAA,KAACH,GAAY,CACXr0B,KAAK,qCACL3U,OAAO,SACP3B,MAAOA,EAAQoqC,GAAiBpqC,GAAS,CAAC,EAAErE,UAE5CmvC,EAAAA,GAAAA,KAAA,QAAAnvC,SAAM,4BACO,ECnCnB,GAJmB4uC,IAAoC,IAAnC,MAAEvqC,GAA2BuqC,EAC/C,OAAOO,EAAAA,GAAAA,KAACC,GAAS,CAAC/qC,MAAOA,GAAS,iBCgBrB,SAA8BuqC,GAGhC,IAHsD,KACjEl8C,EACAW,UAAWw1B,GACH+lB,EACR,MAAMS,EAAoB,cAAcC,YAItC3xC,cACE4xC,QAAO,KAJQC,eAAS,OACTC,gBAAU,EAKzBr2C,KAAKo2C,UAAY32C,SAASC,cAAc,QACxCM,KAAKq2C,WAAa52C,SAASC,cAAc,OACzCM,KAAKs2C,aAAa,CAAErqB,KAAM,QAC5B,CAEAsqB,oBACE,GAAIv2C,KAAKw2C,YAAa,CAAC,IAADC,EAAAC,EACpB,MAAM5C,EAAQv5C,OAAOuI,OAAO,CAAC,KAAMqD,MAAMwwC,KAAK32C,KAAK42C,YAAYnB,IAAA,IAAC,KAAEn8C,EAAI,MAAE2L,GAAOwwC,EAAA,MAAM,CAAE,CAACn8C,GAAO2L,EAAO,KAEvF,QAAfwxC,EAAAz2C,KAAK62C,kBAAU,IAAAJ,GAAfA,EAAiB9uC,YAAY3H,KAAKo2C,WACnB,QAAfM,EAAA12C,KAAK62C,kBAAU,IAAAH,GAAfA,EAAiB/uC,YAAY3H,KAAKq2C,YAEpBS,GAAAA,WAAoB92C,KAAKq2C,YACjCj8C,QACJ27C,EAAAA,GAAAA,KAACgB,GAAiB,CAACnqC,OAAQ5M,KAAKo2C,UAAUxvC,UACxCmvC,EAAAA,GAAAA,KAACtmB,EAAS,IAAKqkB,MAGrB,CACF,CAEAkD,uBAC0B,IAADC,EAAAC,EAAlBl3C,KAAKw2C,cACO,QAAfS,EAAAj3C,KAAK62C,kBAAU,IAAAI,GAAfA,EAAiBvvC,YAAY1H,KAAKq2C,YACnB,QAAfa,EAAAl3C,KAAK62C,kBAAU,IAAAK,GAAfA,EAAiBxvC,YAAY1H,KAAKo2C,WAEtC,GAGFe,eAAeC,OAAO99C,EAAM28C,EAC9B,CCzDAoB,CAAsB,CACpB/9C,KAAM,iBACNW,UAAWq9C","sources":["../node_modules/hoist-non-react-statics/dist/hoist-non-react-statics.cjs.js","../node_modules/hoist-non-react-statics/node_modules/react-is/cjs/react-is.production.min.js","../node_modules/hoist-non-react-statics/node_modules/react-is/index.js","../node_modules/react-dom/cjs/react-dom.production.min.js","../node_modules/react-dom/client.js","../node_modules/react-dom/index.js","../node_modules/react-is/cjs/react-is.production.min.js","../node_modules/react-is/index.js","../node_modules/react/cjs/react-jsx-runtime.production.min.js","../node_modules/react/cjs/react.production.min.js","../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/scheduler/cjs/scheduler.production.min.js","../node_modules/scheduler/index.js","../node_modules/shallowequal/index.js","../webpack/bootstrap","../webpack/runtime/compat get default export","../webpack/runtime/define property getters","../webpack/runtime/hasOwnProperty shorthand","../webpack/runtime/nonce","../node_modules/@emotion/stylis/dist/stylis.browser.esm.js","../node_modules/@emotion/unitless/dist/unitless.browser.esm.js","../node_modules/@emotion/memoize/dist/emotion-memoize.esm.js","../node_modules/@emotion/is-prop-valid/dist/emotion-is-prop-valid.esm.js","../node_modules/styled-components/src/utils/interleave.js","../node_modules/styled-components/src/utils/isPlainObject.js","../node_modules/styled-components/src/utils/empties.js","../node_modules/styled-components/src/utils/isFunction.js","../node_modules/styled-components/src/utils/getComponentName.js","../node_modules/styled-components/src/utils/isStyledComponent.js","../node_modules/styled-components/src/constants.js","../node_modules/styled-components/src/utils/error.js","../node_modules/styled-components/src/sheet/GroupedTag.js","../node_modules/styled-components/src/sheet/GroupIDAllocator.js","../node_modules/styled-components/src/sheet/Rehydration.js","../node_modules/styled-components/src/utils/nonce.js","../node_modules/styled-components/src/sheet/dom.js","../node_modules/styled-components/src/sheet/Tag.js","../node_modules/styled-components/src/sheet/Sheet.js","../node_modules/styled-components/src/utils/generateAlphabeticName.js","../node_modules/styled-components/src/utils/hash.js","../node_modules/styled-components/src/utils/isStaticRules.js","../node_modules/styled-components/src/models/ComponentStyle.js","../node_modules/styled-components/src/utils/stylis.js","../node_modules/styled-components/src/utils/stylisPluginInsertRule.js","../node_modules/styled-components/src/models/StyleSheetManager.js","../node_modules/styled-components/src/models/Keyframes.js","../node_modules/styled-components/src/utils/hyphenateStyleName.js","../node_modules/styled-components/src/utils/flatten.js","../node_modules/styled-components/src/utils/isStatelessFunction.js","../node_modules/styled-components/src/utils/addUnitIfNeeded.js","../node_modules/styled-components/src/constructors/css.js","../node_modules/styled-components/src/utils/checkDynamicCreation.js","../node_modules/styled-components/src/utils/determineTheme.js","../node_modules/styled-components/src/utils/escape.js","../node_modules/styled-components/src/utils/generateComponentId.js","../node_modules/styled-components/src/utils/isTag.js","../node_modules/styled-components/src/utils/mixinDeep.js","../node_modules/styled-components/src/models/ThemeProvider.js","../node_modules/styled-components/src/models/StyledComponent.js","../node_modules/styled-components/src/utils/generateDisplayName.js","../node_modules/styled-components/src/utils/joinStrings.js","../node_modules/styled-components/src/utils/domElements.js","../node_modules/styled-components/src/constructors/styled.js","../node_modules/styled-components/src/constructors/constructWithOptions.js","../node_modules/styled-components/src/models/GlobalStyle.js","../node_modules/styled-components/src/models/ServerStyleSheet.js","../node_modules/styled-components/src/base.js","components/HubButton.tsx","App.tsx","utils/register-custom-element.tsx","index.tsx"],"sourcesContent":["'use strict';\n\nvar reactIs = require('react-is');\n\n/**\n * Copyright 2015, Yahoo! Inc.\n * Copyrights licensed under the New BSD License. See the accompanying LICENSE file for terms.\n */\nvar REACT_STATICS = {\n  childContextTypes: true,\n  contextType: true,\n  contextTypes: true,\n  defaultProps: true,\n  displayName: true,\n  getDefaultProps: true,\n  getDerivedStateFromError: true,\n  getDerivedStateFromProps: true,\n  mixins: true,\n  propTypes: true,\n  type: true\n};\nvar KNOWN_STATICS = {\n  name: true,\n  length: true,\n  prototype: true,\n  caller: true,\n  callee: true,\n  arguments: true,\n  arity: true\n};\nvar FORWARD_REF_STATICS = {\n  '$$typeof': true,\n  render: true,\n  defaultProps: true,\n  displayName: true,\n  propTypes: true\n};\nvar MEMO_STATICS = {\n  '$$typeof': true,\n  compare: true,\n  defaultProps: true,\n  displayName: true,\n  propTypes: true,\n  type: true\n};\nvar TYPE_STATICS = {};\nTYPE_STATICS[reactIs.ForwardRef] = FORWARD_REF_STATICS;\nTYPE_STATICS[reactIs.Memo] = MEMO_STATICS;\n\nfunction getStatics(component) {\n  // React v16.11 and below\n  if (reactIs.isMemo(component)) {\n    return MEMO_STATICS;\n  } // React v16.12 and above\n\n\n  return TYPE_STATICS[component['$$typeof']] || REACT_STATICS;\n}\n\nvar defineProperty = Object.defineProperty;\nvar getOwnPropertyNames = Object.getOwnPropertyNames;\nvar getOwnPropertySymbols = Object.getOwnPropertySymbols;\nvar getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;\nvar getPrototypeOf = Object.getPrototypeOf;\nvar objectPrototype = Object.prototype;\nfunction hoistNonReactStatics(targetComponent, sourceComponent, blacklist) {\n  if (typeof sourceComponent !== 'string') {\n    // don't hoist over string (html) components\n    if (objectPrototype) {\n      var inheritedComponent = getPrototypeOf(sourceComponent);\n\n      if (inheritedComponent && inheritedComponent !== objectPrototype) {\n        hoistNonReactStatics(targetComponent, inheritedComponent, blacklist);\n      }\n    }\n\n    var keys = getOwnPropertyNames(sourceComponent);\n\n    if (getOwnPropertySymbols) {\n      keys = keys.concat(getOwnPropertySymbols(sourceComponent));\n    }\n\n    var targetStatics = getStatics(targetComponent);\n    var sourceStatics = getStatics(sourceComponent);\n\n    for (var i = 0; i < keys.length; ++i) {\n      var key = keys[i];\n\n      if (!KNOWN_STATICS[key] && !(blacklist && blacklist[key]) && !(sourceStatics && sourceStatics[key]) && !(targetStatics && targetStatics[key])) {\n        var descriptor = getOwnPropertyDescriptor(sourceComponent, key);\n\n        try {\n          // Avoid failures from read-only properties\n          defineProperty(targetComponent, key, descriptor);\n        } catch (e) {}\n      }\n    }\n  }\n\n  return targetComponent;\n}\n\nmodule.exports = hoistNonReactStatics;\n","/** @license React v16.13.1\n * react-is.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n\n'use strict';var b=\"function\"===typeof Symbol&&Symbol.for,c=b?Symbol.for(\"react.element\"):60103,d=b?Symbol.for(\"react.portal\"):60106,e=b?Symbol.for(\"react.fragment\"):60107,f=b?Symbol.for(\"react.strict_mode\"):60108,g=b?Symbol.for(\"react.profiler\"):60114,h=b?Symbol.for(\"react.provider\"):60109,k=b?Symbol.for(\"react.context\"):60110,l=b?Symbol.for(\"react.async_mode\"):60111,m=b?Symbol.for(\"react.concurrent_mode\"):60111,n=b?Symbol.for(\"react.forward_ref\"):60112,p=b?Symbol.for(\"react.suspense\"):60113,q=b?\nSymbol.for(\"react.suspense_list\"):60120,r=b?Symbol.for(\"react.memo\"):60115,t=b?Symbol.for(\"react.lazy\"):60116,v=b?Symbol.for(\"react.block\"):60121,w=b?Symbol.for(\"react.fundamental\"):60117,x=b?Symbol.for(\"react.responder\"):60118,y=b?Symbol.for(\"react.scope\"):60119;\nfunction z(a){if(\"object\"===typeof a&&null!==a){var u=a.$$typeof;switch(u){case c:switch(a=a.type,a){case l:case m:case e:case g:case f:case p:return a;default:switch(a=a&&a.$$typeof,a){case k:case n:case t:case r:case h:return a;default:return u}}case d:return u}}}function A(a){return z(a)===m}exports.AsyncMode=l;exports.ConcurrentMode=m;exports.ContextConsumer=k;exports.ContextProvider=h;exports.Element=c;exports.ForwardRef=n;exports.Fragment=e;exports.Lazy=t;exports.Memo=r;exports.Portal=d;\nexports.Profiler=g;exports.StrictMode=f;exports.Suspense=p;exports.isAsyncMode=function(a){return A(a)||z(a)===l};exports.isConcurrentMode=A;exports.isContextConsumer=function(a){return z(a)===k};exports.isContextProvider=function(a){return z(a)===h};exports.isElement=function(a){return\"object\"===typeof a&&null!==a&&a.$$typeof===c};exports.isForwardRef=function(a){return z(a)===n};exports.isFragment=function(a){return z(a)===e};exports.isLazy=function(a){return z(a)===t};\nexports.isMemo=function(a){return z(a)===r};exports.isPortal=function(a){return z(a)===d};exports.isProfiler=function(a){return z(a)===g};exports.isStrictMode=function(a){return z(a)===f};exports.isSuspense=function(a){return z(a)===p};\nexports.isValidElementType=function(a){return\"string\"===typeof a||\"function\"===typeof a||a===e||a===m||a===g||a===f||a===p||a===q||\"object\"===typeof a&&null!==a&&(a.$$typeof===t||a.$$typeof===r||a.$$typeof===h||a.$$typeof===k||a.$$typeof===n||a.$$typeof===w||a.$$typeof===x||a.$$typeof===y||a.$$typeof===v)};exports.typeOf=z;\n","'use strict';\n\nif (process.env.NODE_ENV === 'production') {\n  module.exports = require('./cjs/react-is.production.min.js');\n} else {\n  module.exports = require('./cjs/react-is.development.js');\n}\n","/**\n * @license React\n * react-dom.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n/*\n Modernizr 3.0.0pre (Custom Build) | MIT\n*/\n'use strict';var aa=require(\"react\"),ca=require(\"scheduler\");function p(a){for(var b=\"https://reactjs.org/docs/error-decoder.html?invariant=\"+a,c=1;c<arguments.length;c++)b+=\"&args[]=\"+encodeURIComponent(arguments[c]);return\"Minified React error #\"+a+\"; visit \"+b+\" for the full message or use the non-minified dev environment for full errors and additional helpful warnings.\"}var da=new Set,ea={};function fa(a,b){ha(a,b);ha(a+\"Capture\",b)}\nfunction ha(a,b){ea[a]=b;for(a=0;a<b.length;a++)da.add(b[a])}\nvar ia=!(\"undefined\"===typeof window||\"undefined\"===typeof window.document||\"undefined\"===typeof window.document.createElement),ja=Object.prototype.hasOwnProperty,ka=/^[:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD][:A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD\\-.0-9\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$/,la=\n{},ma={};function oa(a){if(ja.call(ma,a))return!0;if(ja.call(la,a))return!1;if(ka.test(a))return ma[a]=!0;la[a]=!0;return!1}function pa(a,b,c,d){if(null!==c&&0===c.type)return!1;switch(typeof b){case \"function\":case \"symbol\":return!0;case \"boolean\":if(d)return!1;if(null!==c)return!c.acceptsBooleans;a=a.toLowerCase().slice(0,5);return\"data-\"!==a&&\"aria-\"!==a;default:return!1}}\nfunction qa(a,b,c,d){if(null===b||\"undefined\"===typeof b||pa(a,b,c,d))return!0;if(d)return!1;if(null!==c)switch(c.type){case 3:return!b;case 4:return!1===b;case 5:return isNaN(b);case 6:return isNaN(b)||1>b}return!1}function v(a,b,c,d,e,f,g){this.acceptsBooleans=2===b||3===b||4===b;this.attributeName=d;this.attributeNamespace=e;this.mustUseProperty=c;this.propertyName=a;this.type=b;this.sanitizeURL=f;this.removeEmptyString=g}var z={};\n\"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style\".split(\" \").forEach(function(a){z[a]=new v(a,0,!1,a,null,!1,!1)});[[\"acceptCharset\",\"accept-charset\"],[\"className\",\"class\"],[\"htmlFor\",\"for\"],[\"httpEquiv\",\"http-equiv\"]].forEach(function(a){var b=a[0];z[b]=new v(b,1,!1,a[1],null,!1,!1)});[\"contentEditable\",\"draggable\",\"spellCheck\",\"value\"].forEach(function(a){z[a]=new v(a,2,!1,a.toLowerCase(),null,!1,!1)});\n[\"autoReverse\",\"externalResourcesRequired\",\"focusable\",\"preserveAlpha\"].forEach(function(a){z[a]=new v(a,2,!1,a,null,!1,!1)});\"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope\".split(\" \").forEach(function(a){z[a]=new v(a,3,!1,a.toLowerCase(),null,!1,!1)});\n[\"checked\",\"multiple\",\"muted\",\"selected\"].forEach(function(a){z[a]=new v(a,3,!0,a,null,!1,!1)});[\"capture\",\"download\"].forEach(function(a){z[a]=new v(a,4,!1,a,null,!1,!1)});[\"cols\",\"rows\",\"size\",\"span\"].forEach(function(a){z[a]=new v(a,6,!1,a,null,!1,!1)});[\"rowSpan\",\"start\"].forEach(function(a){z[a]=new v(a,5,!1,a.toLowerCase(),null,!1,!1)});var ra=/[\\-:]([a-z])/g;function sa(a){return a[1].toUpperCase()}\n\"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-name glyph-orientation-horizontal glyph-orientation-vertical horiz-adv-x horiz-origin-x image-rendering letter-spacing lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-rendering underline-position underline-thickness unicode-bidi unicode-range units-per-em v-alphabetic v-hanging v-ideographic v-mathematical vector-effect vert-adv-y vert-origin-x vert-origin-y word-spacing writing-mode xmlns:xlink x-height\".split(\" \").forEach(function(a){var b=a.replace(ra,\nsa);z[b]=new v(b,1,!1,a,null,!1,!1)});\"xlink:actuate xlink:arcrole xlink:role xlink:show xlink:title xlink:type\".split(\" \").forEach(function(a){var b=a.replace(ra,sa);z[b]=new v(b,1,!1,a,\"http://www.w3.org/1999/xlink\",!1,!1)});[\"xml:base\",\"xml:lang\",\"xml:space\"].forEach(function(a){var b=a.replace(ra,sa);z[b]=new v(b,1,!1,a,\"http://www.w3.org/XML/1998/namespace\",!1,!1)});[\"tabIndex\",\"crossOrigin\"].forEach(function(a){z[a]=new v(a,1,!1,a.toLowerCase(),null,!1,!1)});\nz.xlinkHref=new v(\"xlinkHref\",1,!1,\"xlink:href\",\"http://www.w3.org/1999/xlink\",!0,!1);[\"src\",\"href\",\"action\",\"formAction\"].forEach(function(a){z[a]=new v(a,1,!1,a.toLowerCase(),null,!0,!0)});\nfunction ta(a,b,c,d){var e=z.hasOwnProperty(b)?z[b]:null;if(null!==e?0!==e.type:d||!(2<b.length)||\"o\"!==b[0]&&\"O\"!==b[0]||\"n\"!==b[1]&&\"N\"!==b[1])qa(b,c,e,d)&&(c=null),d||null===e?oa(b)&&(null===c?a.removeAttribute(b):a.setAttribute(b,\"\"+c)):e.mustUseProperty?a[e.propertyName]=null===c?3===e.type?!1:\"\":c:(b=e.attributeName,d=e.attributeNamespace,null===c?a.removeAttribute(b):(e=e.type,c=3===e||4===e&&!0===c?\"\":\"\"+c,d?a.setAttributeNS(d,b,c):a.setAttribute(b,c)))}\nvar ua=aa.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED,va=Symbol.for(\"react.element\"),wa=Symbol.for(\"react.portal\"),ya=Symbol.for(\"react.fragment\"),za=Symbol.for(\"react.strict_mode\"),Aa=Symbol.for(\"react.profiler\"),Ba=Symbol.for(\"react.provider\"),Ca=Symbol.for(\"react.context\"),Da=Symbol.for(\"react.forward_ref\"),Ea=Symbol.for(\"react.suspense\"),Fa=Symbol.for(\"react.suspense_list\"),Ga=Symbol.for(\"react.memo\"),Ha=Symbol.for(\"react.lazy\");Symbol.for(\"react.scope\");Symbol.for(\"react.debug_trace_mode\");\nvar Ia=Symbol.for(\"react.offscreen\");Symbol.for(\"react.legacy_hidden\");Symbol.for(\"react.cache\");Symbol.for(\"react.tracing_marker\");var Ja=Symbol.iterator;function Ka(a){if(null===a||\"object\"!==typeof a)return null;a=Ja&&a[Ja]||a[\"@@iterator\"];return\"function\"===typeof a?a:null}var A=Object.assign,La;function Ma(a){if(void 0===La)try{throw Error();}catch(c){var b=c.stack.trim().match(/\\n( *(at )?)/);La=b&&b[1]||\"\"}return\"\\n\"+La+a}var Na=!1;\nfunction Oa(a,b){if(!a||Na)return\"\";Na=!0;var c=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(b)if(b=function(){throw Error();},Object.defineProperty(b.prototype,\"props\",{set:function(){throw Error();}}),\"object\"===typeof Reflect&&Reflect.construct){try{Reflect.construct(b,[])}catch(l){var d=l}Reflect.construct(a,[],b)}else{try{b.call()}catch(l){d=l}a.call(b.prototype)}else{try{throw Error();}catch(l){d=l}a()}}catch(l){if(l&&d&&\"string\"===typeof l.stack){for(var e=l.stack.split(\"\\n\"),\nf=d.stack.split(\"\\n\"),g=e.length-1,h=f.length-1;1<=g&&0<=h&&e[g]!==f[h];)h--;for(;1<=g&&0<=h;g--,h--)if(e[g]!==f[h]){if(1!==g||1!==h){do if(g--,h--,0>h||e[g]!==f[h]){var k=\"\\n\"+e[g].replace(\" at new \",\" at \");a.displayName&&k.includes(\"<anonymous>\")&&(k=k.replace(\"<anonymous>\",a.displayName));return k}while(1<=g&&0<=h)}break}}}finally{Na=!1,Error.prepareStackTrace=c}return(a=a?a.displayName||a.name:\"\")?Ma(a):\"\"}\nfunction Pa(a){switch(a.tag){case 5:return Ma(a.type);case 16:return Ma(\"Lazy\");case 13:return Ma(\"Suspense\");case 19:return Ma(\"SuspenseList\");case 0:case 2:case 15:return a=Oa(a.type,!1),a;case 11:return a=Oa(a.type.render,!1),a;case 1:return a=Oa(a.type,!0),a;default:return\"\"}}\nfunction Qa(a){if(null==a)return null;if(\"function\"===typeof a)return a.displayName||a.name||null;if(\"string\"===typeof a)return a;switch(a){case ya:return\"Fragment\";case wa:return\"Portal\";case Aa:return\"Profiler\";case za:return\"StrictMode\";case Ea:return\"Suspense\";case Fa:return\"SuspenseList\"}if(\"object\"===typeof a)switch(a.$$typeof){case Ca:return(a.displayName||\"Context\")+\".Consumer\";case Ba:return(a._context.displayName||\"Context\")+\".Provider\";case Da:var b=a.render;a=a.displayName;a||(a=b.displayName||\nb.name||\"\",a=\"\"!==a?\"ForwardRef(\"+a+\")\":\"ForwardRef\");return a;case Ga:return b=a.displayName||null,null!==b?b:Qa(a.type)||\"Memo\";case Ha:b=a._payload;a=a._init;try{return Qa(a(b))}catch(c){}}return null}\nfunction Ra(a){var b=a.type;switch(a.tag){case 24:return\"Cache\";case 9:return(b.displayName||\"Context\")+\".Consumer\";case 10:return(b._context.displayName||\"Context\")+\".Provider\";case 18:return\"DehydratedFragment\";case 11:return a=b.render,a=a.displayName||a.name||\"\",b.displayName||(\"\"!==a?\"ForwardRef(\"+a+\")\":\"ForwardRef\");case 7:return\"Fragment\";case 5:return b;case 4:return\"Portal\";case 3:return\"Root\";case 6:return\"Text\";case 16:return Qa(b);case 8:return b===za?\"StrictMode\":\"Mode\";case 22:return\"Offscreen\";\ncase 12:return\"Profiler\";case 21:return\"Scope\";case 13:return\"Suspense\";case 19:return\"SuspenseList\";case 25:return\"TracingMarker\";case 1:case 0:case 17:case 2:case 14:case 15:if(\"function\"===typeof b)return b.displayName||b.name||null;if(\"string\"===typeof b)return b}return null}function Sa(a){switch(typeof a){case \"boolean\":case \"number\":case \"string\":case \"undefined\":return a;case \"object\":return a;default:return\"\"}}\nfunction Ta(a){var b=a.type;return(a=a.nodeName)&&\"input\"===a.toLowerCase()&&(\"checkbox\"===b||\"radio\"===b)}\nfunction Ua(a){var b=Ta(a)?\"checked\":\"value\",c=Object.getOwnPropertyDescriptor(a.constructor.prototype,b),d=\"\"+a[b];if(!a.hasOwnProperty(b)&&\"undefined\"!==typeof c&&\"function\"===typeof c.get&&\"function\"===typeof c.set){var e=c.get,f=c.set;Object.defineProperty(a,b,{configurable:!0,get:function(){return e.call(this)},set:function(a){d=\"\"+a;f.call(this,a)}});Object.defineProperty(a,b,{enumerable:c.enumerable});return{getValue:function(){return d},setValue:function(a){d=\"\"+a},stopTracking:function(){a._valueTracker=\nnull;delete a[b]}}}}function Va(a){a._valueTracker||(a._valueTracker=Ua(a))}function Wa(a){if(!a)return!1;var b=a._valueTracker;if(!b)return!0;var c=b.getValue();var d=\"\";a&&(d=Ta(a)?a.checked?\"true\":\"false\":a.value);a=d;return a!==c?(b.setValue(a),!0):!1}function Xa(a){a=a||(\"undefined\"!==typeof document?document:void 0);if(\"undefined\"===typeof a)return null;try{return a.activeElement||a.body}catch(b){return a.body}}\nfunction Ya(a,b){var c=b.checked;return A({},b,{defaultChecked:void 0,defaultValue:void 0,value:void 0,checked:null!=c?c:a._wrapperState.initialChecked})}function Za(a,b){var c=null==b.defaultValue?\"\":b.defaultValue,d=null!=b.checked?b.checked:b.defaultChecked;c=Sa(null!=b.value?b.value:c);a._wrapperState={initialChecked:d,initialValue:c,controlled:\"checkbox\"===b.type||\"radio\"===b.type?null!=b.checked:null!=b.value}}function ab(a,b){b=b.checked;null!=b&&ta(a,\"checked\",b,!1)}\nfunction bb(a,b){ab(a,b);var c=Sa(b.value),d=b.type;if(null!=c)if(\"number\"===d){if(0===c&&\"\"===a.value||a.value!=c)a.value=\"\"+c}else a.value!==\"\"+c&&(a.value=\"\"+c);else if(\"submit\"===d||\"reset\"===d){a.removeAttribute(\"value\");return}b.hasOwnProperty(\"value\")?cb(a,b.type,c):b.hasOwnProperty(\"defaultValue\")&&cb(a,b.type,Sa(b.defaultValue));null==b.checked&&null!=b.defaultChecked&&(a.defaultChecked=!!b.defaultChecked)}\nfunction db(a,b,c){if(b.hasOwnProperty(\"value\")||b.hasOwnProperty(\"defaultValue\")){var d=b.type;if(!(\"submit\"!==d&&\"reset\"!==d||void 0!==b.value&&null!==b.value))return;b=\"\"+a._wrapperState.initialValue;c||b===a.value||(a.value=b);a.defaultValue=b}c=a.name;\"\"!==c&&(a.name=\"\");a.defaultChecked=!!a._wrapperState.initialChecked;\"\"!==c&&(a.name=c)}\nfunction cb(a,b,c){if(\"number\"!==b||Xa(a.ownerDocument)!==a)null==c?a.defaultValue=\"\"+a._wrapperState.initialValue:a.defaultValue!==\"\"+c&&(a.defaultValue=\"\"+c)}var eb=Array.isArray;\nfunction fb(a,b,c,d){a=a.options;if(b){b={};for(var e=0;e<c.length;e++)b[\"$\"+c[e]]=!0;for(c=0;c<a.length;c++)e=b.hasOwnProperty(\"$\"+a[c].value),a[c].selected!==e&&(a[c].selected=e),e&&d&&(a[c].defaultSelected=!0)}else{c=\"\"+Sa(c);b=null;for(e=0;e<a.length;e++){if(a[e].value===c){a[e].selected=!0;d&&(a[e].defaultSelected=!0);return}null!==b||a[e].disabled||(b=a[e])}null!==b&&(b.selected=!0)}}\nfunction gb(a,b){if(null!=b.dangerouslySetInnerHTML)throw Error(p(91));return A({},b,{value:void 0,defaultValue:void 0,children:\"\"+a._wrapperState.initialValue})}function hb(a,b){var c=b.value;if(null==c){c=b.children;b=b.defaultValue;if(null!=c){if(null!=b)throw Error(p(92));if(eb(c)){if(1<c.length)throw Error(p(93));c=c[0]}b=c}null==b&&(b=\"\");c=b}a._wrapperState={initialValue:Sa(c)}}\nfunction ib(a,b){var c=Sa(b.value),d=Sa(b.defaultValue);null!=c&&(c=\"\"+c,c!==a.value&&(a.value=c),null==b.defaultValue&&a.defaultValue!==c&&(a.defaultValue=c));null!=d&&(a.defaultValue=\"\"+d)}function jb(a){var b=a.textContent;b===a._wrapperState.initialValue&&\"\"!==b&&null!==b&&(a.value=b)}function kb(a){switch(a){case \"svg\":return\"http://www.w3.org/2000/svg\";case \"math\":return\"http://www.w3.org/1998/Math/MathML\";default:return\"http://www.w3.org/1999/xhtml\"}}\nfunction lb(a,b){return null==a||\"http://www.w3.org/1999/xhtml\"===a?kb(b):\"http://www.w3.org/2000/svg\"===a&&\"foreignObject\"===b?\"http://www.w3.org/1999/xhtml\":a}\nvar mb,nb=function(a){return\"undefined\"!==typeof MSApp&&MSApp.execUnsafeLocalFunction?function(b,c,d,e){MSApp.execUnsafeLocalFunction(function(){return a(b,c,d,e)})}:a}(function(a,b){if(\"http://www.w3.org/2000/svg\"!==a.namespaceURI||\"innerHTML\"in a)a.innerHTML=b;else{mb=mb||document.createElement(\"div\");mb.innerHTML=\"<svg>\"+b.valueOf().toString()+\"</svg>\";for(b=mb.firstChild;a.firstChild;)a.removeChild(a.firstChild);for(;b.firstChild;)a.appendChild(b.firstChild)}});\nfunction ob(a,b){if(b){var c=a.firstChild;if(c&&c===a.lastChild&&3===c.nodeType){c.nodeValue=b;return}}a.textContent=b}\nvar pb={animationIterationCount:!0,aspectRatio:!0,borderImageOutset:!0,borderImageSlice:!0,borderImageWidth:!0,boxFlex:!0,boxFlexGroup:!0,boxOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:!0,fontWeight:!0,lineClamp:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,tabSize:!0,widows:!0,zIndex:!0,\nzoom:!0,fillOpacity:!0,floodOpacity:!0,stopOpacity:!0,strokeDasharray:!0,strokeDashoffset:!0,strokeMiterlimit:!0,strokeOpacity:!0,strokeWidth:!0},qb=[\"Webkit\",\"ms\",\"Moz\",\"O\"];Object.keys(pb).forEach(function(a){qb.forEach(function(b){b=b+a.charAt(0).toUpperCase()+a.substring(1);pb[b]=pb[a]})});function rb(a,b,c){return null==b||\"boolean\"===typeof b||\"\"===b?\"\":c||\"number\"!==typeof b||0===b||pb.hasOwnProperty(a)&&pb[a]?(\"\"+b).trim():b+\"px\"}\nfunction sb(a,b){a=a.style;for(var c in b)if(b.hasOwnProperty(c)){var d=0===c.indexOf(\"--\"),e=rb(c,b[c],d);\"float\"===c&&(c=\"cssFloat\");d?a.setProperty(c,e):a[c]=e}}var tb=A({menuitem:!0},{area:!0,base:!0,br:!0,col:!0,embed:!0,hr:!0,img:!0,input:!0,keygen:!0,link:!0,meta:!0,param:!0,source:!0,track:!0,wbr:!0});\nfunction ub(a,b){if(b){if(tb[a]&&(null!=b.children||null!=b.dangerouslySetInnerHTML))throw Error(p(137,a));if(null!=b.dangerouslySetInnerHTML){if(null!=b.children)throw Error(p(60));if(\"object\"!==typeof b.dangerouslySetInnerHTML||!(\"__html\"in b.dangerouslySetInnerHTML))throw Error(p(61));}if(null!=b.style&&\"object\"!==typeof b.style)throw Error(p(62));}}\nfunction vb(a,b){if(-1===a.indexOf(\"-\"))return\"string\"===typeof b.is;switch(a){case \"annotation-xml\":case \"color-profile\":case \"font-face\":case \"font-face-src\":case \"font-face-uri\":case \"font-face-format\":case \"font-face-name\":case \"missing-glyph\":return!1;default:return!0}}var wb=null;function xb(a){a=a.target||a.srcElement||window;a.correspondingUseElement&&(a=a.correspondingUseElement);return 3===a.nodeType?a.parentNode:a}var yb=null,zb=null,Ab=null;\nfunction Bb(a){if(a=Cb(a)){if(\"function\"!==typeof yb)throw Error(p(280));var b=a.stateNode;b&&(b=Db(b),yb(a.stateNode,a.type,b))}}function Eb(a){zb?Ab?Ab.push(a):Ab=[a]:zb=a}function Fb(){if(zb){var a=zb,b=Ab;Ab=zb=null;Bb(a);if(b)for(a=0;a<b.length;a++)Bb(b[a])}}function Gb(a,b){return a(b)}function Hb(){}var Ib=!1;function Jb(a,b,c){if(Ib)return a(b,c);Ib=!0;try{return Gb(a,b,c)}finally{if(Ib=!1,null!==zb||null!==Ab)Hb(),Fb()}}\nfunction Kb(a,b){var c=a.stateNode;if(null===c)return null;var d=Db(c);if(null===d)return null;c=d[b];a:switch(b){case \"onClick\":case \"onClickCapture\":case \"onDoubleClick\":case \"onDoubleClickCapture\":case \"onMouseDown\":case \"onMouseDownCapture\":case \"onMouseMove\":case \"onMouseMoveCapture\":case \"onMouseUp\":case \"onMouseUpCapture\":case \"onMouseEnter\":(d=!d.disabled)||(a=a.type,d=!(\"button\"===a||\"input\"===a||\"select\"===a||\"textarea\"===a));a=!d;break a;default:a=!1}if(a)return null;if(c&&\"function\"!==\ntypeof c)throw Error(p(231,b,typeof c));return c}var Lb=!1;if(ia)try{var Mb={};Object.defineProperty(Mb,\"passive\",{get:function(){Lb=!0}});window.addEventListener(\"test\",Mb,Mb);window.removeEventListener(\"test\",Mb,Mb)}catch(a){Lb=!1}function Nb(a,b,c,d,e,f,g,h,k){var l=Array.prototype.slice.call(arguments,3);try{b.apply(c,l)}catch(m){this.onError(m)}}var Ob=!1,Pb=null,Qb=!1,Rb=null,Sb={onError:function(a){Ob=!0;Pb=a}};function Tb(a,b,c,d,e,f,g,h,k){Ob=!1;Pb=null;Nb.apply(Sb,arguments)}\nfunction Ub(a,b,c,d,e,f,g,h,k){Tb.apply(this,arguments);if(Ob){if(Ob){var l=Pb;Ob=!1;Pb=null}else throw Error(p(198));Qb||(Qb=!0,Rb=l)}}function Vb(a){var b=a,c=a;if(a.alternate)for(;b.return;)b=b.return;else{a=b;do b=a,0!==(b.flags&4098)&&(c=b.return),a=b.return;while(a)}return 3===b.tag?c:null}function Wb(a){if(13===a.tag){var b=a.memoizedState;null===b&&(a=a.alternate,null!==a&&(b=a.memoizedState));if(null!==b)return b.dehydrated}return null}function Xb(a){if(Vb(a)!==a)throw Error(p(188));}\nfunction Yb(a){var b=a.alternate;if(!b){b=Vb(a);if(null===b)throw Error(p(188));return b!==a?null:a}for(var c=a,d=b;;){var e=c.return;if(null===e)break;var f=e.alternate;if(null===f){d=e.return;if(null!==d){c=d;continue}break}if(e.child===f.child){for(f=e.child;f;){if(f===c)return Xb(e),a;if(f===d)return Xb(e),b;f=f.sibling}throw Error(p(188));}if(c.return!==d.return)c=e,d=f;else{for(var g=!1,h=e.child;h;){if(h===c){g=!0;c=e;d=f;break}if(h===d){g=!0;d=e;c=f;break}h=h.sibling}if(!g){for(h=f.child;h;){if(h===\nc){g=!0;c=f;d=e;break}if(h===d){g=!0;d=f;c=e;break}h=h.sibling}if(!g)throw Error(p(189));}}if(c.alternate!==d)throw Error(p(190));}if(3!==c.tag)throw Error(p(188));return c.stateNode.current===c?a:b}function Zb(a){a=Yb(a);return null!==a?$b(a):null}function $b(a){if(5===a.tag||6===a.tag)return a;for(a=a.child;null!==a;){var b=$b(a);if(null!==b)return b;a=a.sibling}return null}\nvar ac=ca.unstable_scheduleCallback,bc=ca.unstable_cancelCallback,cc=ca.unstable_shouldYield,dc=ca.unstable_requestPaint,B=ca.unstable_now,ec=ca.unstable_getCurrentPriorityLevel,fc=ca.unstable_ImmediatePriority,gc=ca.unstable_UserBlockingPriority,hc=ca.unstable_NormalPriority,ic=ca.unstable_LowPriority,jc=ca.unstable_IdlePriority,kc=null,lc=null;function mc(a){if(lc&&\"function\"===typeof lc.onCommitFiberRoot)try{lc.onCommitFiberRoot(kc,a,void 0,128===(a.current.flags&128))}catch(b){}}\nvar oc=Math.clz32?Math.clz32:nc,pc=Math.log,qc=Math.LN2;function nc(a){a>>>=0;return 0===a?32:31-(pc(a)/qc|0)|0}var rc=64,sc=4194304;\nfunction tc(a){switch(a&-a){case 1:return 1;case 2:return 2;case 4:return 4;case 8:return 8;case 16:return 16;case 32:return 32;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return a&4194240;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return a&130023424;case 134217728:return 134217728;case 268435456:return 268435456;case 536870912:return 536870912;case 1073741824:return 1073741824;\ndefault:return a}}function uc(a,b){var c=a.pendingLanes;if(0===c)return 0;var d=0,e=a.suspendedLanes,f=a.pingedLanes,g=c&268435455;if(0!==g){var h=g&~e;0!==h?d=tc(h):(f&=g,0!==f&&(d=tc(f)))}else g=c&~e,0!==g?d=tc(g):0!==f&&(d=tc(f));if(0===d)return 0;if(0!==b&&b!==d&&0===(b&e)&&(e=d&-d,f=b&-b,e>=f||16===e&&0!==(f&4194240)))return b;0!==(d&4)&&(d|=c&16);b=a.entangledLanes;if(0!==b)for(a=a.entanglements,b&=d;0<b;)c=31-oc(b),e=1<<c,d|=a[c],b&=~e;return d}\nfunction vc(a,b){switch(a){case 1:case 2:case 4:return b+250;case 8:case 16:case 32:case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:return b+5E3;case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:return-1;case 134217728:case 268435456:case 536870912:case 1073741824:return-1;default:return-1}}\nfunction wc(a,b){for(var c=a.suspendedLanes,d=a.pingedLanes,e=a.expirationTimes,f=a.pendingLanes;0<f;){var g=31-oc(f),h=1<<g,k=e[g];if(-1===k){if(0===(h&c)||0!==(h&d))e[g]=vc(h,b)}else k<=b&&(a.expiredLanes|=h);f&=~h}}function xc(a){a=a.pendingLanes&-1073741825;return 0!==a?a:a&1073741824?1073741824:0}function yc(){var a=rc;rc<<=1;0===(rc&4194240)&&(rc=64);return a}function zc(a){for(var b=[],c=0;31>c;c++)b.push(a);return b}\nfunction Ac(a,b,c){a.pendingLanes|=b;536870912!==b&&(a.suspendedLanes=0,a.pingedLanes=0);a=a.eventTimes;b=31-oc(b);a[b]=c}function Bc(a,b){var c=a.pendingLanes&~b;a.pendingLanes=b;a.suspendedLanes=0;a.pingedLanes=0;a.expiredLanes&=b;a.mutableReadLanes&=b;a.entangledLanes&=b;b=a.entanglements;var d=a.eventTimes;for(a=a.expirationTimes;0<c;){var e=31-oc(c),f=1<<e;b[e]=0;d[e]=-1;a[e]=-1;c&=~f}}\nfunction Cc(a,b){var c=a.entangledLanes|=b;for(a=a.entanglements;c;){var d=31-oc(c),e=1<<d;e&b|a[d]&b&&(a[d]|=b);c&=~e}}var C=0;function Dc(a){a&=-a;return 1<a?4<a?0!==(a&268435455)?16:536870912:4:1}var Ec,Fc,Gc,Hc,Ic,Jc=!1,Kc=[],Lc=null,Mc=null,Nc=null,Oc=new Map,Pc=new Map,Qc=[],Rc=\"mousedown mouseup touchcancel touchend touchstart auxclick dblclick pointercancel pointerdown pointerup dragend dragstart drop compositionend compositionstart keydown keypress keyup input textInput copy cut paste click change contextmenu reset submit\".split(\" \");\nfunction Sc(a,b){switch(a){case \"focusin\":case \"focusout\":Lc=null;break;case \"dragenter\":case \"dragleave\":Mc=null;break;case \"mouseover\":case \"mouseout\":Nc=null;break;case \"pointerover\":case \"pointerout\":Oc.delete(b.pointerId);break;case \"gotpointercapture\":case \"lostpointercapture\":Pc.delete(b.pointerId)}}\nfunction Tc(a,b,c,d,e,f){if(null===a||a.nativeEvent!==f)return a={blockedOn:b,domEventName:c,eventSystemFlags:d,nativeEvent:f,targetContainers:[e]},null!==b&&(b=Cb(b),null!==b&&Fc(b)),a;a.eventSystemFlags|=d;b=a.targetContainers;null!==e&&-1===b.indexOf(e)&&b.push(e);return a}\nfunction Uc(a,b,c,d,e){switch(b){case \"focusin\":return Lc=Tc(Lc,a,b,c,d,e),!0;case \"dragenter\":return Mc=Tc(Mc,a,b,c,d,e),!0;case \"mouseover\":return Nc=Tc(Nc,a,b,c,d,e),!0;case \"pointerover\":var f=e.pointerId;Oc.set(f,Tc(Oc.get(f)||null,a,b,c,d,e));return!0;case \"gotpointercapture\":return f=e.pointerId,Pc.set(f,Tc(Pc.get(f)||null,a,b,c,d,e)),!0}return!1}\nfunction Vc(a){var b=Wc(a.target);if(null!==b){var c=Vb(b);if(null!==c)if(b=c.tag,13===b){if(b=Wb(c),null!==b){a.blockedOn=b;Ic(a.priority,function(){Gc(c)});return}}else if(3===b&&c.stateNode.current.memoizedState.isDehydrated){a.blockedOn=3===c.tag?c.stateNode.containerInfo:null;return}}a.blockedOn=null}\nfunction Xc(a){if(null!==a.blockedOn)return!1;for(var b=a.targetContainers;0<b.length;){var c=Yc(a.domEventName,a.eventSystemFlags,b[0],a.nativeEvent);if(null===c){c=a.nativeEvent;var d=new c.constructor(c.type,c);wb=d;c.target.dispatchEvent(d);wb=null}else return b=Cb(c),null!==b&&Fc(b),a.blockedOn=c,!1;b.shift()}return!0}function Zc(a,b,c){Xc(a)&&c.delete(b)}function $c(){Jc=!1;null!==Lc&&Xc(Lc)&&(Lc=null);null!==Mc&&Xc(Mc)&&(Mc=null);null!==Nc&&Xc(Nc)&&(Nc=null);Oc.forEach(Zc);Pc.forEach(Zc)}\nfunction ad(a,b){a.blockedOn===b&&(a.blockedOn=null,Jc||(Jc=!0,ca.unstable_scheduleCallback(ca.unstable_NormalPriority,$c)))}\nfunction bd(a){function b(b){return ad(b,a)}if(0<Kc.length){ad(Kc[0],a);for(var c=1;c<Kc.length;c++){var d=Kc[c];d.blockedOn===a&&(d.blockedOn=null)}}null!==Lc&&ad(Lc,a);null!==Mc&&ad(Mc,a);null!==Nc&&ad(Nc,a);Oc.forEach(b);Pc.forEach(b);for(c=0;c<Qc.length;c++)d=Qc[c],d.blockedOn===a&&(d.blockedOn=null);for(;0<Qc.length&&(c=Qc[0],null===c.blockedOn);)Vc(c),null===c.blockedOn&&Qc.shift()}var cd=ua.ReactCurrentBatchConfig,dd=!0;\nfunction ed(a,b,c,d){var e=C,f=cd.transition;cd.transition=null;try{C=1,fd(a,b,c,d)}finally{C=e,cd.transition=f}}function gd(a,b,c,d){var e=C,f=cd.transition;cd.transition=null;try{C=4,fd(a,b,c,d)}finally{C=e,cd.transition=f}}\nfunction fd(a,b,c,d){if(dd){var e=Yc(a,b,c,d);if(null===e)hd(a,b,d,id,c),Sc(a,d);else if(Uc(e,a,b,c,d))d.stopPropagation();else if(Sc(a,d),b&4&&-1<Rc.indexOf(a)){for(;null!==e;){var f=Cb(e);null!==f&&Ec(f);f=Yc(a,b,c,d);null===f&&hd(a,b,d,id,c);if(f===e)break;e=f}null!==e&&d.stopPropagation()}else hd(a,b,d,null,c)}}var id=null;\nfunction Yc(a,b,c,d){id=null;a=xb(d);a=Wc(a);if(null!==a)if(b=Vb(a),null===b)a=null;else if(c=b.tag,13===c){a=Wb(b);if(null!==a)return a;a=null}else if(3===c){if(b.stateNode.current.memoizedState.isDehydrated)return 3===b.tag?b.stateNode.containerInfo:null;a=null}else b!==a&&(a=null);id=a;return null}\nfunction jd(a){switch(a){case \"cancel\":case \"click\":case \"close\":case \"contextmenu\":case \"copy\":case \"cut\":case \"auxclick\":case \"dblclick\":case \"dragend\":case \"dragstart\":case \"drop\":case \"focusin\":case \"focusout\":case \"input\":case \"invalid\":case \"keydown\":case \"keypress\":case \"keyup\":case \"mousedown\":case \"mouseup\":case \"paste\":case \"pause\":case \"play\":case \"pointercancel\":case \"pointerdown\":case \"pointerup\":case \"ratechange\":case \"reset\":case \"resize\":case \"seeked\":case \"submit\":case \"touchcancel\":case \"touchend\":case \"touchstart\":case \"volumechange\":case \"change\":case \"selectionchange\":case \"textInput\":case \"compositionstart\":case \"compositionend\":case \"compositionupdate\":case \"beforeblur\":case \"afterblur\":case \"beforeinput\":case \"blur\":case \"fullscreenchange\":case \"focus\":case \"hashchange\":case \"popstate\":case \"select\":case \"selectstart\":return 1;case \"drag\":case \"dragenter\":case \"dragexit\":case \"dragleave\":case \"dragover\":case \"mousemove\":case \"mouseout\":case \"mouseover\":case \"pointermove\":case \"pointerout\":case \"pointerover\":case \"scroll\":case \"toggle\":case \"touchmove\":case \"wheel\":case \"mouseenter\":case \"mouseleave\":case \"pointerenter\":case \"pointerleave\":return 4;\ncase \"message\":switch(ec()){case fc:return 1;case gc:return 4;case hc:case ic:return 16;case jc:return 536870912;default:return 16}default:return 16}}var kd=null,ld=null,md=null;function nd(){if(md)return md;var a,b=ld,c=b.length,d,e=\"value\"in kd?kd.value:kd.textContent,f=e.length;for(a=0;a<c&&b[a]===e[a];a++);var g=c-a;for(d=1;d<=g&&b[c-d]===e[f-d];d++);return md=e.slice(a,1<d?1-d:void 0)}\nfunction od(a){var b=a.keyCode;\"charCode\"in a?(a=a.charCode,0===a&&13===b&&(a=13)):a=b;10===a&&(a=13);return 32<=a||13===a?a:0}function pd(){return!0}function qd(){return!1}\nfunction rd(a){function b(b,d,e,f,g){this._reactName=b;this._targetInst=e;this.type=d;this.nativeEvent=f;this.target=g;this.currentTarget=null;for(var c in a)a.hasOwnProperty(c)&&(b=a[c],this[c]=b?b(f):f[c]);this.isDefaultPrevented=(null!=f.defaultPrevented?f.defaultPrevented:!1===f.returnValue)?pd:qd;this.isPropagationStopped=qd;return this}A(b.prototype,{preventDefault:function(){this.defaultPrevented=!0;var a=this.nativeEvent;a&&(a.preventDefault?a.preventDefault():\"unknown\"!==typeof a.returnValue&&\n(a.returnValue=!1),this.isDefaultPrevented=pd)},stopPropagation:function(){var a=this.nativeEvent;a&&(a.stopPropagation?a.stopPropagation():\"unknown\"!==typeof a.cancelBubble&&(a.cancelBubble=!0),this.isPropagationStopped=pd)},persist:function(){},isPersistent:pd});return b}\nvar sd={eventPhase:0,bubbles:0,cancelable:0,timeStamp:function(a){return a.timeStamp||Date.now()},defaultPrevented:0,isTrusted:0},td=rd(sd),ud=A({},sd,{view:0,detail:0}),vd=rd(ud),wd,xd,yd,Ad=A({},ud,{screenX:0,screenY:0,clientX:0,clientY:0,pageX:0,pageY:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,getModifierState:zd,button:0,buttons:0,relatedTarget:function(a){return void 0===a.relatedTarget?a.fromElement===a.srcElement?a.toElement:a.fromElement:a.relatedTarget},movementX:function(a){if(\"movementX\"in\na)return a.movementX;a!==yd&&(yd&&\"mousemove\"===a.type?(wd=a.screenX-yd.screenX,xd=a.screenY-yd.screenY):xd=wd=0,yd=a);return wd},movementY:function(a){return\"movementY\"in a?a.movementY:xd}}),Bd=rd(Ad),Cd=A({},Ad,{dataTransfer:0}),Dd=rd(Cd),Ed=A({},ud,{relatedTarget:0}),Fd=rd(Ed),Gd=A({},sd,{animationName:0,elapsedTime:0,pseudoElement:0}),Hd=rd(Gd),Id=A({},sd,{clipboardData:function(a){return\"clipboardData\"in a?a.clipboardData:window.clipboardData}}),Jd=rd(Id),Kd=A({},sd,{data:0}),Ld=rd(Kd),Md={Esc:\"Escape\",\nSpacebar:\" \",Left:\"ArrowLeft\",Up:\"ArrowUp\",Right:\"ArrowRight\",Down:\"ArrowDown\",Del:\"Delete\",Win:\"OS\",Menu:\"ContextMenu\",Apps:\"ContextMenu\",Scroll:\"ScrollLock\",MozPrintableKey:\"Unidentified\"},Nd={8:\"Backspace\",9:\"Tab\",12:\"Clear\",13:\"Enter\",16:\"Shift\",17:\"Control\",18:\"Alt\",19:\"Pause\",20:\"CapsLock\",27:\"Escape\",32:\" \",33:\"PageUp\",34:\"PageDown\",35:\"End\",36:\"Home\",37:\"ArrowLeft\",38:\"ArrowUp\",39:\"ArrowRight\",40:\"ArrowDown\",45:\"Insert\",46:\"Delete\",112:\"F1\",113:\"F2\",114:\"F3\",115:\"F4\",116:\"F5\",117:\"F6\",118:\"F7\",\n119:\"F8\",120:\"F9\",121:\"F10\",122:\"F11\",123:\"F12\",144:\"NumLock\",145:\"ScrollLock\",224:\"Meta\"},Od={Alt:\"altKey\",Control:\"ctrlKey\",Meta:\"metaKey\",Shift:\"shiftKey\"};function Pd(a){var b=this.nativeEvent;return b.getModifierState?b.getModifierState(a):(a=Od[a])?!!b[a]:!1}function zd(){return Pd}\nvar Qd=A({},ud,{key:function(a){if(a.key){var b=Md[a.key]||a.key;if(\"Unidentified\"!==b)return b}return\"keypress\"===a.type?(a=od(a),13===a?\"Enter\":String.fromCharCode(a)):\"keydown\"===a.type||\"keyup\"===a.type?Nd[a.keyCode]||\"Unidentified\":\"\"},code:0,location:0,ctrlKey:0,shiftKey:0,altKey:0,metaKey:0,repeat:0,locale:0,getModifierState:zd,charCode:function(a){return\"keypress\"===a.type?od(a):0},keyCode:function(a){return\"keydown\"===a.type||\"keyup\"===a.type?a.keyCode:0},which:function(a){return\"keypress\"===\na.type?od(a):\"keydown\"===a.type||\"keyup\"===a.type?a.keyCode:0}}),Rd=rd(Qd),Sd=A({},Ad,{pointerId:0,width:0,height:0,pressure:0,tangentialPressure:0,tiltX:0,tiltY:0,twist:0,pointerType:0,isPrimary:0}),Td=rd(Sd),Ud=A({},ud,{touches:0,targetTouches:0,changedTouches:0,altKey:0,metaKey:0,ctrlKey:0,shiftKey:0,getModifierState:zd}),Vd=rd(Ud),Wd=A({},sd,{propertyName:0,elapsedTime:0,pseudoElement:0}),Xd=rd(Wd),Yd=A({},Ad,{deltaX:function(a){return\"deltaX\"in a?a.deltaX:\"wheelDeltaX\"in a?-a.wheelDeltaX:0},\ndeltaY:function(a){return\"deltaY\"in a?a.deltaY:\"wheelDeltaY\"in a?-a.wheelDeltaY:\"wheelDelta\"in a?-a.wheelDelta:0},deltaZ:0,deltaMode:0}),Zd=rd(Yd),$d=[9,13,27,32],ae=ia&&\"CompositionEvent\"in window,be=null;ia&&\"documentMode\"in document&&(be=document.documentMode);var ce=ia&&\"TextEvent\"in window&&!be,de=ia&&(!ae||be&&8<be&&11>=be),ee=String.fromCharCode(32),fe=!1;\nfunction ge(a,b){switch(a){case \"keyup\":return-1!==$d.indexOf(b.keyCode);case \"keydown\":return 229!==b.keyCode;case \"keypress\":case \"mousedown\":case \"focusout\":return!0;default:return!1}}function he(a){a=a.detail;return\"object\"===typeof a&&\"data\"in a?a.data:null}var ie=!1;function je(a,b){switch(a){case \"compositionend\":return he(b);case \"keypress\":if(32!==b.which)return null;fe=!0;return ee;case \"textInput\":return a=b.data,a===ee&&fe?null:a;default:return null}}\nfunction ke(a,b){if(ie)return\"compositionend\"===a||!ae&&ge(a,b)?(a=nd(),md=ld=kd=null,ie=!1,a):null;switch(a){case \"paste\":return null;case \"keypress\":if(!(b.ctrlKey||b.altKey||b.metaKey)||b.ctrlKey&&b.altKey){if(b.char&&1<b.char.length)return b.char;if(b.which)return String.fromCharCode(b.which)}return null;case \"compositionend\":return de&&\"ko\"!==b.locale?null:b.data;default:return null}}\nvar le={color:!0,date:!0,datetime:!0,\"datetime-local\":!0,email:!0,month:!0,number:!0,password:!0,range:!0,search:!0,tel:!0,text:!0,time:!0,url:!0,week:!0};function me(a){var b=a&&a.nodeName&&a.nodeName.toLowerCase();return\"input\"===b?!!le[a.type]:\"textarea\"===b?!0:!1}function ne(a,b,c,d){Eb(d);b=oe(b,\"onChange\");0<b.length&&(c=new td(\"onChange\",\"change\",null,c,d),a.push({event:c,listeners:b}))}var pe=null,qe=null;function re(a){se(a,0)}function te(a){var b=ue(a);if(Wa(b))return a}\nfunction ve(a,b){if(\"change\"===a)return b}var we=!1;if(ia){var xe;if(ia){var ye=\"oninput\"in document;if(!ye){var ze=document.createElement(\"div\");ze.setAttribute(\"oninput\",\"return;\");ye=\"function\"===typeof ze.oninput}xe=ye}else xe=!1;we=xe&&(!document.documentMode||9<document.documentMode)}function Ae(){pe&&(pe.detachEvent(\"onpropertychange\",Be),qe=pe=null)}function Be(a){if(\"value\"===a.propertyName&&te(qe)){var b=[];ne(b,qe,a,xb(a));Jb(re,b)}}\nfunction Ce(a,b,c){\"focusin\"===a?(Ae(),pe=b,qe=c,pe.attachEvent(\"onpropertychange\",Be)):\"focusout\"===a&&Ae()}function De(a){if(\"selectionchange\"===a||\"keyup\"===a||\"keydown\"===a)return te(qe)}function Ee(a,b){if(\"click\"===a)return te(b)}function Fe(a,b){if(\"input\"===a||\"change\"===a)return te(b)}function Ge(a,b){return a===b&&(0!==a||1/a===1/b)||a!==a&&b!==b}var He=\"function\"===typeof Object.is?Object.is:Ge;\nfunction Ie(a,b){if(He(a,b))return!0;if(\"object\"!==typeof a||null===a||\"object\"!==typeof b||null===b)return!1;var c=Object.keys(a),d=Object.keys(b);if(c.length!==d.length)return!1;for(d=0;d<c.length;d++){var e=c[d];if(!ja.call(b,e)||!He(a[e],b[e]))return!1}return!0}function Je(a){for(;a&&a.firstChild;)a=a.firstChild;return a}\nfunction Ke(a,b){var c=Je(a);a=0;for(var d;c;){if(3===c.nodeType){d=a+c.textContent.length;if(a<=b&&d>=b)return{node:c,offset:b-a};a=d}a:{for(;c;){if(c.nextSibling){c=c.nextSibling;break a}c=c.parentNode}c=void 0}c=Je(c)}}function Le(a,b){return a&&b?a===b?!0:a&&3===a.nodeType?!1:b&&3===b.nodeType?Le(a,b.parentNode):\"contains\"in a?a.contains(b):a.compareDocumentPosition?!!(a.compareDocumentPosition(b)&16):!1:!1}\nfunction Me(){for(var a=window,b=Xa();b instanceof a.HTMLIFrameElement;){try{var c=\"string\"===typeof b.contentWindow.location.href}catch(d){c=!1}if(c)a=b.contentWindow;else break;b=Xa(a.document)}return b}function Ne(a){var b=a&&a.nodeName&&a.nodeName.toLowerCase();return b&&(\"input\"===b&&(\"text\"===a.type||\"search\"===a.type||\"tel\"===a.type||\"url\"===a.type||\"password\"===a.type)||\"textarea\"===b||\"true\"===a.contentEditable)}\nfunction Oe(a){var b=Me(),c=a.focusedElem,d=a.selectionRange;if(b!==c&&c&&c.ownerDocument&&Le(c.ownerDocument.documentElement,c)){if(null!==d&&Ne(c))if(b=d.start,a=d.end,void 0===a&&(a=b),\"selectionStart\"in c)c.selectionStart=b,c.selectionEnd=Math.min(a,c.value.length);else if(a=(b=c.ownerDocument||document)&&b.defaultView||window,a.getSelection){a=a.getSelection();var e=c.textContent.length,f=Math.min(d.start,e);d=void 0===d.end?f:Math.min(d.end,e);!a.extend&&f>d&&(e=d,d=f,f=e);e=Ke(c,f);var g=Ke(c,\nd);e&&g&&(1!==a.rangeCount||a.anchorNode!==e.node||a.anchorOffset!==e.offset||a.focusNode!==g.node||a.focusOffset!==g.offset)&&(b=b.createRange(),b.setStart(e.node,e.offset),a.removeAllRanges(),f>d?(a.addRange(b),a.extend(g.node,g.offset)):(b.setEnd(g.node,g.offset),a.addRange(b)))}b=[];for(a=c;a=a.parentNode;)1===a.nodeType&&b.push({element:a,left:a.scrollLeft,top:a.scrollTop});\"function\"===typeof c.focus&&c.focus();for(c=0;c<b.length;c++)a=b[c],a.element.scrollLeft=a.left,a.element.scrollTop=a.top}}\nvar Pe=ia&&\"documentMode\"in document&&11>=document.documentMode,Qe=null,Re=null,Se=null,Te=!1;\nfunction Ue(a,b,c){var d=c.window===c?c.document:9===c.nodeType?c:c.ownerDocument;Te||null==Qe||Qe!==Xa(d)||(d=Qe,\"selectionStart\"in d&&Ne(d)?d={start:d.selectionStart,end:d.selectionEnd}:(d=(d.ownerDocument&&d.ownerDocument.defaultView||window).getSelection(),d={anchorNode:d.anchorNode,anchorOffset:d.anchorOffset,focusNode:d.focusNode,focusOffset:d.focusOffset}),Se&&Ie(Se,d)||(Se=d,d=oe(Re,\"onSelect\"),0<d.length&&(b=new td(\"onSelect\",\"select\",null,b,c),a.push({event:b,listeners:d}),b.target=Qe)))}\nfunction Ve(a,b){var c={};c[a.toLowerCase()]=b.toLowerCase();c[\"Webkit\"+a]=\"webkit\"+b;c[\"Moz\"+a]=\"moz\"+b;return c}var We={animationend:Ve(\"Animation\",\"AnimationEnd\"),animationiteration:Ve(\"Animation\",\"AnimationIteration\"),animationstart:Ve(\"Animation\",\"AnimationStart\"),transitionend:Ve(\"Transition\",\"TransitionEnd\")},Xe={},Ye={};\nia&&(Ye=document.createElement(\"div\").style,\"AnimationEvent\"in window||(delete We.animationend.animation,delete We.animationiteration.animation,delete We.animationstart.animation),\"TransitionEvent\"in window||delete We.transitionend.transition);function Ze(a){if(Xe[a])return Xe[a];if(!We[a])return a;var b=We[a],c;for(c in b)if(b.hasOwnProperty(c)&&c in Ye)return Xe[a]=b[c];return a}var $e=Ze(\"animationend\"),af=Ze(\"animationiteration\"),bf=Ze(\"animationstart\"),cf=Ze(\"transitionend\"),df=new Map,ef=\"abort auxClick cancel canPlay canPlayThrough click close contextMenu copy cut drag dragEnd dragEnter dragExit dragLeave dragOver dragStart drop durationChange emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove pointerOut pointerOver pointerUp progress rateChange reset resize seeked seeking stalled submit suspend timeUpdate touchCancel touchEnd touchStart volumeChange scroll toggle touchMove waiting wheel\".split(\" \");\nfunction ff(a,b){df.set(a,b);fa(b,[a])}for(var gf=0;gf<ef.length;gf++){var hf=ef[gf],jf=hf.toLowerCase(),kf=hf[0].toUpperCase()+hf.slice(1);ff(jf,\"on\"+kf)}ff($e,\"onAnimationEnd\");ff(af,\"onAnimationIteration\");ff(bf,\"onAnimationStart\");ff(\"dblclick\",\"onDoubleClick\");ff(\"focusin\",\"onFocus\");ff(\"focusout\",\"onBlur\");ff(cf,\"onTransitionEnd\");ha(\"onMouseEnter\",[\"mouseout\",\"mouseover\"]);ha(\"onMouseLeave\",[\"mouseout\",\"mouseover\"]);ha(\"onPointerEnter\",[\"pointerout\",\"pointerover\"]);\nha(\"onPointerLeave\",[\"pointerout\",\"pointerover\"]);fa(\"onChange\",\"change click focusin focusout input keydown keyup selectionchange\".split(\" \"));fa(\"onSelect\",\"focusout contextmenu dragend focusin keydown keyup mousedown mouseup selectionchange\".split(\" \"));fa(\"onBeforeInput\",[\"compositionend\",\"keypress\",\"textInput\",\"paste\"]);fa(\"onCompositionEnd\",\"compositionend focusout keydown keypress keyup mousedown\".split(\" \"));fa(\"onCompositionStart\",\"compositionstart focusout keydown keypress keyup mousedown\".split(\" \"));\nfa(\"onCompositionUpdate\",\"compositionupdate focusout keydown keypress keyup mousedown\".split(\" \"));var lf=\"abort canplay canplaythrough durationchange emptied encrypted ended error loadeddata loadedmetadata loadstart pause play playing progress ratechange resize seeked seeking stalled suspend timeupdate volumechange waiting\".split(\" \"),mf=new Set(\"cancel close invalid load scroll toggle\".split(\" \").concat(lf));\nfunction nf(a,b,c){var d=a.type||\"unknown-event\";a.currentTarget=c;Ub(d,b,void 0,a);a.currentTarget=null}\nfunction se(a,b){b=0!==(b&4);for(var c=0;c<a.length;c++){var d=a[c],e=d.event;d=d.listeners;a:{var f=void 0;if(b)for(var g=d.length-1;0<=g;g--){var h=d[g],k=h.instance,l=h.currentTarget;h=h.listener;if(k!==f&&e.isPropagationStopped())break a;nf(e,h,l);f=k}else for(g=0;g<d.length;g++){h=d[g];k=h.instance;l=h.currentTarget;h=h.listener;if(k!==f&&e.isPropagationStopped())break a;nf(e,h,l);f=k}}}if(Qb)throw a=Rb,Qb=!1,Rb=null,a;}\nfunction D(a,b){var c=b[of];void 0===c&&(c=b[of]=new Set);var d=a+\"__bubble\";c.has(d)||(pf(b,a,2,!1),c.add(d))}function qf(a,b,c){var d=0;b&&(d|=4);pf(c,a,d,b)}var rf=\"_reactListening\"+Math.random().toString(36).slice(2);function sf(a){if(!a[rf]){a[rf]=!0;da.forEach(function(b){\"selectionchange\"!==b&&(mf.has(b)||qf(b,!1,a),qf(b,!0,a))});var b=9===a.nodeType?a:a.ownerDocument;null===b||b[rf]||(b[rf]=!0,qf(\"selectionchange\",!1,b))}}\nfunction pf(a,b,c,d){switch(jd(b)){case 1:var e=ed;break;case 4:e=gd;break;default:e=fd}c=e.bind(null,b,c,a);e=void 0;!Lb||\"touchstart\"!==b&&\"touchmove\"!==b&&\"wheel\"!==b||(e=!0);d?void 0!==e?a.addEventListener(b,c,{capture:!0,passive:e}):a.addEventListener(b,c,!0):void 0!==e?a.addEventListener(b,c,{passive:e}):a.addEventListener(b,c,!1)}\nfunction hd(a,b,c,d,e){var f=d;if(0===(b&1)&&0===(b&2)&&null!==d)a:for(;;){if(null===d)return;var g=d.tag;if(3===g||4===g){var h=d.stateNode.containerInfo;if(h===e||8===h.nodeType&&h.parentNode===e)break;if(4===g)for(g=d.return;null!==g;){var k=g.tag;if(3===k||4===k)if(k=g.stateNode.containerInfo,k===e||8===k.nodeType&&k.parentNode===e)return;g=g.return}for(;null!==h;){g=Wc(h);if(null===g)return;k=g.tag;if(5===k||6===k){d=f=g;continue a}h=h.parentNode}}d=d.return}Jb(function(){var d=f,e=xb(c),g=[];\na:{var h=df.get(a);if(void 0!==h){var k=td,n=a;switch(a){case \"keypress\":if(0===od(c))break a;case \"keydown\":case \"keyup\":k=Rd;break;case \"focusin\":n=\"focus\";k=Fd;break;case \"focusout\":n=\"blur\";k=Fd;break;case \"beforeblur\":case \"afterblur\":k=Fd;break;case \"click\":if(2===c.button)break a;case \"auxclick\":case \"dblclick\":case \"mousedown\":case \"mousemove\":case \"mouseup\":case \"mouseout\":case \"mouseover\":case \"contextmenu\":k=Bd;break;case \"drag\":case \"dragend\":case \"dragenter\":case \"dragexit\":case \"dragleave\":case \"dragover\":case \"dragstart\":case \"drop\":k=\nDd;break;case \"touchcancel\":case \"touchend\":case \"touchmove\":case \"touchstart\":k=Vd;break;case $e:case af:case bf:k=Hd;break;case cf:k=Xd;break;case \"scroll\":k=vd;break;case \"wheel\":k=Zd;break;case \"copy\":case \"cut\":case \"paste\":k=Jd;break;case \"gotpointercapture\":case \"lostpointercapture\":case \"pointercancel\":case \"pointerdown\":case \"pointermove\":case \"pointerout\":case \"pointerover\":case \"pointerup\":k=Td}var t=0!==(b&4),J=!t&&\"scroll\"===a,x=t?null!==h?h+\"Capture\":null:h;t=[];for(var w=d,u;null!==\nw;){u=w;var F=u.stateNode;5===u.tag&&null!==F&&(u=F,null!==x&&(F=Kb(w,x),null!=F&&t.push(tf(w,F,u))));if(J)break;w=w.return}0<t.length&&(h=new k(h,n,null,c,e),g.push({event:h,listeners:t}))}}if(0===(b&7)){a:{h=\"mouseover\"===a||\"pointerover\"===a;k=\"mouseout\"===a||\"pointerout\"===a;if(h&&c!==wb&&(n=c.relatedTarget||c.fromElement)&&(Wc(n)||n[uf]))break a;if(k||h){h=e.window===e?e:(h=e.ownerDocument)?h.defaultView||h.parentWindow:window;if(k){if(n=c.relatedTarget||c.toElement,k=d,n=n?Wc(n):null,null!==\nn&&(J=Vb(n),n!==J||5!==n.tag&&6!==n.tag))n=null}else k=null,n=d;if(k!==n){t=Bd;F=\"onMouseLeave\";x=\"onMouseEnter\";w=\"mouse\";if(\"pointerout\"===a||\"pointerover\"===a)t=Td,F=\"onPointerLeave\",x=\"onPointerEnter\",w=\"pointer\";J=null==k?h:ue(k);u=null==n?h:ue(n);h=new t(F,w+\"leave\",k,c,e);h.target=J;h.relatedTarget=u;F=null;Wc(e)===d&&(t=new t(x,w+\"enter\",n,c,e),t.target=u,t.relatedTarget=J,F=t);J=F;if(k&&n)b:{t=k;x=n;w=0;for(u=t;u;u=vf(u))w++;u=0;for(F=x;F;F=vf(F))u++;for(;0<w-u;)t=vf(t),w--;for(;0<u-w;)x=\nvf(x),u--;for(;w--;){if(t===x||null!==x&&t===x.alternate)break b;t=vf(t);x=vf(x)}t=null}else t=null;null!==k&&wf(g,h,k,t,!1);null!==n&&null!==J&&wf(g,J,n,t,!0)}}}a:{h=d?ue(d):window;k=h.nodeName&&h.nodeName.toLowerCase();if(\"select\"===k||\"input\"===k&&\"file\"===h.type)var na=ve;else if(me(h))if(we)na=Fe;else{na=De;var xa=Ce}else(k=h.nodeName)&&\"input\"===k.toLowerCase()&&(\"checkbox\"===h.type||\"radio\"===h.type)&&(na=Ee);if(na&&(na=na(a,d))){ne(g,na,c,e);break a}xa&&xa(a,h,d);\"focusout\"===a&&(xa=h._wrapperState)&&\nxa.controlled&&\"number\"===h.type&&cb(h,\"number\",h.value)}xa=d?ue(d):window;switch(a){case \"focusin\":if(me(xa)||\"true\"===xa.contentEditable)Qe=xa,Re=d,Se=null;break;case \"focusout\":Se=Re=Qe=null;break;case \"mousedown\":Te=!0;break;case \"contextmenu\":case \"mouseup\":case \"dragend\":Te=!1;Ue(g,c,e);break;case \"selectionchange\":if(Pe)break;case \"keydown\":case \"keyup\":Ue(g,c,e)}var $a;if(ae)b:{switch(a){case \"compositionstart\":var ba=\"onCompositionStart\";break b;case \"compositionend\":ba=\"onCompositionEnd\";\nbreak b;case \"compositionupdate\":ba=\"onCompositionUpdate\";break b}ba=void 0}else ie?ge(a,c)&&(ba=\"onCompositionEnd\"):\"keydown\"===a&&229===c.keyCode&&(ba=\"onCompositionStart\");ba&&(de&&\"ko\"!==c.locale&&(ie||\"onCompositionStart\"!==ba?\"onCompositionEnd\"===ba&&ie&&($a=nd()):(kd=e,ld=\"value\"in kd?kd.value:kd.textContent,ie=!0)),xa=oe(d,ba),0<xa.length&&(ba=new Ld(ba,a,null,c,e),g.push({event:ba,listeners:xa}),$a?ba.data=$a:($a=he(c),null!==$a&&(ba.data=$a))));if($a=ce?je(a,c):ke(a,c))d=oe(d,\"onBeforeInput\"),\n0<d.length&&(e=new Ld(\"onBeforeInput\",\"beforeinput\",null,c,e),g.push({event:e,listeners:d}),e.data=$a)}se(g,b)})}function tf(a,b,c){return{instance:a,listener:b,currentTarget:c}}function oe(a,b){for(var c=b+\"Capture\",d=[];null!==a;){var e=a,f=e.stateNode;5===e.tag&&null!==f&&(e=f,f=Kb(a,c),null!=f&&d.unshift(tf(a,f,e)),f=Kb(a,b),null!=f&&d.push(tf(a,f,e)));a=a.return}return d}function vf(a){if(null===a)return null;do a=a.return;while(a&&5!==a.tag);return a?a:null}\nfunction wf(a,b,c,d,e){for(var f=b._reactName,g=[];null!==c&&c!==d;){var h=c,k=h.alternate,l=h.stateNode;if(null!==k&&k===d)break;5===h.tag&&null!==l&&(h=l,e?(k=Kb(c,f),null!=k&&g.unshift(tf(c,k,h))):e||(k=Kb(c,f),null!=k&&g.push(tf(c,k,h))));c=c.return}0!==g.length&&a.push({event:b,listeners:g})}var xf=/\\r\\n?/g,yf=/\\u0000|\\uFFFD/g;function zf(a){return(\"string\"===typeof a?a:\"\"+a).replace(xf,\"\\n\").replace(yf,\"\")}function Af(a,b,c){b=zf(b);if(zf(a)!==b&&c)throw Error(p(425));}function Bf(){}\nvar Cf=null,Df=null;function Ef(a,b){return\"textarea\"===a||\"noscript\"===a||\"string\"===typeof b.children||\"number\"===typeof b.children||\"object\"===typeof b.dangerouslySetInnerHTML&&null!==b.dangerouslySetInnerHTML&&null!=b.dangerouslySetInnerHTML.__html}\nvar Ff=\"function\"===typeof setTimeout?setTimeout:void 0,Gf=\"function\"===typeof clearTimeout?clearTimeout:void 0,Hf=\"function\"===typeof Promise?Promise:void 0,Jf=\"function\"===typeof queueMicrotask?queueMicrotask:\"undefined\"!==typeof Hf?function(a){return Hf.resolve(null).then(a).catch(If)}:Ff;function If(a){setTimeout(function(){throw a;})}\nfunction Kf(a,b){var c=b,d=0;do{var e=c.nextSibling;a.removeChild(c);if(e&&8===e.nodeType)if(c=e.data,\"/$\"===c){if(0===d){a.removeChild(e);bd(b);return}d--}else\"$\"!==c&&\"$?\"!==c&&\"$!\"!==c||d++;c=e}while(c);bd(b)}function Lf(a){for(;null!=a;a=a.nextSibling){var b=a.nodeType;if(1===b||3===b)break;if(8===b){b=a.data;if(\"$\"===b||\"$!\"===b||\"$?\"===b)break;if(\"/$\"===b)return null}}return a}\nfunction Mf(a){a=a.previousSibling;for(var b=0;a;){if(8===a.nodeType){var c=a.data;if(\"$\"===c||\"$!\"===c||\"$?\"===c){if(0===b)return a;b--}else\"/$\"===c&&b++}a=a.previousSibling}return null}var Nf=Math.random().toString(36).slice(2),Of=\"__reactFiber$\"+Nf,Pf=\"__reactProps$\"+Nf,uf=\"__reactContainer$\"+Nf,of=\"__reactEvents$\"+Nf,Qf=\"__reactListeners$\"+Nf,Rf=\"__reactHandles$\"+Nf;\nfunction Wc(a){var b=a[Of];if(b)return b;for(var c=a.parentNode;c;){if(b=c[uf]||c[Of]){c=b.alternate;if(null!==b.child||null!==c&&null!==c.child)for(a=Mf(a);null!==a;){if(c=a[Of])return c;a=Mf(a)}return b}a=c;c=a.parentNode}return null}function Cb(a){a=a[Of]||a[uf];return!a||5!==a.tag&&6!==a.tag&&13!==a.tag&&3!==a.tag?null:a}function ue(a){if(5===a.tag||6===a.tag)return a.stateNode;throw Error(p(33));}function Db(a){return a[Pf]||null}var Sf=[],Tf=-1;function Uf(a){return{current:a}}\nfunction E(a){0>Tf||(a.current=Sf[Tf],Sf[Tf]=null,Tf--)}function G(a,b){Tf++;Sf[Tf]=a.current;a.current=b}var Vf={},H=Uf(Vf),Wf=Uf(!1),Xf=Vf;function Yf(a,b){var c=a.type.contextTypes;if(!c)return Vf;var d=a.stateNode;if(d&&d.__reactInternalMemoizedUnmaskedChildContext===b)return d.__reactInternalMemoizedMaskedChildContext;var e={},f;for(f in c)e[f]=b[f];d&&(a=a.stateNode,a.__reactInternalMemoizedUnmaskedChildContext=b,a.__reactInternalMemoizedMaskedChildContext=e);return e}\nfunction Zf(a){a=a.childContextTypes;return null!==a&&void 0!==a}function $f(){E(Wf);E(H)}function ag(a,b,c){if(H.current!==Vf)throw Error(p(168));G(H,b);G(Wf,c)}function bg(a,b,c){var d=a.stateNode;b=b.childContextTypes;if(\"function\"!==typeof d.getChildContext)return c;d=d.getChildContext();for(var e in d)if(!(e in b))throw Error(p(108,Ra(a)||\"Unknown\",e));return A({},c,d)}\nfunction cg(a){a=(a=a.stateNode)&&a.__reactInternalMemoizedMergedChildContext||Vf;Xf=H.current;G(H,a);G(Wf,Wf.current);return!0}function dg(a,b,c){var d=a.stateNode;if(!d)throw Error(p(169));c?(a=bg(a,b,Xf),d.__reactInternalMemoizedMergedChildContext=a,E(Wf),E(H),G(H,a)):E(Wf);G(Wf,c)}var eg=null,fg=!1,gg=!1;function hg(a){null===eg?eg=[a]:eg.push(a)}function ig(a){fg=!0;hg(a)}\nfunction jg(){if(!gg&&null!==eg){gg=!0;var a=0,b=C;try{var c=eg;for(C=1;a<c.length;a++){var d=c[a];do d=d(!0);while(null!==d)}eg=null;fg=!1}catch(e){throw null!==eg&&(eg=eg.slice(a+1)),ac(fc,jg),e;}finally{C=b,gg=!1}}return null}var kg=[],lg=0,mg=null,ng=0,og=[],pg=0,qg=null,rg=1,sg=\"\";function tg(a,b){kg[lg++]=ng;kg[lg++]=mg;mg=a;ng=b}\nfunction ug(a,b,c){og[pg++]=rg;og[pg++]=sg;og[pg++]=qg;qg=a;var d=rg;a=sg;var e=32-oc(d)-1;d&=~(1<<e);c+=1;var f=32-oc(b)+e;if(30<f){var g=e-e%5;f=(d&(1<<g)-1).toString(32);d>>=g;e-=g;rg=1<<32-oc(b)+e|c<<e|d;sg=f+a}else rg=1<<f|c<<e|d,sg=a}function vg(a){null!==a.return&&(tg(a,1),ug(a,1,0))}function wg(a){for(;a===mg;)mg=kg[--lg],kg[lg]=null,ng=kg[--lg],kg[lg]=null;for(;a===qg;)qg=og[--pg],og[pg]=null,sg=og[--pg],og[pg]=null,rg=og[--pg],og[pg]=null}var xg=null,yg=null,I=!1,zg=null;\nfunction Ag(a,b){var c=Bg(5,null,null,0);c.elementType=\"DELETED\";c.stateNode=b;c.return=a;b=a.deletions;null===b?(a.deletions=[c],a.flags|=16):b.push(c)}\nfunction Cg(a,b){switch(a.tag){case 5:var c=a.type;b=1!==b.nodeType||c.toLowerCase()!==b.nodeName.toLowerCase()?null:b;return null!==b?(a.stateNode=b,xg=a,yg=Lf(b.firstChild),!0):!1;case 6:return b=\"\"===a.pendingProps||3!==b.nodeType?null:b,null!==b?(a.stateNode=b,xg=a,yg=null,!0):!1;case 13:return b=8!==b.nodeType?null:b,null!==b?(c=null!==qg?{id:rg,overflow:sg}:null,a.memoizedState={dehydrated:b,treeContext:c,retryLane:1073741824},c=Bg(18,null,null,0),c.stateNode=b,c.return=a,a.child=c,xg=a,yg=\nnull,!0):!1;default:return!1}}function Dg(a){return 0!==(a.mode&1)&&0===(a.flags&128)}function Eg(a){if(I){var b=yg;if(b){var c=b;if(!Cg(a,b)){if(Dg(a))throw Error(p(418));b=Lf(c.nextSibling);var d=xg;b&&Cg(a,b)?Ag(d,c):(a.flags=a.flags&-4097|2,I=!1,xg=a)}}else{if(Dg(a))throw Error(p(418));a.flags=a.flags&-4097|2;I=!1;xg=a}}}function Fg(a){for(a=a.return;null!==a&&5!==a.tag&&3!==a.tag&&13!==a.tag;)a=a.return;xg=a}\nfunction Gg(a){if(a!==xg)return!1;if(!I)return Fg(a),I=!0,!1;var b;(b=3!==a.tag)&&!(b=5!==a.tag)&&(b=a.type,b=\"head\"!==b&&\"body\"!==b&&!Ef(a.type,a.memoizedProps));if(b&&(b=yg)){if(Dg(a))throw Hg(),Error(p(418));for(;b;)Ag(a,b),b=Lf(b.nextSibling)}Fg(a);if(13===a.tag){a=a.memoizedState;a=null!==a?a.dehydrated:null;if(!a)throw Error(p(317));a:{a=a.nextSibling;for(b=0;a;){if(8===a.nodeType){var c=a.data;if(\"/$\"===c){if(0===b){yg=Lf(a.nextSibling);break a}b--}else\"$\"!==c&&\"$!\"!==c&&\"$?\"!==c||b++}a=a.nextSibling}yg=\nnull}}else yg=xg?Lf(a.stateNode.nextSibling):null;return!0}function Hg(){for(var a=yg;a;)a=Lf(a.nextSibling)}function Ig(){yg=xg=null;I=!1}function Jg(a){null===zg?zg=[a]:zg.push(a)}var Kg=ua.ReactCurrentBatchConfig;function Lg(a,b){if(a&&a.defaultProps){b=A({},b);a=a.defaultProps;for(var c in a)void 0===b[c]&&(b[c]=a[c]);return b}return b}var Mg=Uf(null),Ng=null,Og=null,Pg=null;function Qg(){Pg=Og=Ng=null}function Rg(a){var b=Mg.current;E(Mg);a._currentValue=b}\nfunction Sg(a,b,c){for(;null!==a;){var d=a.alternate;(a.childLanes&b)!==b?(a.childLanes|=b,null!==d&&(d.childLanes|=b)):null!==d&&(d.childLanes&b)!==b&&(d.childLanes|=b);if(a===c)break;a=a.return}}function Tg(a,b){Ng=a;Pg=Og=null;a=a.dependencies;null!==a&&null!==a.firstContext&&(0!==(a.lanes&b)&&(Ug=!0),a.firstContext=null)}\nfunction Vg(a){var b=a._currentValue;if(Pg!==a)if(a={context:a,memoizedValue:b,next:null},null===Og){if(null===Ng)throw Error(p(308));Og=a;Ng.dependencies={lanes:0,firstContext:a}}else Og=Og.next=a;return b}var Wg=null;function Xg(a){null===Wg?Wg=[a]:Wg.push(a)}function Yg(a,b,c,d){var e=b.interleaved;null===e?(c.next=c,Xg(b)):(c.next=e.next,e.next=c);b.interleaved=c;return Zg(a,d)}\nfunction Zg(a,b){a.lanes|=b;var c=a.alternate;null!==c&&(c.lanes|=b);c=a;for(a=a.return;null!==a;)a.childLanes|=b,c=a.alternate,null!==c&&(c.childLanes|=b),c=a,a=a.return;return 3===c.tag?c.stateNode:null}var $g=!1;function ah(a){a.updateQueue={baseState:a.memoizedState,firstBaseUpdate:null,lastBaseUpdate:null,shared:{pending:null,interleaved:null,lanes:0},effects:null}}\nfunction bh(a,b){a=a.updateQueue;b.updateQueue===a&&(b.updateQueue={baseState:a.baseState,firstBaseUpdate:a.firstBaseUpdate,lastBaseUpdate:a.lastBaseUpdate,shared:a.shared,effects:a.effects})}function ch(a,b){return{eventTime:a,lane:b,tag:0,payload:null,callback:null,next:null}}\nfunction dh(a,b,c){var d=a.updateQueue;if(null===d)return null;d=d.shared;if(0!==(K&2)){var e=d.pending;null===e?b.next=b:(b.next=e.next,e.next=b);d.pending=b;return Zg(a,c)}e=d.interleaved;null===e?(b.next=b,Xg(d)):(b.next=e.next,e.next=b);d.interleaved=b;return Zg(a,c)}function eh(a,b,c){b=b.updateQueue;if(null!==b&&(b=b.shared,0!==(c&4194240))){var d=b.lanes;d&=a.pendingLanes;c|=d;b.lanes=c;Cc(a,c)}}\nfunction fh(a,b){var c=a.updateQueue,d=a.alternate;if(null!==d&&(d=d.updateQueue,c===d)){var e=null,f=null;c=c.firstBaseUpdate;if(null!==c){do{var g={eventTime:c.eventTime,lane:c.lane,tag:c.tag,payload:c.payload,callback:c.callback,next:null};null===f?e=f=g:f=f.next=g;c=c.next}while(null!==c);null===f?e=f=b:f=f.next=b}else e=f=b;c={baseState:d.baseState,firstBaseUpdate:e,lastBaseUpdate:f,shared:d.shared,effects:d.effects};a.updateQueue=c;return}a=c.lastBaseUpdate;null===a?c.firstBaseUpdate=b:a.next=\nb;c.lastBaseUpdate=b}\nfunction gh(a,b,c,d){var e=a.updateQueue;$g=!1;var f=e.firstBaseUpdate,g=e.lastBaseUpdate,h=e.shared.pending;if(null!==h){e.shared.pending=null;var k=h,l=k.next;k.next=null;null===g?f=l:g.next=l;g=k;var m=a.alternate;null!==m&&(m=m.updateQueue,h=m.lastBaseUpdate,h!==g&&(null===h?m.firstBaseUpdate=l:h.next=l,m.lastBaseUpdate=k))}if(null!==f){var q=e.baseState;g=0;m=l=k=null;h=f;do{var r=h.lane,y=h.eventTime;if((d&r)===r){null!==m&&(m=m.next={eventTime:y,lane:0,tag:h.tag,payload:h.payload,callback:h.callback,\nnext:null});a:{var n=a,t=h;r=b;y=c;switch(t.tag){case 1:n=t.payload;if(\"function\"===typeof n){q=n.call(y,q,r);break a}q=n;break a;case 3:n.flags=n.flags&-65537|128;case 0:n=t.payload;r=\"function\"===typeof n?n.call(y,q,r):n;if(null===r||void 0===r)break a;q=A({},q,r);break a;case 2:$g=!0}}null!==h.callback&&0!==h.lane&&(a.flags|=64,r=e.effects,null===r?e.effects=[h]:r.push(h))}else y={eventTime:y,lane:r,tag:h.tag,payload:h.payload,callback:h.callback,next:null},null===m?(l=m=y,k=q):m=m.next=y,g|=r;\nh=h.next;if(null===h)if(h=e.shared.pending,null===h)break;else r=h,h=r.next,r.next=null,e.lastBaseUpdate=r,e.shared.pending=null}while(1);null===m&&(k=q);e.baseState=k;e.firstBaseUpdate=l;e.lastBaseUpdate=m;b=e.shared.interleaved;if(null!==b){e=b;do g|=e.lane,e=e.next;while(e!==b)}else null===f&&(e.shared.lanes=0);hh|=g;a.lanes=g;a.memoizedState=q}}\nfunction ih(a,b,c){a=b.effects;b.effects=null;if(null!==a)for(b=0;b<a.length;b++){var d=a[b],e=d.callback;if(null!==e){d.callback=null;d=c;if(\"function\"!==typeof e)throw Error(p(191,e));e.call(d)}}}var jh=(new aa.Component).refs;function kh(a,b,c,d){b=a.memoizedState;c=c(d,b);c=null===c||void 0===c?b:A({},b,c);a.memoizedState=c;0===a.lanes&&(a.updateQueue.baseState=c)}\nvar nh={isMounted:function(a){return(a=a._reactInternals)?Vb(a)===a:!1},enqueueSetState:function(a,b,c){a=a._reactInternals;var d=L(),e=lh(a),f=ch(d,e);f.payload=b;void 0!==c&&null!==c&&(f.callback=c);b=dh(a,f,e);null!==b&&(mh(b,a,e,d),eh(b,a,e))},enqueueReplaceState:function(a,b,c){a=a._reactInternals;var d=L(),e=lh(a),f=ch(d,e);f.tag=1;f.payload=b;void 0!==c&&null!==c&&(f.callback=c);b=dh(a,f,e);null!==b&&(mh(b,a,e,d),eh(b,a,e))},enqueueForceUpdate:function(a,b){a=a._reactInternals;var c=L(),d=\nlh(a),e=ch(c,d);e.tag=2;void 0!==b&&null!==b&&(e.callback=b);b=dh(a,e,d);null!==b&&(mh(b,a,d,c),eh(b,a,d))}};function oh(a,b,c,d,e,f,g){a=a.stateNode;return\"function\"===typeof a.shouldComponentUpdate?a.shouldComponentUpdate(d,f,g):b.prototype&&b.prototype.isPureReactComponent?!Ie(c,d)||!Ie(e,f):!0}\nfunction ph(a,b,c){var d=!1,e=Vf;var f=b.contextType;\"object\"===typeof f&&null!==f?f=Vg(f):(e=Zf(b)?Xf:H.current,d=b.contextTypes,f=(d=null!==d&&void 0!==d)?Yf(a,e):Vf);b=new b(c,f);a.memoizedState=null!==b.state&&void 0!==b.state?b.state:null;b.updater=nh;a.stateNode=b;b._reactInternals=a;d&&(a=a.stateNode,a.__reactInternalMemoizedUnmaskedChildContext=e,a.__reactInternalMemoizedMaskedChildContext=f);return b}\nfunction qh(a,b,c,d){a=b.state;\"function\"===typeof b.componentWillReceiveProps&&b.componentWillReceiveProps(c,d);\"function\"===typeof b.UNSAFE_componentWillReceiveProps&&b.UNSAFE_componentWillReceiveProps(c,d);b.state!==a&&nh.enqueueReplaceState(b,b.state,null)}\nfunction rh(a,b,c,d){var e=a.stateNode;e.props=c;e.state=a.memoizedState;e.refs=jh;ah(a);var f=b.contextType;\"object\"===typeof f&&null!==f?e.context=Vg(f):(f=Zf(b)?Xf:H.current,e.context=Yf(a,f));e.state=a.memoizedState;f=b.getDerivedStateFromProps;\"function\"===typeof f&&(kh(a,b,f,c),e.state=a.memoizedState);\"function\"===typeof b.getDerivedStateFromProps||\"function\"===typeof e.getSnapshotBeforeUpdate||\"function\"!==typeof e.UNSAFE_componentWillMount&&\"function\"!==typeof e.componentWillMount||(b=e.state,\n\"function\"===typeof e.componentWillMount&&e.componentWillMount(),\"function\"===typeof e.UNSAFE_componentWillMount&&e.UNSAFE_componentWillMount(),b!==e.state&&nh.enqueueReplaceState(e,e.state,null),gh(a,c,e,d),e.state=a.memoizedState);\"function\"===typeof e.componentDidMount&&(a.flags|=4194308)}\nfunction sh(a,b,c){a=c.ref;if(null!==a&&\"function\"!==typeof a&&\"object\"!==typeof a){if(c._owner){c=c._owner;if(c){if(1!==c.tag)throw Error(p(309));var d=c.stateNode}if(!d)throw Error(p(147,a));var e=d,f=\"\"+a;if(null!==b&&null!==b.ref&&\"function\"===typeof b.ref&&b.ref._stringRef===f)return b.ref;b=function(a){var b=e.refs;b===jh&&(b=e.refs={});null===a?delete b[f]:b[f]=a};b._stringRef=f;return b}if(\"string\"!==typeof a)throw Error(p(284));if(!c._owner)throw Error(p(290,a));}return a}\nfunction th(a,b){a=Object.prototype.toString.call(b);throw Error(p(31,\"[object Object]\"===a?\"object with keys {\"+Object.keys(b).join(\", \")+\"}\":a));}function uh(a){var b=a._init;return b(a._payload)}\nfunction vh(a){function b(b,c){if(a){var d=b.deletions;null===d?(b.deletions=[c],b.flags|=16):d.push(c)}}function c(c,d){if(!a)return null;for(;null!==d;)b(c,d),d=d.sibling;return null}function d(a,b){for(a=new Map;null!==b;)null!==b.key?a.set(b.key,b):a.set(b.index,b),b=b.sibling;return a}function e(a,b){a=wh(a,b);a.index=0;a.sibling=null;return a}function f(b,c,d){b.index=d;if(!a)return b.flags|=1048576,c;d=b.alternate;if(null!==d)return d=d.index,d<c?(b.flags|=2,c):d;b.flags|=2;return c}function g(b){a&&\nnull===b.alternate&&(b.flags|=2);return b}function h(a,b,c,d){if(null===b||6!==b.tag)return b=xh(c,a.mode,d),b.return=a,b;b=e(b,c);b.return=a;return b}function k(a,b,c,d){var f=c.type;if(f===ya)return m(a,b,c.props.children,d,c.key);if(null!==b&&(b.elementType===f||\"object\"===typeof f&&null!==f&&f.$$typeof===Ha&&uh(f)===b.type))return d=e(b,c.props),d.ref=sh(a,b,c),d.return=a,d;d=yh(c.type,c.key,c.props,null,a.mode,d);d.ref=sh(a,b,c);d.return=a;return d}function l(a,b,c,d){if(null===b||4!==b.tag||\nb.stateNode.containerInfo!==c.containerInfo||b.stateNode.implementation!==c.implementation)return b=zh(c,a.mode,d),b.return=a,b;b=e(b,c.children||[]);b.return=a;return b}function m(a,b,c,d,f){if(null===b||7!==b.tag)return b=Ah(c,a.mode,d,f),b.return=a,b;b=e(b,c);b.return=a;return b}function q(a,b,c){if(\"string\"===typeof b&&\"\"!==b||\"number\"===typeof b)return b=xh(\"\"+b,a.mode,c),b.return=a,b;if(\"object\"===typeof b&&null!==b){switch(b.$$typeof){case va:return c=yh(b.type,b.key,b.props,null,a.mode,c),\nc.ref=sh(a,null,b),c.return=a,c;case wa:return b=zh(b,a.mode,c),b.return=a,b;case Ha:var d=b._init;return q(a,d(b._payload),c)}if(eb(b)||Ka(b))return b=Ah(b,a.mode,c,null),b.return=a,b;th(a,b)}return null}function r(a,b,c,d){var e=null!==b?b.key:null;if(\"string\"===typeof c&&\"\"!==c||\"number\"===typeof c)return null!==e?null:h(a,b,\"\"+c,d);if(\"object\"===typeof c&&null!==c){switch(c.$$typeof){case va:return c.key===e?k(a,b,c,d):null;case wa:return c.key===e?l(a,b,c,d):null;case Ha:return e=c._init,r(a,\nb,e(c._payload),d)}if(eb(c)||Ka(c))return null!==e?null:m(a,b,c,d,null);th(a,c)}return null}function y(a,b,c,d,e){if(\"string\"===typeof d&&\"\"!==d||\"number\"===typeof d)return a=a.get(c)||null,h(b,a,\"\"+d,e);if(\"object\"===typeof d&&null!==d){switch(d.$$typeof){case va:return a=a.get(null===d.key?c:d.key)||null,k(b,a,d,e);case wa:return a=a.get(null===d.key?c:d.key)||null,l(b,a,d,e);case Ha:var f=d._init;return y(a,b,c,f(d._payload),e)}if(eb(d)||Ka(d))return a=a.get(c)||null,m(b,a,d,e,null);th(b,d)}return null}\nfunction n(e,g,h,k){for(var l=null,m=null,u=g,w=g=0,x=null;null!==u&&w<h.length;w++){u.index>w?(x=u,u=null):x=u.sibling;var n=r(e,u,h[w],k);if(null===n){null===u&&(u=x);break}a&&u&&null===n.alternate&&b(e,u);g=f(n,g,w);null===m?l=n:m.sibling=n;m=n;u=x}if(w===h.length)return c(e,u),I&&tg(e,w),l;if(null===u){for(;w<h.length;w++)u=q(e,h[w],k),null!==u&&(g=f(u,g,w),null===m?l=u:m.sibling=u,m=u);I&&tg(e,w);return l}for(u=d(e,u);w<h.length;w++)x=y(u,e,w,h[w],k),null!==x&&(a&&null!==x.alternate&&u.delete(null===\nx.key?w:x.key),g=f(x,g,w),null===m?l=x:m.sibling=x,m=x);a&&u.forEach(function(a){return b(e,a)});I&&tg(e,w);return l}function t(e,g,h,k){var l=Ka(h);if(\"function\"!==typeof l)throw Error(p(150));h=l.call(h);if(null==h)throw Error(p(151));for(var u=l=null,m=g,w=g=0,x=null,n=h.next();null!==m&&!n.done;w++,n=h.next()){m.index>w?(x=m,m=null):x=m.sibling;var t=r(e,m,n.value,k);if(null===t){null===m&&(m=x);break}a&&m&&null===t.alternate&&b(e,m);g=f(t,g,w);null===u?l=t:u.sibling=t;u=t;m=x}if(n.done)return c(e,\nm),I&&tg(e,w),l;if(null===m){for(;!n.done;w++,n=h.next())n=q(e,n.value,k),null!==n&&(g=f(n,g,w),null===u?l=n:u.sibling=n,u=n);I&&tg(e,w);return l}for(m=d(e,m);!n.done;w++,n=h.next())n=y(m,e,w,n.value,k),null!==n&&(a&&null!==n.alternate&&m.delete(null===n.key?w:n.key),g=f(n,g,w),null===u?l=n:u.sibling=n,u=n);a&&m.forEach(function(a){return b(e,a)});I&&tg(e,w);return l}function J(a,d,f,h){\"object\"===typeof f&&null!==f&&f.type===ya&&null===f.key&&(f=f.props.children);if(\"object\"===typeof f&&null!==f){switch(f.$$typeof){case va:a:{for(var k=\nf.key,l=d;null!==l;){if(l.key===k){k=f.type;if(k===ya){if(7===l.tag){c(a,l.sibling);d=e(l,f.props.children);d.return=a;a=d;break a}}else if(l.elementType===k||\"object\"===typeof k&&null!==k&&k.$$typeof===Ha&&uh(k)===l.type){c(a,l.sibling);d=e(l,f.props);d.ref=sh(a,l,f);d.return=a;a=d;break a}c(a,l);break}else b(a,l);l=l.sibling}f.type===ya?(d=Ah(f.props.children,a.mode,h,f.key),d.return=a,a=d):(h=yh(f.type,f.key,f.props,null,a.mode,h),h.ref=sh(a,d,f),h.return=a,a=h)}return g(a);case wa:a:{for(l=f.key;null!==\nd;){if(d.key===l)if(4===d.tag&&d.stateNode.containerInfo===f.containerInfo&&d.stateNode.implementation===f.implementation){c(a,d.sibling);d=e(d,f.children||[]);d.return=a;a=d;break a}else{c(a,d);break}else b(a,d);d=d.sibling}d=zh(f,a.mode,h);d.return=a;a=d}return g(a);case Ha:return l=f._init,J(a,d,l(f._payload),h)}if(eb(f))return n(a,d,f,h);if(Ka(f))return t(a,d,f,h);th(a,f)}return\"string\"===typeof f&&\"\"!==f||\"number\"===typeof f?(f=\"\"+f,null!==d&&6===d.tag?(c(a,d.sibling),d=e(d,f),d.return=a,a=d):\n(c(a,d),d=xh(f,a.mode,h),d.return=a,a=d),g(a)):c(a,d)}return J}var Bh=vh(!0),Ch=vh(!1),Dh={},Eh=Uf(Dh),Fh=Uf(Dh),Gh=Uf(Dh);function Hh(a){if(a===Dh)throw Error(p(174));return a}function Ih(a,b){G(Gh,b);G(Fh,a);G(Eh,Dh);a=b.nodeType;switch(a){case 9:case 11:b=(b=b.documentElement)?b.namespaceURI:lb(null,\"\");break;default:a=8===a?b.parentNode:b,b=a.namespaceURI||null,a=a.tagName,b=lb(b,a)}E(Eh);G(Eh,b)}function Jh(){E(Eh);E(Fh);E(Gh)}\nfunction Kh(a){Hh(Gh.current);var b=Hh(Eh.current);var c=lb(b,a.type);b!==c&&(G(Fh,a),G(Eh,c))}function Lh(a){Fh.current===a&&(E(Eh),E(Fh))}var M=Uf(0);\nfunction Mh(a){for(var b=a;null!==b;){if(13===b.tag){var c=b.memoizedState;if(null!==c&&(c=c.dehydrated,null===c||\"$?\"===c.data||\"$!\"===c.data))return b}else if(19===b.tag&&void 0!==b.memoizedProps.revealOrder){if(0!==(b.flags&128))return b}else if(null!==b.child){b.child.return=b;b=b.child;continue}if(b===a)break;for(;null===b.sibling;){if(null===b.return||b.return===a)return null;b=b.return}b.sibling.return=b.return;b=b.sibling}return null}var Nh=[];\nfunction Oh(){for(var a=0;a<Nh.length;a++)Nh[a]._workInProgressVersionPrimary=null;Nh.length=0}var Ph=ua.ReactCurrentDispatcher,Qh=ua.ReactCurrentBatchConfig,Rh=0,N=null,O=null,P=null,Sh=!1,Th=!1,Uh=0,Vh=0;function Q(){throw Error(p(321));}function Wh(a,b){if(null===b)return!1;for(var c=0;c<b.length&&c<a.length;c++)if(!He(a[c],b[c]))return!1;return!0}\nfunction Xh(a,b,c,d,e,f){Rh=f;N=b;b.memoizedState=null;b.updateQueue=null;b.lanes=0;Ph.current=null===a||null===a.memoizedState?Yh:Zh;a=c(d,e);if(Th){f=0;do{Th=!1;Uh=0;if(25<=f)throw Error(p(301));f+=1;P=O=null;b.updateQueue=null;Ph.current=$h;a=c(d,e)}while(Th)}Ph.current=ai;b=null!==O&&null!==O.next;Rh=0;P=O=N=null;Sh=!1;if(b)throw Error(p(300));return a}function bi(){var a=0!==Uh;Uh=0;return a}\nfunction ci(){var a={memoizedState:null,baseState:null,baseQueue:null,queue:null,next:null};null===P?N.memoizedState=P=a:P=P.next=a;return P}function di(){if(null===O){var a=N.alternate;a=null!==a?a.memoizedState:null}else a=O.next;var b=null===P?N.memoizedState:P.next;if(null!==b)P=b,O=a;else{if(null===a)throw Error(p(310));O=a;a={memoizedState:O.memoizedState,baseState:O.baseState,baseQueue:O.baseQueue,queue:O.queue,next:null};null===P?N.memoizedState=P=a:P=P.next=a}return P}\nfunction ei(a,b){return\"function\"===typeof b?b(a):b}\nfunction fi(a){var b=di(),c=b.queue;if(null===c)throw Error(p(311));c.lastRenderedReducer=a;var d=O,e=d.baseQueue,f=c.pending;if(null!==f){if(null!==e){var g=e.next;e.next=f.next;f.next=g}d.baseQueue=e=f;c.pending=null}if(null!==e){f=e.next;d=d.baseState;var h=g=null,k=null,l=f;do{var m=l.lane;if((Rh&m)===m)null!==k&&(k=k.next={lane:0,action:l.action,hasEagerState:l.hasEagerState,eagerState:l.eagerState,next:null}),d=l.hasEagerState?l.eagerState:a(d,l.action);else{var q={lane:m,action:l.action,hasEagerState:l.hasEagerState,\neagerState:l.eagerState,next:null};null===k?(h=k=q,g=d):k=k.next=q;N.lanes|=m;hh|=m}l=l.next}while(null!==l&&l!==f);null===k?g=d:k.next=h;He(d,b.memoizedState)||(Ug=!0);b.memoizedState=d;b.baseState=g;b.baseQueue=k;c.lastRenderedState=d}a=c.interleaved;if(null!==a){e=a;do f=e.lane,N.lanes|=f,hh|=f,e=e.next;while(e!==a)}else null===e&&(c.lanes=0);return[b.memoizedState,c.dispatch]}\nfunction gi(a){var b=di(),c=b.queue;if(null===c)throw Error(p(311));c.lastRenderedReducer=a;var d=c.dispatch,e=c.pending,f=b.memoizedState;if(null!==e){c.pending=null;var g=e=e.next;do f=a(f,g.action),g=g.next;while(g!==e);He(f,b.memoizedState)||(Ug=!0);b.memoizedState=f;null===b.baseQueue&&(b.baseState=f);c.lastRenderedState=f}return[f,d]}function hi(){}\nfunction ii(a,b){var c=N,d=di(),e=b(),f=!He(d.memoizedState,e);f&&(d.memoizedState=e,Ug=!0);d=d.queue;ji(ki.bind(null,c,d,a),[a]);if(d.getSnapshot!==b||f||null!==P&&P.memoizedState.tag&1){c.flags|=2048;li(9,mi.bind(null,c,d,e,b),void 0,null);if(null===R)throw Error(p(349));0!==(Rh&30)||ni(c,b,e)}return e}function ni(a,b,c){a.flags|=16384;a={getSnapshot:b,value:c};b=N.updateQueue;null===b?(b={lastEffect:null,stores:null},N.updateQueue=b,b.stores=[a]):(c=b.stores,null===c?b.stores=[a]:c.push(a))}\nfunction mi(a,b,c,d){b.value=c;b.getSnapshot=d;oi(b)&&pi(a)}function ki(a,b,c){return c(function(){oi(b)&&pi(a)})}function oi(a){var b=a.getSnapshot;a=a.value;try{var c=b();return!He(a,c)}catch(d){return!0}}function pi(a){var b=Zg(a,1);null!==b&&mh(b,a,1,-1)}\nfunction qi(a){var b=ci();\"function\"===typeof a&&(a=a());b.memoizedState=b.baseState=a;a={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:ei,lastRenderedState:a};b.queue=a;a=a.dispatch=ri.bind(null,N,a);return[b.memoizedState,a]}\nfunction li(a,b,c,d){a={tag:a,create:b,destroy:c,deps:d,next:null};b=N.updateQueue;null===b?(b={lastEffect:null,stores:null},N.updateQueue=b,b.lastEffect=a.next=a):(c=b.lastEffect,null===c?b.lastEffect=a.next=a:(d=c.next,c.next=a,a.next=d,b.lastEffect=a));return a}function si(){return di().memoizedState}function ti(a,b,c,d){var e=ci();N.flags|=a;e.memoizedState=li(1|b,c,void 0,void 0===d?null:d)}\nfunction ui(a,b,c,d){var e=di();d=void 0===d?null:d;var f=void 0;if(null!==O){var g=O.memoizedState;f=g.destroy;if(null!==d&&Wh(d,g.deps)){e.memoizedState=li(b,c,f,d);return}}N.flags|=a;e.memoizedState=li(1|b,c,f,d)}function vi(a,b){return ti(8390656,8,a,b)}function ji(a,b){return ui(2048,8,a,b)}function wi(a,b){return ui(4,2,a,b)}function xi(a,b){return ui(4,4,a,b)}\nfunction yi(a,b){if(\"function\"===typeof b)return a=a(),b(a),function(){b(null)};if(null!==b&&void 0!==b)return a=a(),b.current=a,function(){b.current=null}}function zi(a,b,c){c=null!==c&&void 0!==c?c.concat([a]):null;return ui(4,4,yi.bind(null,b,a),c)}function Ai(){}function Bi(a,b){var c=di();b=void 0===b?null:b;var d=c.memoizedState;if(null!==d&&null!==b&&Wh(b,d[1]))return d[0];c.memoizedState=[a,b];return a}\nfunction Ci(a,b){var c=di();b=void 0===b?null:b;var d=c.memoizedState;if(null!==d&&null!==b&&Wh(b,d[1]))return d[0];a=a();c.memoizedState=[a,b];return a}function Di(a,b,c){if(0===(Rh&21))return a.baseState&&(a.baseState=!1,Ug=!0),a.memoizedState=c;He(c,b)||(c=yc(),N.lanes|=c,hh|=c,a.baseState=!0);return b}function Ei(a,b){var c=C;C=0!==c&&4>c?c:4;a(!0);var d=Qh.transition;Qh.transition={};try{a(!1),b()}finally{C=c,Qh.transition=d}}function Fi(){return di().memoizedState}\nfunction Gi(a,b,c){var d=lh(a);c={lane:d,action:c,hasEagerState:!1,eagerState:null,next:null};if(Hi(a))Ii(b,c);else if(c=Yg(a,b,c,d),null!==c){var e=L();mh(c,a,d,e);Ji(c,b,d)}}\nfunction ri(a,b,c){var d=lh(a),e={lane:d,action:c,hasEagerState:!1,eagerState:null,next:null};if(Hi(a))Ii(b,e);else{var f=a.alternate;if(0===a.lanes&&(null===f||0===f.lanes)&&(f=b.lastRenderedReducer,null!==f))try{var g=b.lastRenderedState,h=f(g,c);e.hasEagerState=!0;e.eagerState=h;if(He(h,g)){var k=b.interleaved;null===k?(e.next=e,Xg(b)):(e.next=k.next,k.next=e);b.interleaved=e;return}}catch(l){}finally{}c=Yg(a,b,e,d);null!==c&&(e=L(),mh(c,a,d,e),Ji(c,b,d))}}\nfunction Hi(a){var b=a.alternate;return a===N||null!==b&&b===N}function Ii(a,b){Th=Sh=!0;var c=a.pending;null===c?b.next=b:(b.next=c.next,c.next=b);a.pending=b}function Ji(a,b,c){if(0!==(c&4194240)){var d=b.lanes;d&=a.pendingLanes;c|=d;b.lanes=c;Cc(a,c)}}\nvar ai={readContext:Vg,useCallback:Q,useContext:Q,useEffect:Q,useImperativeHandle:Q,useInsertionEffect:Q,useLayoutEffect:Q,useMemo:Q,useReducer:Q,useRef:Q,useState:Q,useDebugValue:Q,useDeferredValue:Q,useTransition:Q,useMutableSource:Q,useSyncExternalStore:Q,useId:Q,unstable_isNewReconciler:!1},Yh={readContext:Vg,useCallback:function(a,b){ci().memoizedState=[a,void 0===b?null:b];return a},useContext:Vg,useEffect:vi,useImperativeHandle:function(a,b,c){c=null!==c&&void 0!==c?c.concat([a]):null;return ti(4194308,\n4,yi.bind(null,b,a),c)},useLayoutEffect:function(a,b){return ti(4194308,4,a,b)},useInsertionEffect:function(a,b){return ti(4,2,a,b)},useMemo:function(a,b){var c=ci();b=void 0===b?null:b;a=a();c.memoizedState=[a,b];return a},useReducer:function(a,b,c){var d=ci();b=void 0!==c?c(b):b;d.memoizedState=d.baseState=b;a={pending:null,interleaved:null,lanes:0,dispatch:null,lastRenderedReducer:a,lastRenderedState:b};d.queue=a;a=a.dispatch=Gi.bind(null,N,a);return[d.memoizedState,a]},useRef:function(a){var b=\nci();a={current:a};return b.memoizedState=a},useState:qi,useDebugValue:Ai,useDeferredValue:function(a){return ci().memoizedState=a},useTransition:function(){var a=qi(!1),b=a[0];a=Ei.bind(null,a[1]);ci().memoizedState=a;return[b,a]},useMutableSource:function(){},useSyncExternalStore:function(a,b,c){var d=N,e=ci();if(I){if(void 0===c)throw Error(p(407));c=c()}else{c=b();if(null===R)throw Error(p(349));0!==(Rh&30)||ni(d,b,c)}e.memoizedState=c;var f={value:c,getSnapshot:b};e.queue=f;vi(ki.bind(null,d,\nf,a),[a]);d.flags|=2048;li(9,mi.bind(null,d,f,c,b),void 0,null);return c},useId:function(){var a=ci(),b=R.identifierPrefix;if(I){var c=sg;var d=rg;c=(d&~(1<<32-oc(d)-1)).toString(32)+c;b=\":\"+b+\"R\"+c;c=Uh++;0<c&&(b+=\"H\"+c.toString(32));b+=\":\"}else c=Vh++,b=\":\"+b+\"r\"+c.toString(32)+\":\";return a.memoizedState=b},unstable_isNewReconciler:!1},Zh={readContext:Vg,useCallback:Bi,useContext:Vg,useEffect:ji,useImperativeHandle:zi,useInsertionEffect:wi,useLayoutEffect:xi,useMemo:Ci,useReducer:fi,useRef:si,useState:function(){return fi(ei)},\nuseDebugValue:Ai,useDeferredValue:function(a){var b=di();return Di(b,O.memoizedState,a)},useTransition:function(){var a=fi(ei)[0],b=di().memoizedState;return[a,b]},useMutableSource:hi,useSyncExternalStore:ii,useId:Fi,unstable_isNewReconciler:!1},$h={readContext:Vg,useCallback:Bi,useContext:Vg,useEffect:ji,useImperativeHandle:zi,useInsertionEffect:wi,useLayoutEffect:xi,useMemo:Ci,useReducer:gi,useRef:si,useState:function(){return gi(ei)},useDebugValue:Ai,useDeferredValue:function(a){var b=di();return null===\nO?b.memoizedState=a:Di(b,O.memoizedState,a)},useTransition:function(){var a=gi(ei)[0],b=di().memoizedState;return[a,b]},useMutableSource:hi,useSyncExternalStore:ii,useId:Fi,unstable_isNewReconciler:!1};function Ki(a,b){try{var c=\"\",d=b;do c+=Pa(d),d=d.return;while(d);var e=c}catch(f){e=\"\\nError generating stack: \"+f.message+\"\\n\"+f.stack}return{value:a,source:b,stack:e,digest:null}}function Li(a,b,c){return{value:a,source:null,stack:null!=c?c:null,digest:null!=b?b:null}}\nfunction Mi(a,b){try{console.error(b.value)}catch(c){setTimeout(function(){throw c;})}}var Ni=\"function\"===typeof WeakMap?WeakMap:Map;function Oi(a,b,c){c=ch(-1,c);c.tag=3;c.payload={element:null};var d=b.value;c.callback=function(){Pi||(Pi=!0,Qi=d);Mi(a,b)};return c}\nfunction Ri(a,b,c){c=ch(-1,c);c.tag=3;var d=a.type.getDerivedStateFromError;if(\"function\"===typeof d){var e=b.value;c.payload=function(){return d(e)};c.callback=function(){Mi(a,b)}}var f=a.stateNode;null!==f&&\"function\"===typeof f.componentDidCatch&&(c.callback=function(){Mi(a,b);\"function\"!==typeof d&&(null===Si?Si=new Set([this]):Si.add(this));var c=b.stack;this.componentDidCatch(b.value,{componentStack:null!==c?c:\"\"})});return c}\nfunction Ti(a,b,c){var d=a.pingCache;if(null===d){d=a.pingCache=new Ni;var e=new Set;d.set(b,e)}else e=d.get(b),void 0===e&&(e=new Set,d.set(b,e));e.has(c)||(e.add(c),a=Ui.bind(null,a,b,c),b.then(a,a))}function Vi(a){do{var b;if(b=13===a.tag)b=a.memoizedState,b=null!==b?null!==b.dehydrated?!0:!1:!0;if(b)return a;a=a.return}while(null!==a);return null}\nfunction Wi(a,b,c,d,e){if(0===(a.mode&1))return a===b?a.flags|=65536:(a.flags|=128,c.flags|=131072,c.flags&=-52805,1===c.tag&&(null===c.alternate?c.tag=17:(b=ch(-1,1),b.tag=2,dh(c,b,1))),c.lanes|=1),a;a.flags|=65536;a.lanes=e;return a}var Xi=ua.ReactCurrentOwner,Ug=!1;function Yi(a,b,c,d){b.child=null===a?Ch(b,null,c,d):Bh(b,a.child,c,d)}\nfunction Zi(a,b,c,d,e){c=c.render;var f=b.ref;Tg(b,e);d=Xh(a,b,c,d,f,e);c=bi();if(null!==a&&!Ug)return b.updateQueue=a.updateQueue,b.flags&=-2053,a.lanes&=~e,$i(a,b,e);I&&c&&vg(b);b.flags|=1;Yi(a,b,d,e);return b.child}\nfunction aj(a,b,c,d,e){if(null===a){var f=c.type;if(\"function\"===typeof f&&!bj(f)&&void 0===f.defaultProps&&null===c.compare&&void 0===c.defaultProps)return b.tag=15,b.type=f,cj(a,b,f,d,e);a=yh(c.type,null,d,b,b.mode,e);a.ref=b.ref;a.return=b;return b.child=a}f=a.child;if(0===(a.lanes&e)){var g=f.memoizedProps;c=c.compare;c=null!==c?c:Ie;if(c(g,d)&&a.ref===b.ref)return $i(a,b,e)}b.flags|=1;a=wh(f,d);a.ref=b.ref;a.return=b;return b.child=a}\nfunction cj(a,b,c,d,e){if(null!==a){var f=a.memoizedProps;if(Ie(f,d)&&a.ref===b.ref)if(Ug=!1,b.pendingProps=d=f,0!==(a.lanes&e))0!==(a.flags&131072)&&(Ug=!0);else return b.lanes=a.lanes,$i(a,b,e)}return dj(a,b,c,d,e)}\nfunction ej(a,b,c){var d=b.pendingProps,e=d.children,f=null!==a?a.memoizedState:null;if(\"hidden\"===d.mode)if(0===(b.mode&1))b.memoizedState={baseLanes:0,cachePool:null,transitions:null},G(fj,gj),gj|=c;else{if(0===(c&1073741824))return a=null!==f?f.baseLanes|c:c,b.lanes=b.childLanes=1073741824,b.memoizedState={baseLanes:a,cachePool:null,transitions:null},b.updateQueue=null,G(fj,gj),gj|=a,null;b.memoizedState={baseLanes:0,cachePool:null,transitions:null};d=null!==f?f.baseLanes:c;G(fj,gj);gj|=d}else null!==\nf?(d=f.baseLanes|c,b.memoizedState=null):d=c,G(fj,gj),gj|=d;Yi(a,b,e,c);return b.child}function hj(a,b){var c=b.ref;if(null===a&&null!==c||null!==a&&a.ref!==c)b.flags|=512,b.flags|=2097152}function dj(a,b,c,d,e){var f=Zf(c)?Xf:H.current;f=Yf(b,f);Tg(b,e);c=Xh(a,b,c,d,f,e);d=bi();if(null!==a&&!Ug)return b.updateQueue=a.updateQueue,b.flags&=-2053,a.lanes&=~e,$i(a,b,e);I&&d&&vg(b);b.flags|=1;Yi(a,b,c,e);return b.child}\nfunction ij(a,b,c,d,e){if(Zf(c)){var f=!0;cg(b)}else f=!1;Tg(b,e);if(null===b.stateNode)jj(a,b),ph(b,c,d),rh(b,c,d,e),d=!0;else if(null===a){var g=b.stateNode,h=b.memoizedProps;g.props=h;var k=g.context,l=c.contextType;\"object\"===typeof l&&null!==l?l=Vg(l):(l=Zf(c)?Xf:H.current,l=Yf(b,l));var m=c.getDerivedStateFromProps,q=\"function\"===typeof m||\"function\"===typeof g.getSnapshotBeforeUpdate;q||\"function\"!==typeof g.UNSAFE_componentWillReceiveProps&&\"function\"!==typeof g.componentWillReceiveProps||\n(h!==d||k!==l)&&qh(b,g,d,l);$g=!1;var r=b.memoizedState;g.state=r;gh(b,d,g,e);k=b.memoizedState;h!==d||r!==k||Wf.current||$g?(\"function\"===typeof m&&(kh(b,c,m,d),k=b.memoizedState),(h=$g||oh(b,c,h,d,r,k,l))?(q||\"function\"!==typeof g.UNSAFE_componentWillMount&&\"function\"!==typeof g.componentWillMount||(\"function\"===typeof g.componentWillMount&&g.componentWillMount(),\"function\"===typeof g.UNSAFE_componentWillMount&&g.UNSAFE_componentWillMount()),\"function\"===typeof g.componentDidMount&&(b.flags|=4194308)):\n(\"function\"===typeof g.componentDidMount&&(b.flags|=4194308),b.memoizedProps=d,b.memoizedState=k),g.props=d,g.state=k,g.context=l,d=h):(\"function\"===typeof g.componentDidMount&&(b.flags|=4194308),d=!1)}else{g=b.stateNode;bh(a,b);h=b.memoizedProps;l=b.type===b.elementType?h:Lg(b.type,h);g.props=l;q=b.pendingProps;r=g.context;k=c.contextType;\"object\"===typeof k&&null!==k?k=Vg(k):(k=Zf(c)?Xf:H.current,k=Yf(b,k));var y=c.getDerivedStateFromProps;(m=\"function\"===typeof y||\"function\"===typeof g.getSnapshotBeforeUpdate)||\n\"function\"!==typeof g.UNSAFE_componentWillReceiveProps&&\"function\"!==typeof g.componentWillReceiveProps||(h!==q||r!==k)&&qh(b,g,d,k);$g=!1;r=b.memoizedState;g.state=r;gh(b,d,g,e);var n=b.memoizedState;h!==q||r!==n||Wf.current||$g?(\"function\"===typeof y&&(kh(b,c,y,d),n=b.memoizedState),(l=$g||oh(b,c,l,d,r,n,k)||!1)?(m||\"function\"!==typeof g.UNSAFE_componentWillUpdate&&\"function\"!==typeof g.componentWillUpdate||(\"function\"===typeof g.componentWillUpdate&&g.componentWillUpdate(d,n,k),\"function\"===typeof g.UNSAFE_componentWillUpdate&&\ng.UNSAFE_componentWillUpdate(d,n,k)),\"function\"===typeof g.componentDidUpdate&&(b.flags|=4),\"function\"===typeof g.getSnapshotBeforeUpdate&&(b.flags|=1024)):(\"function\"!==typeof g.componentDidUpdate||h===a.memoizedProps&&r===a.memoizedState||(b.flags|=4),\"function\"!==typeof g.getSnapshotBeforeUpdate||h===a.memoizedProps&&r===a.memoizedState||(b.flags|=1024),b.memoizedProps=d,b.memoizedState=n),g.props=d,g.state=n,g.context=k,d=l):(\"function\"!==typeof g.componentDidUpdate||h===a.memoizedProps&&r===\na.memoizedState||(b.flags|=4),\"function\"!==typeof g.getSnapshotBeforeUpdate||h===a.memoizedProps&&r===a.memoizedState||(b.flags|=1024),d=!1)}return kj(a,b,c,d,f,e)}\nfunction kj(a,b,c,d,e,f){hj(a,b);var g=0!==(b.flags&128);if(!d&&!g)return e&&dg(b,c,!1),$i(a,b,f);d=b.stateNode;Xi.current=b;var h=g&&\"function\"!==typeof c.getDerivedStateFromError?null:d.render();b.flags|=1;null!==a&&g?(b.child=Bh(b,a.child,null,f),b.child=Bh(b,null,h,f)):Yi(a,b,h,f);b.memoizedState=d.state;e&&dg(b,c,!0);return b.child}function lj(a){var b=a.stateNode;b.pendingContext?ag(a,b.pendingContext,b.pendingContext!==b.context):b.context&&ag(a,b.context,!1);Ih(a,b.containerInfo)}\nfunction mj(a,b,c,d,e){Ig();Jg(e);b.flags|=256;Yi(a,b,c,d);return b.child}var nj={dehydrated:null,treeContext:null,retryLane:0};function oj(a){return{baseLanes:a,cachePool:null,transitions:null}}\nfunction pj(a,b,c){var d=b.pendingProps,e=M.current,f=!1,g=0!==(b.flags&128),h;(h=g)||(h=null!==a&&null===a.memoizedState?!1:0!==(e&2));if(h)f=!0,b.flags&=-129;else if(null===a||null!==a.memoizedState)e|=1;G(M,e&1);if(null===a){Eg(b);a=b.memoizedState;if(null!==a&&(a=a.dehydrated,null!==a))return 0===(b.mode&1)?b.lanes=1:\"$!\"===a.data?b.lanes=8:b.lanes=1073741824,null;g=d.children;a=d.fallback;return f?(d=b.mode,f=b.child,g={mode:\"hidden\",children:g},0===(d&1)&&null!==f?(f.childLanes=0,f.pendingProps=\ng):f=qj(g,d,0,null),a=Ah(a,d,c,null),f.return=b,a.return=b,f.sibling=a,b.child=f,b.child.memoizedState=oj(c),b.memoizedState=nj,a):rj(b,g)}e=a.memoizedState;if(null!==e&&(h=e.dehydrated,null!==h))return sj(a,b,g,d,h,e,c);if(f){f=d.fallback;g=b.mode;e=a.child;h=e.sibling;var k={mode:\"hidden\",children:d.children};0===(g&1)&&b.child!==e?(d=b.child,d.childLanes=0,d.pendingProps=k,b.deletions=null):(d=wh(e,k),d.subtreeFlags=e.subtreeFlags&14680064);null!==h?f=wh(h,f):(f=Ah(f,g,c,null),f.flags|=2);f.return=\nb;d.return=b;d.sibling=f;b.child=d;d=f;f=b.child;g=a.child.memoizedState;g=null===g?oj(c):{baseLanes:g.baseLanes|c,cachePool:null,transitions:g.transitions};f.memoizedState=g;f.childLanes=a.childLanes&~c;b.memoizedState=nj;return d}f=a.child;a=f.sibling;d=wh(f,{mode:\"visible\",children:d.children});0===(b.mode&1)&&(d.lanes=c);d.return=b;d.sibling=null;null!==a&&(c=b.deletions,null===c?(b.deletions=[a],b.flags|=16):c.push(a));b.child=d;b.memoizedState=null;return d}\nfunction rj(a,b){b=qj({mode:\"visible\",children:b},a.mode,0,null);b.return=a;return a.child=b}function tj(a,b,c,d){null!==d&&Jg(d);Bh(b,a.child,null,c);a=rj(b,b.pendingProps.children);a.flags|=2;b.memoizedState=null;return a}\nfunction sj(a,b,c,d,e,f,g){if(c){if(b.flags&256)return b.flags&=-257,d=Li(Error(p(422))),tj(a,b,g,d);if(null!==b.memoizedState)return b.child=a.child,b.flags|=128,null;f=d.fallback;e=b.mode;d=qj({mode:\"visible\",children:d.children},e,0,null);f=Ah(f,e,g,null);f.flags|=2;d.return=b;f.return=b;d.sibling=f;b.child=d;0!==(b.mode&1)&&Bh(b,a.child,null,g);b.child.memoizedState=oj(g);b.memoizedState=nj;return f}if(0===(b.mode&1))return tj(a,b,g,null);if(\"$!\"===e.data){d=e.nextSibling&&e.nextSibling.dataset;\nif(d)var h=d.dgst;d=h;f=Error(p(419));d=Li(f,d,void 0);return tj(a,b,g,d)}h=0!==(g&a.childLanes);if(Ug||h){d=R;if(null!==d){switch(g&-g){case 4:e=2;break;case 16:e=8;break;case 64:case 128:case 256:case 512:case 1024:case 2048:case 4096:case 8192:case 16384:case 32768:case 65536:case 131072:case 262144:case 524288:case 1048576:case 2097152:case 4194304:case 8388608:case 16777216:case 33554432:case 67108864:e=32;break;case 536870912:e=268435456;break;default:e=0}e=0!==(e&(d.suspendedLanes|g))?0:e;\n0!==e&&e!==f.retryLane&&(f.retryLane=e,Zg(a,e),mh(d,a,e,-1))}uj();d=Li(Error(p(421)));return tj(a,b,g,d)}if(\"$?\"===e.data)return b.flags|=128,b.child=a.child,b=vj.bind(null,a),e._reactRetry=b,null;a=f.treeContext;yg=Lf(e.nextSibling);xg=b;I=!0;zg=null;null!==a&&(og[pg++]=rg,og[pg++]=sg,og[pg++]=qg,rg=a.id,sg=a.overflow,qg=b);b=rj(b,d.children);b.flags|=4096;return b}function wj(a,b,c){a.lanes|=b;var d=a.alternate;null!==d&&(d.lanes|=b);Sg(a.return,b,c)}\nfunction xj(a,b,c,d,e){var f=a.memoizedState;null===f?a.memoizedState={isBackwards:b,rendering:null,renderingStartTime:0,last:d,tail:c,tailMode:e}:(f.isBackwards=b,f.rendering=null,f.renderingStartTime=0,f.last=d,f.tail=c,f.tailMode=e)}\nfunction yj(a,b,c){var d=b.pendingProps,e=d.revealOrder,f=d.tail;Yi(a,b,d.children,c);d=M.current;if(0!==(d&2))d=d&1|2,b.flags|=128;else{if(null!==a&&0!==(a.flags&128))a:for(a=b.child;null!==a;){if(13===a.tag)null!==a.memoizedState&&wj(a,c,b);else if(19===a.tag)wj(a,c,b);else if(null!==a.child){a.child.return=a;a=a.child;continue}if(a===b)break a;for(;null===a.sibling;){if(null===a.return||a.return===b)break a;a=a.return}a.sibling.return=a.return;a=a.sibling}d&=1}G(M,d);if(0===(b.mode&1))b.memoizedState=\nnull;else switch(e){case \"forwards\":c=b.child;for(e=null;null!==c;)a=c.alternate,null!==a&&null===Mh(a)&&(e=c),c=c.sibling;c=e;null===c?(e=b.child,b.child=null):(e=c.sibling,c.sibling=null);xj(b,!1,e,c,f);break;case \"backwards\":c=null;e=b.child;for(b.child=null;null!==e;){a=e.alternate;if(null!==a&&null===Mh(a)){b.child=e;break}a=e.sibling;e.sibling=c;c=e;e=a}xj(b,!0,c,null,f);break;case \"together\":xj(b,!1,null,null,void 0);break;default:b.memoizedState=null}return b.child}\nfunction jj(a,b){0===(b.mode&1)&&null!==a&&(a.alternate=null,b.alternate=null,b.flags|=2)}function $i(a,b,c){null!==a&&(b.dependencies=a.dependencies);hh|=b.lanes;if(0===(c&b.childLanes))return null;if(null!==a&&b.child!==a.child)throw Error(p(153));if(null!==b.child){a=b.child;c=wh(a,a.pendingProps);b.child=c;for(c.return=b;null!==a.sibling;)a=a.sibling,c=c.sibling=wh(a,a.pendingProps),c.return=b;c.sibling=null}return b.child}\nfunction zj(a,b,c){switch(b.tag){case 3:lj(b);Ig();break;case 5:Kh(b);break;case 1:Zf(b.type)&&cg(b);break;case 4:Ih(b,b.stateNode.containerInfo);break;case 10:var d=b.type._context,e=b.memoizedProps.value;G(Mg,d._currentValue);d._currentValue=e;break;case 13:d=b.memoizedState;if(null!==d){if(null!==d.dehydrated)return G(M,M.current&1),b.flags|=128,null;if(0!==(c&b.child.childLanes))return pj(a,b,c);G(M,M.current&1);a=$i(a,b,c);return null!==a?a.sibling:null}G(M,M.current&1);break;case 19:d=0!==(c&\nb.childLanes);if(0!==(a.flags&128)){if(d)return yj(a,b,c);b.flags|=128}e=b.memoizedState;null!==e&&(e.rendering=null,e.tail=null,e.lastEffect=null);G(M,M.current);if(d)break;else return null;case 22:case 23:return b.lanes=0,ej(a,b,c)}return $i(a,b,c)}var Aj,Bj,Cj,Dj;\nAj=function(a,b){for(var c=b.child;null!==c;){if(5===c.tag||6===c.tag)a.appendChild(c.stateNode);else if(4!==c.tag&&null!==c.child){c.child.return=c;c=c.child;continue}if(c===b)break;for(;null===c.sibling;){if(null===c.return||c.return===b)return;c=c.return}c.sibling.return=c.return;c=c.sibling}};Bj=function(){};\nCj=function(a,b,c,d){var e=a.memoizedProps;if(e!==d){a=b.stateNode;Hh(Eh.current);var f=null;switch(c){case \"input\":e=Ya(a,e);d=Ya(a,d);f=[];break;case \"select\":e=A({},e,{value:void 0});d=A({},d,{value:void 0});f=[];break;case \"textarea\":e=gb(a,e);d=gb(a,d);f=[];break;default:\"function\"!==typeof e.onClick&&\"function\"===typeof d.onClick&&(a.onclick=Bf)}ub(c,d);var g;c=null;for(l in e)if(!d.hasOwnProperty(l)&&e.hasOwnProperty(l)&&null!=e[l])if(\"style\"===l){var h=e[l];for(g in h)h.hasOwnProperty(g)&&\n(c||(c={}),c[g]=\"\")}else\"dangerouslySetInnerHTML\"!==l&&\"children\"!==l&&\"suppressContentEditableWarning\"!==l&&\"suppressHydrationWarning\"!==l&&\"autoFocus\"!==l&&(ea.hasOwnProperty(l)?f||(f=[]):(f=f||[]).push(l,null));for(l in d){var k=d[l];h=null!=e?e[l]:void 0;if(d.hasOwnProperty(l)&&k!==h&&(null!=k||null!=h))if(\"style\"===l)if(h){for(g in h)!h.hasOwnProperty(g)||k&&k.hasOwnProperty(g)||(c||(c={}),c[g]=\"\");for(g in k)k.hasOwnProperty(g)&&h[g]!==k[g]&&(c||(c={}),c[g]=k[g])}else c||(f||(f=[]),f.push(l,\nc)),c=k;else\"dangerouslySetInnerHTML\"===l?(k=k?k.__html:void 0,h=h?h.__html:void 0,null!=k&&h!==k&&(f=f||[]).push(l,k)):\"children\"===l?\"string\"!==typeof k&&\"number\"!==typeof k||(f=f||[]).push(l,\"\"+k):\"suppressContentEditableWarning\"!==l&&\"suppressHydrationWarning\"!==l&&(ea.hasOwnProperty(l)?(null!=k&&\"onScroll\"===l&&D(\"scroll\",a),f||h===k||(f=[])):(f=f||[]).push(l,k))}c&&(f=f||[]).push(\"style\",c);var l=f;if(b.updateQueue=l)b.flags|=4}};Dj=function(a,b,c,d){c!==d&&(b.flags|=4)};\nfunction Ej(a,b){if(!I)switch(a.tailMode){case \"hidden\":b=a.tail;for(var c=null;null!==b;)null!==b.alternate&&(c=b),b=b.sibling;null===c?a.tail=null:c.sibling=null;break;case \"collapsed\":c=a.tail;for(var d=null;null!==c;)null!==c.alternate&&(d=c),c=c.sibling;null===d?b||null===a.tail?a.tail=null:a.tail.sibling=null:d.sibling=null}}\nfunction S(a){var b=null!==a.alternate&&a.alternate.child===a.child,c=0,d=0;if(b)for(var e=a.child;null!==e;)c|=e.lanes|e.childLanes,d|=e.subtreeFlags&14680064,d|=e.flags&14680064,e.return=a,e=e.sibling;else for(e=a.child;null!==e;)c|=e.lanes|e.childLanes,d|=e.subtreeFlags,d|=e.flags,e.return=a,e=e.sibling;a.subtreeFlags|=d;a.childLanes=c;return b}\nfunction Fj(a,b,c){var d=b.pendingProps;wg(b);switch(b.tag){case 2:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return S(b),null;case 1:return Zf(b.type)&&$f(),S(b),null;case 3:d=b.stateNode;Jh();E(Wf);E(H);Oh();d.pendingContext&&(d.context=d.pendingContext,d.pendingContext=null);if(null===a||null===a.child)Gg(b)?b.flags|=4:null===a||a.memoizedState.isDehydrated&&0===(b.flags&256)||(b.flags|=1024,null!==zg&&(Gj(zg),zg=null));Bj(a,b);S(b);return null;case 5:Lh(b);var e=Hh(Gh.current);\nc=b.type;if(null!==a&&null!=b.stateNode)Cj(a,b,c,d,e),a.ref!==b.ref&&(b.flags|=512,b.flags|=2097152);else{if(!d){if(null===b.stateNode)throw Error(p(166));S(b);return null}a=Hh(Eh.current);if(Gg(b)){d=b.stateNode;c=b.type;var f=b.memoizedProps;d[Of]=b;d[Pf]=f;a=0!==(b.mode&1);switch(c){case \"dialog\":D(\"cancel\",d);D(\"close\",d);break;case \"iframe\":case \"object\":case \"embed\":D(\"load\",d);break;case \"video\":case \"audio\":for(e=0;e<lf.length;e++)D(lf[e],d);break;case \"source\":D(\"error\",d);break;case \"img\":case \"image\":case \"link\":D(\"error\",\nd);D(\"load\",d);break;case \"details\":D(\"toggle\",d);break;case \"input\":Za(d,f);D(\"invalid\",d);break;case \"select\":d._wrapperState={wasMultiple:!!f.multiple};D(\"invalid\",d);break;case \"textarea\":hb(d,f),D(\"invalid\",d)}ub(c,f);e=null;for(var g in f)if(f.hasOwnProperty(g)){var h=f[g];\"children\"===g?\"string\"===typeof h?d.textContent!==h&&(!0!==f.suppressHydrationWarning&&Af(d.textContent,h,a),e=[\"children\",h]):\"number\"===typeof h&&d.textContent!==\"\"+h&&(!0!==f.suppressHydrationWarning&&Af(d.textContent,\nh,a),e=[\"children\",\"\"+h]):ea.hasOwnProperty(g)&&null!=h&&\"onScroll\"===g&&D(\"scroll\",d)}switch(c){case \"input\":Va(d);db(d,f,!0);break;case \"textarea\":Va(d);jb(d);break;case \"select\":case \"option\":break;default:\"function\"===typeof f.onClick&&(d.onclick=Bf)}d=e;b.updateQueue=d;null!==d&&(b.flags|=4)}else{g=9===e.nodeType?e:e.ownerDocument;\"http://www.w3.org/1999/xhtml\"===a&&(a=kb(c));\"http://www.w3.org/1999/xhtml\"===a?\"script\"===c?(a=g.createElement(\"div\"),a.innerHTML=\"<script>\\x3c/script>\",a=a.removeChild(a.firstChild)):\n\"string\"===typeof d.is?a=g.createElement(c,{is:d.is}):(a=g.createElement(c),\"select\"===c&&(g=a,d.multiple?g.multiple=!0:d.size&&(g.size=d.size))):a=g.createElementNS(a,c);a[Of]=b;a[Pf]=d;Aj(a,b,!1,!1);b.stateNode=a;a:{g=vb(c,d);switch(c){case \"dialog\":D(\"cancel\",a);D(\"close\",a);e=d;break;case \"iframe\":case \"object\":case \"embed\":D(\"load\",a);e=d;break;case \"video\":case \"audio\":for(e=0;e<lf.length;e++)D(lf[e],a);e=d;break;case \"source\":D(\"error\",a);e=d;break;case \"img\":case \"image\":case \"link\":D(\"error\",\na);D(\"load\",a);e=d;break;case \"details\":D(\"toggle\",a);e=d;break;case \"input\":Za(a,d);e=Ya(a,d);D(\"invalid\",a);break;case \"option\":e=d;break;case \"select\":a._wrapperState={wasMultiple:!!d.multiple};e=A({},d,{value:void 0});D(\"invalid\",a);break;case \"textarea\":hb(a,d);e=gb(a,d);D(\"invalid\",a);break;default:e=d}ub(c,e);h=e;for(f in h)if(h.hasOwnProperty(f)){var k=h[f];\"style\"===f?sb(a,k):\"dangerouslySetInnerHTML\"===f?(k=k?k.__html:void 0,null!=k&&nb(a,k)):\"children\"===f?\"string\"===typeof k?(\"textarea\"!==\nc||\"\"!==k)&&ob(a,k):\"number\"===typeof k&&ob(a,\"\"+k):\"suppressContentEditableWarning\"!==f&&\"suppressHydrationWarning\"!==f&&\"autoFocus\"!==f&&(ea.hasOwnProperty(f)?null!=k&&\"onScroll\"===f&&D(\"scroll\",a):null!=k&&ta(a,f,k,g))}switch(c){case \"input\":Va(a);db(a,d,!1);break;case \"textarea\":Va(a);jb(a);break;case \"option\":null!=d.value&&a.setAttribute(\"value\",\"\"+Sa(d.value));break;case \"select\":a.multiple=!!d.multiple;f=d.value;null!=f?fb(a,!!d.multiple,f,!1):null!=d.defaultValue&&fb(a,!!d.multiple,d.defaultValue,\n!0);break;default:\"function\"===typeof e.onClick&&(a.onclick=Bf)}switch(c){case \"button\":case \"input\":case \"select\":case \"textarea\":d=!!d.autoFocus;break a;case \"img\":d=!0;break a;default:d=!1}}d&&(b.flags|=4)}null!==b.ref&&(b.flags|=512,b.flags|=2097152)}S(b);return null;case 6:if(a&&null!=b.stateNode)Dj(a,b,a.memoizedProps,d);else{if(\"string\"!==typeof d&&null===b.stateNode)throw Error(p(166));c=Hh(Gh.current);Hh(Eh.current);if(Gg(b)){d=b.stateNode;c=b.memoizedProps;d[Of]=b;if(f=d.nodeValue!==c)if(a=\nxg,null!==a)switch(a.tag){case 3:Af(d.nodeValue,c,0!==(a.mode&1));break;case 5:!0!==a.memoizedProps.suppressHydrationWarning&&Af(d.nodeValue,c,0!==(a.mode&1))}f&&(b.flags|=4)}else d=(9===c.nodeType?c:c.ownerDocument).createTextNode(d),d[Of]=b,b.stateNode=d}S(b);return null;case 13:E(M);d=b.memoizedState;if(null===a||null!==a.memoizedState&&null!==a.memoizedState.dehydrated){if(I&&null!==yg&&0!==(b.mode&1)&&0===(b.flags&128))Hg(),Ig(),b.flags|=98560,f=!1;else if(f=Gg(b),null!==d&&null!==d.dehydrated){if(null===\na){if(!f)throw Error(p(318));f=b.memoizedState;f=null!==f?f.dehydrated:null;if(!f)throw Error(p(317));f[Of]=b}else Ig(),0===(b.flags&128)&&(b.memoizedState=null),b.flags|=4;S(b);f=!1}else null!==zg&&(Gj(zg),zg=null),f=!0;if(!f)return b.flags&65536?b:null}if(0!==(b.flags&128))return b.lanes=c,b;d=null!==d;d!==(null!==a&&null!==a.memoizedState)&&d&&(b.child.flags|=8192,0!==(b.mode&1)&&(null===a||0!==(M.current&1)?0===T&&(T=3):uj()));null!==b.updateQueue&&(b.flags|=4);S(b);return null;case 4:return Jh(),\nBj(a,b),null===a&&sf(b.stateNode.containerInfo),S(b),null;case 10:return Rg(b.type._context),S(b),null;case 17:return Zf(b.type)&&$f(),S(b),null;case 19:E(M);f=b.memoizedState;if(null===f)return S(b),null;d=0!==(b.flags&128);g=f.rendering;if(null===g)if(d)Ej(f,!1);else{if(0!==T||null!==a&&0!==(a.flags&128))for(a=b.child;null!==a;){g=Mh(a);if(null!==g){b.flags|=128;Ej(f,!1);d=g.updateQueue;null!==d&&(b.updateQueue=d,b.flags|=4);b.subtreeFlags=0;d=c;for(c=b.child;null!==c;)f=c,a=d,f.flags&=14680066,\ng=f.alternate,null===g?(f.childLanes=0,f.lanes=a,f.child=null,f.subtreeFlags=0,f.memoizedProps=null,f.memoizedState=null,f.updateQueue=null,f.dependencies=null,f.stateNode=null):(f.childLanes=g.childLanes,f.lanes=g.lanes,f.child=g.child,f.subtreeFlags=0,f.deletions=null,f.memoizedProps=g.memoizedProps,f.memoizedState=g.memoizedState,f.updateQueue=g.updateQueue,f.type=g.type,a=g.dependencies,f.dependencies=null===a?null:{lanes:a.lanes,firstContext:a.firstContext}),c=c.sibling;G(M,M.current&1|2);return b.child}a=\na.sibling}null!==f.tail&&B()>Hj&&(b.flags|=128,d=!0,Ej(f,!1),b.lanes=4194304)}else{if(!d)if(a=Mh(g),null!==a){if(b.flags|=128,d=!0,c=a.updateQueue,null!==c&&(b.updateQueue=c,b.flags|=4),Ej(f,!0),null===f.tail&&\"hidden\"===f.tailMode&&!g.alternate&&!I)return S(b),null}else 2*B()-f.renderingStartTime>Hj&&1073741824!==c&&(b.flags|=128,d=!0,Ej(f,!1),b.lanes=4194304);f.isBackwards?(g.sibling=b.child,b.child=g):(c=f.last,null!==c?c.sibling=g:b.child=g,f.last=g)}if(null!==f.tail)return b=f.tail,f.rendering=\nb,f.tail=b.sibling,f.renderingStartTime=B(),b.sibling=null,c=M.current,G(M,d?c&1|2:c&1),b;S(b);return null;case 22:case 23:return Ij(),d=null!==b.memoizedState,null!==a&&null!==a.memoizedState!==d&&(b.flags|=8192),d&&0!==(b.mode&1)?0!==(gj&1073741824)&&(S(b),b.subtreeFlags&6&&(b.flags|=8192)):S(b),null;case 24:return null;case 25:return null}throw Error(p(156,b.tag));}\nfunction Jj(a,b){wg(b);switch(b.tag){case 1:return Zf(b.type)&&$f(),a=b.flags,a&65536?(b.flags=a&-65537|128,b):null;case 3:return Jh(),E(Wf),E(H),Oh(),a=b.flags,0!==(a&65536)&&0===(a&128)?(b.flags=a&-65537|128,b):null;case 5:return Lh(b),null;case 13:E(M);a=b.memoizedState;if(null!==a&&null!==a.dehydrated){if(null===b.alternate)throw Error(p(340));Ig()}a=b.flags;return a&65536?(b.flags=a&-65537|128,b):null;case 19:return E(M),null;case 4:return Jh(),null;case 10:return Rg(b.type._context),null;case 22:case 23:return Ij(),\nnull;case 24:return null;default:return null}}var Kj=!1,U=!1,Lj=\"function\"===typeof WeakSet?WeakSet:Set,V=null;function Mj(a,b){var c=a.ref;if(null!==c)if(\"function\"===typeof c)try{c(null)}catch(d){W(a,b,d)}else c.current=null}function Nj(a,b,c){try{c()}catch(d){W(a,b,d)}}var Oj=!1;\nfunction Pj(a,b){Cf=dd;a=Me();if(Ne(a)){if(\"selectionStart\"in a)var c={start:a.selectionStart,end:a.selectionEnd};else a:{c=(c=a.ownerDocument)&&c.defaultView||window;var d=c.getSelection&&c.getSelection();if(d&&0!==d.rangeCount){c=d.anchorNode;var e=d.anchorOffset,f=d.focusNode;d=d.focusOffset;try{c.nodeType,f.nodeType}catch(F){c=null;break a}var g=0,h=-1,k=-1,l=0,m=0,q=a,r=null;b:for(;;){for(var y;;){q!==c||0!==e&&3!==q.nodeType||(h=g+e);q!==f||0!==d&&3!==q.nodeType||(k=g+d);3===q.nodeType&&(g+=\nq.nodeValue.length);if(null===(y=q.firstChild))break;r=q;q=y}for(;;){if(q===a)break b;r===c&&++l===e&&(h=g);r===f&&++m===d&&(k=g);if(null!==(y=q.nextSibling))break;q=r;r=q.parentNode}q=y}c=-1===h||-1===k?null:{start:h,end:k}}else c=null}c=c||{start:0,end:0}}else c=null;Df={focusedElem:a,selectionRange:c};dd=!1;for(V=b;null!==V;)if(b=V,a=b.child,0!==(b.subtreeFlags&1028)&&null!==a)a.return=b,V=a;else for(;null!==V;){b=V;try{var n=b.alternate;if(0!==(b.flags&1024))switch(b.tag){case 0:case 11:case 15:break;\ncase 1:if(null!==n){var t=n.memoizedProps,J=n.memoizedState,x=b.stateNode,w=x.getSnapshotBeforeUpdate(b.elementType===b.type?t:Lg(b.type,t),J);x.__reactInternalSnapshotBeforeUpdate=w}break;case 3:var u=b.stateNode.containerInfo;1===u.nodeType?u.textContent=\"\":9===u.nodeType&&u.documentElement&&u.removeChild(u.documentElement);break;case 5:case 6:case 4:case 17:break;default:throw Error(p(163));}}catch(F){W(b,b.return,F)}a=b.sibling;if(null!==a){a.return=b.return;V=a;break}V=b.return}n=Oj;Oj=!1;return n}\nfunction Qj(a,b,c){var d=b.updateQueue;d=null!==d?d.lastEffect:null;if(null!==d){var e=d=d.next;do{if((e.tag&a)===a){var f=e.destroy;e.destroy=void 0;void 0!==f&&Nj(b,c,f)}e=e.next}while(e!==d)}}function Rj(a,b){b=b.updateQueue;b=null!==b?b.lastEffect:null;if(null!==b){var c=b=b.next;do{if((c.tag&a)===a){var d=c.create;c.destroy=d()}c=c.next}while(c!==b)}}function Sj(a){var b=a.ref;if(null!==b){var c=a.stateNode;switch(a.tag){case 5:a=c;break;default:a=c}\"function\"===typeof b?b(a):b.current=a}}\nfunction Tj(a){var b=a.alternate;null!==b&&(a.alternate=null,Tj(b));a.child=null;a.deletions=null;a.sibling=null;5===a.tag&&(b=a.stateNode,null!==b&&(delete b[Of],delete b[Pf],delete b[of],delete b[Qf],delete b[Rf]));a.stateNode=null;a.return=null;a.dependencies=null;a.memoizedProps=null;a.memoizedState=null;a.pendingProps=null;a.stateNode=null;a.updateQueue=null}function Uj(a){return 5===a.tag||3===a.tag||4===a.tag}\nfunction Vj(a){a:for(;;){for(;null===a.sibling;){if(null===a.return||Uj(a.return))return null;a=a.return}a.sibling.return=a.return;for(a=a.sibling;5!==a.tag&&6!==a.tag&&18!==a.tag;){if(a.flags&2)continue a;if(null===a.child||4===a.tag)continue a;else a.child.return=a,a=a.child}if(!(a.flags&2))return a.stateNode}}\nfunction Wj(a,b,c){var d=a.tag;if(5===d||6===d)a=a.stateNode,b?8===c.nodeType?c.parentNode.insertBefore(a,b):c.insertBefore(a,b):(8===c.nodeType?(b=c.parentNode,b.insertBefore(a,c)):(b=c,b.appendChild(a)),c=c._reactRootContainer,null!==c&&void 0!==c||null!==b.onclick||(b.onclick=Bf));else if(4!==d&&(a=a.child,null!==a))for(Wj(a,b,c),a=a.sibling;null!==a;)Wj(a,b,c),a=a.sibling}\nfunction Xj(a,b,c){var d=a.tag;if(5===d||6===d)a=a.stateNode,b?c.insertBefore(a,b):c.appendChild(a);else if(4!==d&&(a=a.child,null!==a))for(Xj(a,b,c),a=a.sibling;null!==a;)Xj(a,b,c),a=a.sibling}var X=null,Yj=!1;function Zj(a,b,c){for(c=c.child;null!==c;)ak(a,b,c),c=c.sibling}\nfunction ak(a,b,c){if(lc&&\"function\"===typeof lc.onCommitFiberUnmount)try{lc.onCommitFiberUnmount(kc,c)}catch(h){}switch(c.tag){case 5:U||Mj(c,b);case 6:var d=X,e=Yj;X=null;Zj(a,b,c);X=d;Yj=e;null!==X&&(Yj?(a=X,c=c.stateNode,8===a.nodeType?a.parentNode.removeChild(c):a.removeChild(c)):X.removeChild(c.stateNode));break;case 18:null!==X&&(Yj?(a=X,c=c.stateNode,8===a.nodeType?Kf(a.parentNode,c):1===a.nodeType&&Kf(a,c),bd(a)):Kf(X,c.stateNode));break;case 4:d=X;e=Yj;X=c.stateNode.containerInfo;Yj=!0;\nZj(a,b,c);X=d;Yj=e;break;case 0:case 11:case 14:case 15:if(!U&&(d=c.updateQueue,null!==d&&(d=d.lastEffect,null!==d))){e=d=d.next;do{var f=e,g=f.destroy;f=f.tag;void 0!==g&&(0!==(f&2)?Nj(c,b,g):0!==(f&4)&&Nj(c,b,g));e=e.next}while(e!==d)}Zj(a,b,c);break;case 1:if(!U&&(Mj(c,b),d=c.stateNode,\"function\"===typeof d.componentWillUnmount))try{d.props=c.memoizedProps,d.state=c.memoizedState,d.componentWillUnmount()}catch(h){W(c,b,h)}Zj(a,b,c);break;case 21:Zj(a,b,c);break;case 22:c.mode&1?(U=(d=U)||null!==\nc.memoizedState,Zj(a,b,c),U=d):Zj(a,b,c);break;default:Zj(a,b,c)}}function bk(a){var b=a.updateQueue;if(null!==b){a.updateQueue=null;var c=a.stateNode;null===c&&(c=a.stateNode=new Lj);b.forEach(function(b){var d=ck.bind(null,a,b);c.has(b)||(c.add(b),b.then(d,d))})}}\nfunction dk(a,b){var c=b.deletions;if(null!==c)for(var d=0;d<c.length;d++){var e=c[d];try{var f=a,g=b,h=g;a:for(;null!==h;){switch(h.tag){case 5:X=h.stateNode;Yj=!1;break a;case 3:X=h.stateNode.containerInfo;Yj=!0;break a;case 4:X=h.stateNode.containerInfo;Yj=!0;break a}h=h.return}if(null===X)throw Error(p(160));ak(f,g,e);X=null;Yj=!1;var k=e.alternate;null!==k&&(k.return=null);e.return=null}catch(l){W(e,b,l)}}if(b.subtreeFlags&12854)for(b=b.child;null!==b;)ek(b,a),b=b.sibling}\nfunction ek(a,b){var c=a.alternate,d=a.flags;switch(a.tag){case 0:case 11:case 14:case 15:dk(b,a);fk(a);if(d&4){try{Qj(3,a,a.return),Rj(3,a)}catch(t){W(a,a.return,t)}try{Qj(5,a,a.return)}catch(t){W(a,a.return,t)}}break;case 1:dk(b,a);fk(a);d&512&&null!==c&&Mj(c,c.return);break;case 5:dk(b,a);fk(a);d&512&&null!==c&&Mj(c,c.return);if(a.flags&32){var e=a.stateNode;try{ob(e,\"\")}catch(t){W(a,a.return,t)}}if(d&4&&(e=a.stateNode,null!=e)){var f=a.memoizedProps,g=null!==c?c.memoizedProps:f,h=a.type,k=a.updateQueue;\na.updateQueue=null;if(null!==k)try{\"input\"===h&&\"radio\"===f.type&&null!=f.name&&ab(e,f);vb(h,g);var l=vb(h,f);for(g=0;g<k.length;g+=2){var m=k[g],q=k[g+1];\"style\"===m?sb(e,q):\"dangerouslySetInnerHTML\"===m?nb(e,q):\"children\"===m?ob(e,q):ta(e,m,q,l)}switch(h){case \"input\":bb(e,f);break;case \"textarea\":ib(e,f);break;case \"select\":var r=e._wrapperState.wasMultiple;e._wrapperState.wasMultiple=!!f.multiple;var y=f.value;null!=y?fb(e,!!f.multiple,y,!1):r!==!!f.multiple&&(null!=f.defaultValue?fb(e,!!f.multiple,\nf.defaultValue,!0):fb(e,!!f.multiple,f.multiple?[]:\"\",!1))}e[Pf]=f}catch(t){W(a,a.return,t)}}break;case 6:dk(b,a);fk(a);if(d&4){if(null===a.stateNode)throw Error(p(162));e=a.stateNode;f=a.memoizedProps;try{e.nodeValue=f}catch(t){W(a,a.return,t)}}break;case 3:dk(b,a);fk(a);if(d&4&&null!==c&&c.memoizedState.isDehydrated)try{bd(b.containerInfo)}catch(t){W(a,a.return,t)}break;case 4:dk(b,a);fk(a);break;case 13:dk(b,a);fk(a);e=a.child;e.flags&8192&&(f=null!==e.memoizedState,e.stateNode.isHidden=f,!f||\nnull!==e.alternate&&null!==e.alternate.memoizedState||(gk=B()));d&4&&bk(a);break;case 22:m=null!==c&&null!==c.memoizedState;a.mode&1?(U=(l=U)||m,dk(b,a),U=l):dk(b,a);fk(a);if(d&8192){l=null!==a.memoizedState;if((a.stateNode.isHidden=l)&&!m&&0!==(a.mode&1))for(V=a,m=a.child;null!==m;){for(q=V=m;null!==V;){r=V;y=r.child;switch(r.tag){case 0:case 11:case 14:case 15:Qj(4,r,r.return);break;case 1:Mj(r,r.return);var n=r.stateNode;if(\"function\"===typeof n.componentWillUnmount){d=r;c=r.return;try{b=d,n.props=\nb.memoizedProps,n.state=b.memoizedState,n.componentWillUnmount()}catch(t){W(d,c,t)}}break;case 5:Mj(r,r.return);break;case 22:if(null!==r.memoizedState){hk(q);continue}}null!==y?(y.return=r,V=y):hk(q)}m=m.sibling}a:for(m=null,q=a;;){if(5===q.tag){if(null===m){m=q;try{e=q.stateNode,l?(f=e.style,\"function\"===typeof f.setProperty?f.setProperty(\"display\",\"none\",\"important\"):f.display=\"none\"):(h=q.stateNode,k=q.memoizedProps.style,g=void 0!==k&&null!==k&&k.hasOwnProperty(\"display\")?k.display:null,h.style.display=\nrb(\"display\",g))}catch(t){W(a,a.return,t)}}}else if(6===q.tag){if(null===m)try{q.stateNode.nodeValue=l?\"\":q.memoizedProps}catch(t){W(a,a.return,t)}}else if((22!==q.tag&&23!==q.tag||null===q.memoizedState||q===a)&&null!==q.child){q.child.return=q;q=q.child;continue}if(q===a)break a;for(;null===q.sibling;){if(null===q.return||q.return===a)break a;m===q&&(m=null);q=q.return}m===q&&(m=null);q.sibling.return=q.return;q=q.sibling}}break;case 19:dk(b,a);fk(a);d&4&&bk(a);break;case 21:break;default:dk(b,\na),fk(a)}}function fk(a){var b=a.flags;if(b&2){try{a:{for(var c=a.return;null!==c;){if(Uj(c)){var d=c;break a}c=c.return}throw Error(p(160));}switch(d.tag){case 5:var e=d.stateNode;d.flags&32&&(ob(e,\"\"),d.flags&=-33);var f=Vj(a);Xj(a,f,e);break;case 3:case 4:var g=d.stateNode.containerInfo,h=Vj(a);Wj(a,h,g);break;default:throw Error(p(161));}}catch(k){W(a,a.return,k)}a.flags&=-3}b&4096&&(a.flags&=-4097)}function ik(a,b,c){V=a;jk(a,b,c)}\nfunction jk(a,b,c){for(var d=0!==(a.mode&1);null!==V;){var e=V,f=e.child;if(22===e.tag&&d){var g=null!==e.memoizedState||Kj;if(!g){var h=e.alternate,k=null!==h&&null!==h.memoizedState||U;h=Kj;var l=U;Kj=g;if((U=k)&&!l)for(V=e;null!==V;)g=V,k=g.child,22===g.tag&&null!==g.memoizedState?kk(e):null!==k?(k.return=g,V=k):kk(e);for(;null!==f;)V=f,jk(f,b,c),f=f.sibling;V=e;Kj=h;U=l}lk(a,b,c)}else 0!==(e.subtreeFlags&8772)&&null!==f?(f.return=e,V=f):lk(a,b,c)}}\nfunction lk(a){for(;null!==V;){var b=V;if(0!==(b.flags&8772)){var c=b.alternate;try{if(0!==(b.flags&8772))switch(b.tag){case 0:case 11:case 15:U||Rj(5,b);break;case 1:var d=b.stateNode;if(b.flags&4&&!U)if(null===c)d.componentDidMount();else{var e=b.elementType===b.type?c.memoizedProps:Lg(b.type,c.memoizedProps);d.componentDidUpdate(e,c.memoizedState,d.__reactInternalSnapshotBeforeUpdate)}var f=b.updateQueue;null!==f&&ih(b,f,d);break;case 3:var g=b.updateQueue;if(null!==g){c=null;if(null!==b.child)switch(b.child.tag){case 5:c=\nb.child.stateNode;break;case 1:c=b.child.stateNode}ih(b,g,c)}break;case 5:var h=b.stateNode;if(null===c&&b.flags&4){c=h;var k=b.memoizedProps;switch(b.type){case \"button\":case \"input\":case \"select\":case \"textarea\":k.autoFocus&&c.focus();break;case \"img\":k.src&&(c.src=k.src)}}break;case 6:break;case 4:break;case 12:break;case 13:if(null===b.memoizedState){var l=b.alternate;if(null!==l){var m=l.memoizedState;if(null!==m){var q=m.dehydrated;null!==q&&bd(q)}}}break;case 19:case 17:case 21:case 22:case 23:case 25:break;\ndefault:throw Error(p(163));}U||b.flags&512&&Sj(b)}catch(r){W(b,b.return,r)}}if(b===a){V=null;break}c=b.sibling;if(null!==c){c.return=b.return;V=c;break}V=b.return}}function hk(a){for(;null!==V;){var b=V;if(b===a){V=null;break}var c=b.sibling;if(null!==c){c.return=b.return;V=c;break}V=b.return}}\nfunction kk(a){for(;null!==V;){var b=V;try{switch(b.tag){case 0:case 11:case 15:var c=b.return;try{Rj(4,b)}catch(k){W(b,c,k)}break;case 1:var d=b.stateNode;if(\"function\"===typeof d.componentDidMount){var e=b.return;try{d.componentDidMount()}catch(k){W(b,e,k)}}var f=b.return;try{Sj(b)}catch(k){W(b,f,k)}break;case 5:var g=b.return;try{Sj(b)}catch(k){W(b,g,k)}}}catch(k){W(b,b.return,k)}if(b===a){V=null;break}var h=b.sibling;if(null!==h){h.return=b.return;V=h;break}V=b.return}}\nvar mk=Math.ceil,nk=ua.ReactCurrentDispatcher,ok=ua.ReactCurrentOwner,pk=ua.ReactCurrentBatchConfig,K=0,R=null,Y=null,Z=0,gj=0,fj=Uf(0),T=0,qk=null,hh=0,rk=0,sk=0,tk=null,uk=null,gk=0,Hj=Infinity,vk=null,Pi=!1,Qi=null,Si=null,wk=!1,xk=null,yk=0,zk=0,Ak=null,Bk=-1,Ck=0;function L(){return 0!==(K&6)?B():-1!==Bk?Bk:Bk=B()}\nfunction lh(a){if(0===(a.mode&1))return 1;if(0!==(K&2)&&0!==Z)return Z&-Z;if(null!==Kg.transition)return 0===Ck&&(Ck=yc()),Ck;a=C;if(0!==a)return a;a=window.event;a=void 0===a?16:jd(a.type);return a}function mh(a,b,c,d){if(50<zk)throw zk=0,Ak=null,Error(p(185));Ac(a,c,d);if(0===(K&2)||a!==R)a===R&&(0===(K&2)&&(rk|=c),4===T&&Dk(a,Z)),Ek(a,d),1===c&&0===K&&0===(b.mode&1)&&(Hj=B()+500,fg&&jg())}\nfunction Ek(a,b){var c=a.callbackNode;wc(a,b);var d=uc(a,a===R?Z:0);if(0===d)null!==c&&bc(c),a.callbackNode=null,a.callbackPriority=0;else if(b=d&-d,a.callbackPriority!==b){null!=c&&bc(c);if(1===b)0===a.tag?ig(Fk.bind(null,a)):hg(Fk.bind(null,a)),Jf(function(){0===(K&6)&&jg()}),c=null;else{switch(Dc(d)){case 1:c=fc;break;case 4:c=gc;break;case 16:c=hc;break;case 536870912:c=jc;break;default:c=hc}c=Gk(c,Hk.bind(null,a))}a.callbackPriority=b;a.callbackNode=c}}\nfunction Hk(a,b){Bk=-1;Ck=0;if(0!==(K&6))throw Error(p(327));var c=a.callbackNode;if(Ik()&&a.callbackNode!==c)return null;var d=uc(a,a===R?Z:0);if(0===d)return null;if(0!==(d&30)||0!==(d&a.expiredLanes)||b)b=Jk(a,d);else{b=d;var e=K;K|=2;var f=Kk();if(R!==a||Z!==b)vk=null,Hj=B()+500,Lk(a,b);do try{Mk();break}catch(h){Nk(a,h)}while(1);Qg();nk.current=f;K=e;null!==Y?b=0:(R=null,Z=0,b=T)}if(0!==b){2===b&&(e=xc(a),0!==e&&(d=e,b=Ok(a,e)));if(1===b)throw c=qk,Lk(a,0),Dk(a,d),Ek(a,B()),c;if(6===b)Dk(a,d);\nelse{e=a.current.alternate;if(0===(d&30)&&!Pk(e)&&(b=Jk(a,d),2===b&&(f=xc(a),0!==f&&(d=f,b=Ok(a,f))),1===b))throw c=qk,Lk(a,0),Dk(a,d),Ek(a,B()),c;a.finishedWork=e;a.finishedLanes=d;switch(b){case 0:case 1:throw Error(p(345));case 2:Qk(a,uk,vk);break;case 3:Dk(a,d);if((d&130023424)===d&&(b=gk+500-B(),10<b)){if(0!==uc(a,0))break;e=a.suspendedLanes;if((e&d)!==d){L();a.pingedLanes|=a.suspendedLanes&e;break}a.timeoutHandle=Ff(Qk.bind(null,a,uk,vk),b);break}Qk(a,uk,vk);break;case 4:Dk(a,d);if((d&4194240)===\nd)break;b=a.eventTimes;for(e=-1;0<d;){var g=31-oc(d);f=1<<g;g=b[g];g>e&&(e=g);d&=~f}d=e;d=B()-d;d=(120>d?120:480>d?480:1080>d?1080:1920>d?1920:3E3>d?3E3:4320>d?4320:1960*mk(d/1960))-d;if(10<d){a.timeoutHandle=Ff(Qk.bind(null,a,uk,vk),d);break}Qk(a,uk,vk);break;case 5:Qk(a,uk,vk);break;default:throw Error(p(329));}}}Ek(a,B());return a.callbackNode===c?Hk.bind(null,a):null}\nfunction Ok(a,b){var c=tk;a.current.memoizedState.isDehydrated&&(Lk(a,b).flags|=256);a=Jk(a,b);2!==a&&(b=uk,uk=c,null!==b&&Gj(b));return a}function Gj(a){null===uk?uk=a:uk.push.apply(uk,a)}\nfunction Pk(a){for(var b=a;;){if(b.flags&16384){var c=b.updateQueue;if(null!==c&&(c=c.stores,null!==c))for(var d=0;d<c.length;d++){var e=c[d],f=e.getSnapshot;e=e.value;try{if(!He(f(),e))return!1}catch(g){return!1}}}c=b.child;if(b.subtreeFlags&16384&&null!==c)c.return=b,b=c;else{if(b===a)break;for(;null===b.sibling;){if(null===b.return||b.return===a)return!0;b=b.return}b.sibling.return=b.return;b=b.sibling}}return!0}\nfunction Dk(a,b){b&=~sk;b&=~rk;a.suspendedLanes|=b;a.pingedLanes&=~b;for(a=a.expirationTimes;0<b;){var c=31-oc(b),d=1<<c;a[c]=-1;b&=~d}}function Fk(a){if(0!==(K&6))throw Error(p(327));Ik();var b=uc(a,0);if(0===(b&1))return Ek(a,B()),null;var c=Jk(a,b);if(0!==a.tag&&2===c){var d=xc(a);0!==d&&(b=d,c=Ok(a,d))}if(1===c)throw c=qk,Lk(a,0),Dk(a,b),Ek(a,B()),c;if(6===c)throw Error(p(345));a.finishedWork=a.current.alternate;a.finishedLanes=b;Qk(a,uk,vk);Ek(a,B());return null}\nfunction Rk(a,b){var c=K;K|=1;try{return a(b)}finally{K=c,0===K&&(Hj=B()+500,fg&&jg())}}function Sk(a){null!==xk&&0===xk.tag&&0===(K&6)&&Ik();var b=K;K|=1;var c=pk.transition,d=C;try{if(pk.transition=null,C=1,a)return a()}finally{C=d,pk.transition=c,K=b,0===(K&6)&&jg()}}function Ij(){gj=fj.current;E(fj)}\nfunction Lk(a,b){a.finishedWork=null;a.finishedLanes=0;var c=a.timeoutHandle;-1!==c&&(a.timeoutHandle=-1,Gf(c));if(null!==Y)for(c=Y.return;null!==c;){var d=c;wg(d);switch(d.tag){case 1:d=d.type.childContextTypes;null!==d&&void 0!==d&&$f();break;case 3:Jh();E(Wf);E(H);Oh();break;case 5:Lh(d);break;case 4:Jh();break;case 13:E(M);break;case 19:E(M);break;case 10:Rg(d.type._context);break;case 22:case 23:Ij()}c=c.return}R=a;Y=a=wh(a.current,null);Z=gj=b;T=0;qk=null;sk=rk=hh=0;uk=tk=null;if(null!==Wg){for(b=\n0;b<Wg.length;b++)if(c=Wg[b],d=c.interleaved,null!==d){c.interleaved=null;var e=d.next,f=c.pending;if(null!==f){var g=f.next;f.next=e;d.next=g}c.pending=d}Wg=null}return a}\nfunction Nk(a,b){do{var c=Y;try{Qg();Ph.current=ai;if(Sh){for(var d=N.memoizedState;null!==d;){var e=d.queue;null!==e&&(e.pending=null);d=d.next}Sh=!1}Rh=0;P=O=N=null;Th=!1;Uh=0;ok.current=null;if(null===c||null===c.return){T=1;qk=b;Y=null;break}a:{var f=a,g=c.return,h=c,k=b;b=Z;h.flags|=32768;if(null!==k&&\"object\"===typeof k&&\"function\"===typeof k.then){var l=k,m=h,q=m.tag;if(0===(m.mode&1)&&(0===q||11===q||15===q)){var r=m.alternate;r?(m.updateQueue=r.updateQueue,m.memoizedState=r.memoizedState,\nm.lanes=r.lanes):(m.updateQueue=null,m.memoizedState=null)}var y=Vi(g);if(null!==y){y.flags&=-257;Wi(y,g,h,f,b);y.mode&1&&Ti(f,l,b);b=y;k=l;var n=b.updateQueue;if(null===n){var t=new Set;t.add(k);b.updateQueue=t}else n.add(k);break a}else{if(0===(b&1)){Ti(f,l,b);uj();break a}k=Error(p(426))}}else if(I&&h.mode&1){var J=Vi(g);if(null!==J){0===(J.flags&65536)&&(J.flags|=256);Wi(J,g,h,f,b);Jg(Ki(k,h));break a}}f=k=Ki(k,h);4!==T&&(T=2);null===tk?tk=[f]:tk.push(f);f=g;do{switch(f.tag){case 3:f.flags|=65536;\nb&=-b;f.lanes|=b;var x=Oi(f,k,b);fh(f,x);break a;case 1:h=k;var w=f.type,u=f.stateNode;if(0===(f.flags&128)&&(\"function\"===typeof w.getDerivedStateFromError||null!==u&&\"function\"===typeof u.componentDidCatch&&(null===Si||!Si.has(u)))){f.flags|=65536;b&=-b;f.lanes|=b;var F=Ri(f,h,b);fh(f,F);break a}}f=f.return}while(null!==f)}Tk(c)}catch(na){b=na;Y===c&&null!==c&&(Y=c=c.return);continue}break}while(1)}function Kk(){var a=nk.current;nk.current=ai;return null===a?ai:a}\nfunction uj(){if(0===T||3===T||2===T)T=4;null===R||0===(hh&268435455)&&0===(rk&268435455)||Dk(R,Z)}function Jk(a,b){var c=K;K|=2;var d=Kk();if(R!==a||Z!==b)vk=null,Lk(a,b);do try{Uk();break}catch(e){Nk(a,e)}while(1);Qg();K=c;nk.current=d;if(null!==Y)throw Error(p(261));R=null;Z=0;return T}function Uk(){for(;null!==Y;)Vk(Y)}function Mk(){for(;null!==Y&&!cc();)Vk(Y)}function Vk(a){var b=Wk(a.alternate,a,gj);a.memoizedProps=a.pendingProps;null===b?Tk(a):Y=b;ok.current=null}\nfunction Tk(a){var b=a;do{var c=b.alternate;a=b.return;if(0===(b.flags&32768)){if(c=Fj(c,b,gj),null!==c){Y=c;return}}else{c=Jj(c,b);if(null!==c){c.flags&=32767;Y=c;return}if(null!==a)a.flags|=32768,a.subtreeFlags=0,a.deletions=null;else{T=6;Y=null;return}}b=b.sibling;if(null!==b){Y=b;return}Y=b=a}while(null!==b);0===T&&(T=5)}function Qk(a,b,c){var d=C,e=pk.transition;try{pk.transition=null,C=1,Xk(a,b,c,d)}finally{pk.transition=e,C=d}return null}\nfunction Xk(a,b,c,d){do Ik();while(null!==xk);if(0!==(K&6))throw Error(p(327));c=a.finishedWork;var e=a.finishedLanes;if(null===c)return null;a.finishedWork=null;a.finishedLanes=0;if(c===a.current)throw Error(p(177));a.callbackNode=null;a.callbackPriority=0;var f=c.lanes|c.childLanes;Bc(a,f);a===R&&(Y=R=null,Z=0);0===(c.subtreeFlags&2064)&&0===(c.flags&2064)||wk||(wk=!0,Gk(hc,function(){Ik();return null}));f=0!==(c.flags&15990);if(0!==(c.subtreeFlags&15990)||f){f=pk.transition;pk.transition=null;\nvar g=C;C=1;var h=K;K|=4;ok.current=null;Pj(a,c);ek(c,a);Oe(Df);dd=!!Cf;Df=Cf=null;a.current=c;ik(c,a,e);dc();K=h;C=g;pk.transition=f}else a.current=c;wk&&(wk=!1,xk=a,yk=e);f=a.pendingLanes;0===f&&(Si=null);mc(c.stateNode,d);Ek(a,B());if(null!==b)for(d=a.onRecoverableError,c=0;c<b.length;c++)e=b[c],d(e.value,{componentStack:e.stack,digest:e.digest});if(Pi)throw Pi=!1,a=Qi,Qi=null,a;0!==(yk&1)&&0!==a.tag&&Ik();f=a.pendingLanes;0!==(f&1)?a===Ak?zk++:(zk=0,Ak=a):zk=0;jg();return null}\nfunction Ik(){if(null!==xk){var a=Dc(yk),b=pk.transition,c=C;try{pk.transition=null;C=16>a?16:a;if(null===xk)var d=!1;else{a=xk;xk=null;yk=0;if(0!==(K&6))throw Error(p(331));var e=K;K|=4;for(V=a.current;null!==V;){var f=V,g=f.child;if(0!==(V.flags&16)){var h=f.deletions;if(null!==h){for(var k=0;k<h.length;k++){var l=h[k];for(V=l;null!==V;){var m=V;switch(m.tag){case 0:case 11:case 15:Qj(8,m,f)}var q=m.child;if(null!==q)q.return=m,V=q;else for(;null!==V;){m=V;var r=m.sibling,y=m.return;Tj(m);if(m===\nl){V=null;break}if(null!==r){r.return=y;V=r;break}V=y}}}var n=f.alternate;if(null!==n){var t=n.child;if(null!==t){n.child=null;do{var J=t.sibling;t.sibling=null;t=J}while(null!==t)}}V=f}}if(0!==(f.subtreeFlags&2064)&&null!==g)g.return=f,V=g;else b:for(;null!==V;){f=V;if(0!==(f.flags&2048))switch(f.tag){case 0:case 11:case 15:Qj(9,f,f.return)}var x=f.sibling;if(null!==x){x.return=f.return;V=x;break b}V=f.return}}var w=a.current;for(V=w;null!==V;){g=V;var u=g.child;if(0!==(g.subtreeFlags&2064)&&null!==\nu)u.return=g,V=u;else b:for(g=w;null!==V;){h=V;if(0!==(h.flags&2048))try{switch(h.tag){case 0:case 11:case 15:Rj(9,h)}}catch(na){W(h,h.return,na)}if(h===g){V=null;break b}var F=h.sibling;if(null!==F){F.return=h.return;V=F;break b}V=h.return}}K=e;jg();if(lc&&\"function\"===typeof lc.onPostCommitFiberRoot)try{lc.onPostCommitFiberRoot(kc,a)}catch(na){}d=!0}return d}finally{C=c,pk.transition=b}}return!1}function Yk(a,b,c){b=Ki(c,b);b=Oi(a,b,1);a=dh(a,b,1);b=L();null!==a&&(Ac(a,1,b),Ek(a,b))}\nfunction W(a,b,c){if(3===a.tag)Yk(a,a,c);else for(;null!==b;){if(3===b.tag){Yk(b,a,c);break}else if(1===b.tag){var d=b.stateNode;if(\"function\"===typeof b.type.getDerivedStateFromError||\"function\"===typeof d.componentDidCatch&&(null===Si||!Si.has(d))){a=Ki(c,a);a=Ri(b,a,1);b=dh(b,a,1);a=L();null!==b&&(Ac(b,1,a),Ek(b,a));break}}b=b.return}}\nfunction Ui(a,b,c){var d=a.pingCache;null!==d&&d.delete(b);b=L();a.pingedLanes|=a.suspendedLanes&c;R===a&&(Z&c)===c&&(4===T||3===T&&(Z&130023424)===Z&&500>B()-gk?Lk(a,0):sk|=c);Ek(a,b)}function Zk(a,b){0===b&&(0===(a.mode&1)?b=1:(b=sc,sc<<=1,0===(sc&130023424)&&(sc=4194304)));var c=L();a=Zg(a,b);null!==a&&(Ac(a,b,c),Ek(a,c))}function vj(a){var b=a.memoizedState,c=0;null!==b&&(c=b.retryLane);Zk(a,c)}\nfunction ck(a,b){var c=0;switch(a.tag){case 13:var d=a.stateNode;var e=a.memoizedState;null!==e&&(c=e.retryLane);break;case 19:d=a.stateNode;break;default:throw Error(p(314));}null!==d&&d.delete(b);Zk(a,c)}var Wk;\nWk=function(a,b,c){if(null!==a)if(a.memoizedProps!==b.pendingProps||Wf.current)Ug=!0;else{if(0===(a.lanes&c)&&0===(b.flags&128))return Ug=!1,zj(a,b,c);Ug=0!==(a.flags&131072)?!0:!1}else Ug=!1,I&&0!==(b.flags&1048576)&&ug(b,ng,b.index);b.lanes=0;switch(b.tag){case 2:var d=b.type;jj(a,b);a=b.pendingProps;var e=Yf(b,H.current);Tg(b,c);e=Xh(null,b,d,a,e,c);var f=bi();b.flags|=1;\"object\"===typeof e&&null!==e&&\"function\"===typeof e.render&&void 0===e.$$typeof?(b.tag=1,b.memoizedState=null,b.updateQueue=\nnull,Zf(d)?(f=!0,cg(b)):f=!1,b.memoizedState=null!==e.state&&void 0!==e.state?e.state:null,ah(b),e.updater=nh,b.stateNode=e,e._reactInternals=b,rh(b,d,a,c),b=kj(null,b,d,!0,f,c)):(b.tag=0,I&&f&&vg(b),Yi(null,b,e,c),b=b.child);return b;case 16:d=b.elementType;a:{jj(a,b);a=b.pendingProps;e=d._init;d=e(d._payload);b.type=d;e=b.tag=$k(d);a=Lg(d,a);switch(e){case 0:b=dj(null,b,d,a,c);break a;case 1:b=ij(null,b,d,a,c);break a;case 11:b=Zi(null,b,d,a,c);break a;case 14:b=aj(null,b,d,Lg(d.type,a),c);break a}throw Error(p(306,\nd,\"\"));}return b;case 0:return d=b.type,e=b.pendingProps,e=b.elementType===d?e:Lg(d,e),dj(a,b,d,e,c);case 1:return d=b.type,e=b.pendingProps,e=b.elementType===d?e:Lg(d,e),ij(a,b,d,e,c);case 3:a:{lj(b);if(null===a)throw Error(p(387));d=b.pendingProps;f=b.memoizedState;e=f.element;bh(a,b);gh(b,d,null,c);var g=b.memoizedState;d=g.element;if(f.isDehydrated)if(f={element:d,isDehydrated:!1,cache:g.cache,pendingSuspenseBoundaries:g.pendingSuspenseBoundaries,transitions:g.transitions},b.updateQueue.baseState=\nf,b.memoizedState=f,b.flags&256){e=Ki(Error(p(423)),b);b=mj(a,b,d,c,e);break a}else if(d!==e){e=Ki(Error(p(424)),b);b=mj(a,b,d,c,e);break a}else for(yg=Lf(b.stateNode.containerInfo.firstChild),xg=b,I=!0,zg=null,c=Ch(b,null,d,c),b.child=c;c;)c.flags=c.flags&-3|4096,c=c.sibling;else{Ig();if(d===e){b=$i(a,b,c);break a}Yi(a,b,d,c)}b=b.child}return b;case 5:return Kh(b),null===a&&Eg(b),d=b.type,e=b.pendingProps,f=null!==a?a.memoizedProps:null,g=e.children,Ef(d,e)?g=null:null!==f&&Ef(d,f)&&(b.flags|=32),\nhj(a,b),Yi(a,b,g,c),b.child;case 6:return null===a&&Eg(b),null;case 13:return pj(a,b,c);case 4:return Ih(b,b.stateNode.containerInfo),d=b.pendingProps,null===a?b.child=Bh(b,null,d,c):Yi(a,b,d,c),b.child;case 11:return d=b.type,e=b.pendingProps,e=b.elementType===d?e:Lg(d,e),Zi(a,b,d,e,c);case 7:return Yi(a,b,b.pendingProps,c),b.child;case 8:return Yi(a,b,b.pendingProps.children,c),b.child;case 12:return Yi(a,b,b.pendingProps.children,c),b.child;case 10:a:{d=b.type._context;e=b.pendingProps;f=b.memoizedProps;\ng=e.value;G(Mg,d._currentValue);d._currentValue=g;if(null!==f)if(He(f.value,g)){if(f.children===e.children&&!Wf.current){b=$i(a,b,c);break a}}else for(f=b.child,null!==f&&(f.return=b);null!==f;){var h=f.dependencies;if(null!==h){g=f.child;for(var k=h.firstContext;null!==k;){if(k.context===d){if(1===f.tag){k=ch(-1,c&-c);k.tag=2;var l=f.updateQueue;if(null!==l){l=l.shared;var m=l.pending;null===m?k.next=k:(k.next=m.next,m.next=k);l.pending=k}}f.lanes|=c;k=f.alternate;null!==k&&(k.lanes|=c);Sg(f.return,\nc,b);h.lanes|=c;break}k=k.next}}else if(10===f.tag)g=f.type===b.type?null:f.child;else if(18===f.tag){g=f.return;if(null===g)throw Error(p(341));g.lanes|=c;h=g.alternate;null!==h&&(h.lanes|=c);Sg(g,c,b);g=f.sibling}else g=f.child;if(null!==g)g.return=f;else for(g=f;null!==g;){if(g===b){g=null;break}f=g.sibling;if(null!==f){f.return=g.return;g=f;break}g=g.return}f=g}Yi(a,b,e.children,c);b=b.child}return b;case 9:return e=b.type,d=b.pendingProps.children,Tg(b,c),e=Vg(e),d=d(e),b.flags|=1,Yi(a,b,d,c),\nb.child;case 14:return d=b.type,e=Lg(d,b.pendingProps),e=Lg(d.type,e),aj(a,b,d,e,c);case 15:return cj(a,b,b.type,b.pendingProps,c);case 17:return d=b.type,e=b.pendingProps,e=b.elementType===d?e:Lg(d,e),jj(a,b),b.tag=1,Zf(d)?(a=!0,cg(b)):a=!1,Tg(b,c),ph(b,d,e),rh(b,d,e,c),kj(null,b,d,!0,a,c);case 19:return yj(a,b,c);case 22:return ej(a,b,c)}throw Error(p(156,b.tag));};function Gk(a,b){return ac(a,b)}\nfunction al(a,b,c,d){this.tag=a;this.key=c;this.sibling=this.child=this.return=this.stateNode=this.type=this.elementType=null;this.index=0;this.ref=null;this.pendingProps=b;this.dependencies=this.memoizedState=this.updateQueue=this.memoizedProps=null;this.mode=d;this.subtreeFlags=this.flags=0;this.deletions=null;this.childLanes=this.lanes=0;this.alternate=null}function Bg(a,b,c,d){return new al(a,b,c,d)}function bj(a){a=a.prototype;return!(!a||!a.isReactComponent)}\nfunction $k(a){if(\"function\"===typeof a)return bj(a)?1:0;if(void 0!==a&&null!==a){a=a.$$typeof;if(a===Da)return 11;if(a===Ga)return 14}return 2}\nfunction wh(a,b){var c=a.alternate;null===c?(c=Bg(a.tag,b,a.key,a.mode),c.elementType=a.elementType,c.type=a.type,c.stateNode=a.stateNode,c.alternate=a,a.alternate=c):(c.pendingProps=b,c.type=a.type,c.flags=0,c.subtreeFlags=0,c.deletions=null);c.flags=a.flags&14680064;c.childLanes=a.childLanes;c.lanes=a.lanes;c.child=a.child;c.memoizedProps=a.memoizedProps;c.memoizedState=a.memoizedState;c.updateQueue=a.updateQueue;b=a.dependencies;c.dependencies=null===b?null:{lanes:b.lanes,firstContext:b.firstContext};\nc.sibling=a.sibling;c.index=a.index;c.ref=a.ref;return c}\nfunction yh(a,b,c,d,e,f){var g=2;d=a;if(\"function\"===typeof a)bj(a)&&(g=1);else if(\"string\"===typeof a)g=5;else a:switch(a){case ya:return Ah(c.children,e,f,b);case za:g=8;e|=8;break;case Aa:return a=Bg(12,c,b,e|2),a.elementType=Aa,a.lanes=f,a;case Ea:return a=Bg(13,c,b,e),a.elementType=Ea,a.lanes=f,a;case Fa:return a=Bg(19,c,b,e),a.elementType=Fa,a.lanes=f,a;case Ia:return qj(c,e,f,b);default:if(\"object\"===typeof a&&null!==a)switch(a.$$typeof){case Ba:g=10;break a;case Ca:g=9;break a;case Da:g=11;\nbreak a;case Ga:g=14;break a;case Ha:g=16;d=null;break a}throw Error(p(130,null==a?a:typeof a,\"\"));}b=Bg(g,c,b,e);b.elementType=a;b.type=d;b.lanes=f;return b}function Ah(a,b,c,d){a=Bg(7,a,d,b);a.lanes=c;return a}function qj(a,b,c,d){a=Bg(22,a,d,b);a.elementType=Ia;a.lanes=c;a.stateNode={isHidden:!1};return a}function xh(a,b,c){a=Bg(6,a,null,b);a.lanes=c;return a}\nfunction zh(a,b,c){b=Bg(4,null!==a.children?a.children:[],a.key,b);b.lanes=c;b.stateNode={containerInfo:a.containerInfo,pendingChildren:null,implementation:a.implementation};return b}\nfunction bl(a,b,c,d,e){this.tag=b;this.containerInfo=a;this.finishedWork=this.pingCache=this.current=this.pendingChildren=null;this.timeoutHandle=-1;this.callbackNode=this.pendingContext=this.context=null;this.callbackPriority=0;this.eventTimes=zc(0);this.expirationTimes=zc(-1);this.entangledLanes=this.finishedLanes=this.mutableReadLanes=this.expiredLanes=this.pingedLanes=this.suspendedLanes=this.pendingLanes=0;this.entanglements=zc(0);this.identifierPrefix=d;this.onRecoverableError=e;this.mutableSourceEagerHydrationData=\nnull}function cl(a,b,c,d,e,f,g,h,k){a=new bl(a,b,c,h,k);1===b?(b=1,!0===f&&(b|=8)):b=0;f=Bg(3,null,null,b);a.current=f;f.stateNode=a;f.memoizedState={element:d,isDehydrated:c,cache:null,transitions:null,pendingSuspenseBoundaries:null};ah(f);return a}function dl(a,b,c){var d=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return{$$typeof:wa,key:null==d?null:\"\"+d,children:a,containerInfo:b,implementation:c}}\nfunction el(a){if(!a)return Vf;a=a._reactInternals;a:{if(Vb(a)!==a||1!==a.tag)throw Error(p(170));var b=a;do{switch(b.tag){case 3:b=b.stateNode.context;break a;case 1:if(Zf(b.type)){b=b.stateNode.__reactInternalMemoizedMergedChildContext;break a}}b=b.return}while(null!==b);throw Error(p(171));}if(1===a.tag){var c=a.type;if(Zf(c))return bg(a,c,b)}return b}\nfunction fl(a,b,c,d,e,f,g,h,k){a=cl(c,d,!0,a,e,f,g,h,k);a.context=el(null);c=a.current;d=L();e=lh(c);f=ch(d,e);f.callback=void 0!==b&&null!==b?b:null;dh(c,f,e);a.current.lanes=e;Ac(a,e,d);Ek(a,d);return a}function gl(a,b,c,d){var e=b.current,f=L(),g=lh(e);c=el(c);null===b.context?b.context=c:b.pendingContext=c;b=ch(f,g);b.payload={element:a};d=void 0===d?null:d;null!==d&&(b.callback=d);a=dh(e,b,g);null!==a&&(mh(a,e,g,f),eh(a,e,g));return g}\nfunction hl(a){a=a.current;if(!a.child)return null;switch(a.child.tag){case 5:return a.child.stateNode;default:return a.child.stateNode}}function il(a,b){a=a.memoizedState;if(null!==a&&null!==a.dehydrated){var c=a.retryLane;a.retryLane=0!==c&&c<b?c:b}}function jl(a,b){il(a,b);(a=a.alternate)&&il(a,b)}function kl(){return null}var ll=\"function\"===typeof reportError?reportError:function(a){console.error(a)};function ml(a){this._internalRoot=a}\nnl.prototype.render=ml.prototype.render=function(a){var b=this._internalRoot;if(null===b)throw Error(p(409));gl(a,b,null,null)};nl.prototype.unmount=ml.prototype.unmount=function(){var a=this._internalRoot;if(null!==a){this._internalRoot=null;var b=a.containerInfo;Sk(function(){gl(null,a,null,null)});b[uf]=null}};function nl(a){this._internalRoot=a}\nnl.prototype.unstable_scheduleHydration=function(a){if(a){var b=Hc();a={blockedOn:null,target:a,priority:b};for(var c=0;c<Qc.length&&0!==b&&b<Qc[c].priority;c++);Qc.splice(c,0,a);0===c&&Vc(a)}};function ol(a){return!(!a||1!==a.nodeType&&9!==a.nodeType&&11!==a.nodeType)}function pl(a){return!(!a||1!==a.nodeType&&9!==a.nodeType&&11!==a.nodeType&&(8!==a.nodeType||\" react-mount-point-unstable \"!==a.nodeValue))}function ql(){}\nfunction rl(a,b,c,d,e){if(e){if(\"function\"===typeof d){var f=d;d=function(){var a=hl(g);f.call(a)}}var g=fl(b,d,a,0,null,!1,!1,\"\",ql);a._reactRootContainer=g;a[uf]=g.current;sf(8===a.nodeType?a.parentNode:a);Sk();return g}for(;e=a.lastChild;)a.removeChild(e);if(\"function\"===typeof d){var h=d;d=function(){var a=hl(k);h.call(a)}}var k=cl(a,0,!1,null,null,!1,!1,\"\",ql);a._reactRootContainer=k;a[uf]=k.current;sf(8===a.nodeType?a.parentNode:a);Sk(function(){gl(b,k,c,d)});return k}\nfunction sl(a,b,c,d,e){var f=c._reactRootContainer;if(f){var g=f;if(\"function\"===typeof e){var h=e;e=function(){var a=hl(g);h.call(a)}}gl(b,g,a,e)}else g=rl(c,b,a,e,d);return hl(g)}Ec=function(a){switch(a.tag){case 3:var b=a.stateNode;if(b.current.memoizedState.isDehydrated){var c=tc(b.pendingLanes);0!==c&&(Cc(b,c|1),Ek(b,B()),0===(K&6)&&(Hj=B()+500,jg()))}break;case 13:Sk(function(){var b=Zg(a,1);if(null!==b){var c=L();mh(b,a,1,c)}}),jl(a,1)}};\nFc=function(a){if(13===a.tag){var b=Zg(a,134217728);if(null!==b){var c=L();mh(b,a,134217728,c)}jl(a,134217728)}};Gc=function(a){if(13===a.tag){var b=lh(a),c=Zg(a,b);if(null!==c){var d=L();mh(c,a,b,d)}jl(a,b)}};Hc=function(){return C};Ic=function(a,b){var c=C;try{return C=a,b()}finally{C=c}};\nyb=function(a,b,c){switch(b){case \"input\":bb(a,c);b=c.name;if(\"radio\"===c.type&&null!=b){for(c=a;c.parentNode;)c=c.parentNode;c=c.querySelectorAll(\"input[name=\"+JSON.stringify(\"\"+b)+'][type=\"radio\"]');for(b=0;b<c.length;b++){var d=c[b];if(d!==a&&d.form===a.form){var e=Db(d);if(!e)throw Error(p(90));Wa(d);bb(d,e)}}}break;case \"textarea\":ib(a,c);break;case \"select\":b=c.value,null!=b&&fb(a,!!c.multiple,b,!1)}};Gb=Rk;Hb=Sk;\nvar tl={usingClientEntryPoint:!1,Events:[Cb,ue,Db,Eb,Fb,Rk]},ul={findFiberByHostInstance:Wc,bundleType:0,version:\"18.2.0\",rendererPackageName:\"react-dom\"};\nvar vl={bundleType:ul.bundleType,version:ul.version,rendererPackageName:ul.rendererPackageName,rendererConfig:ul.rendererConfig,overrideHookState:null,overrideHookStateDeletePath:null,overrideHookStateRenamePath:null,overrideProps:null,overridePropsDeletePath:null,overridePropsRenamePath:null,setErrorHandler:null,setSuspenseHandler:null,scheduleUpdate:null,currentDispatcherRef:ua.ReactCurrentDispatcher,findHostInstanceByFiber:function(a){a=Zb(a);return null===a?null:a.stateNode},findFiberByHostInstance:ul.findFiberByHostInstance||\nkl,findHostInstancesForRefresh:null,scheduleRefresh:null,scheduleRoot:null,setRefreshHandler:null,getCurrentFiber:null,reconcilerVersion:\"18.2.0-next-9e3b772b8-20220608\"};if(\"undefined\"!==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__){var wl=__REACT_DEVTOOLS_GLOBAL_HOOK__;if(!wl.isDisabled&&wl.supportsFiber)try{kc=wl.inject(vl),lc=wl}catch(a){}}exports.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=tl;\nexports.createPortal=function(a,b){var c=2<arguments.length&&void 0!==arguments[2]?arguments[2]:null;if(!ol(b))throw Error(p(200));return dl(a,b,null,c)};exports.createRoot=function(a,b){if(!ol(a))throw Error(p(299));var c=!1,d=\"\",e=ll;null!==b&&void 0!==b&&(!0===b.unstable_strictMode&&(c=!0),void 0!==b.identifierPrefix&&(d=b.identifierPrefix),void 0!==b.onRecoverableError&&(e=b.onRecoverableError));b=cl(a,1,!1,null,null,c,!1,d,e);a[uf]=b.current;sf(8===a.nodeType?a.parentNode:a);return new ml(b)};\nexports.findDOMNode=function(a){if(null==a)return null;if(1===a.nodeType)return a;var b=a._reactInternals;if(void 0===b){if(\"function\"===typeof a.render)throw Error(p(188));a=Object.keys(a).join(\",\");throw Error(p(268,a));}a=Zb(b);a=null===a?null:a.stateNode;return a};exports.flushSync=function(a){return Sk(a)};exports.hydrate=function(a,b,c){if(!pl(b))throw Error(p(200));return sl(null,a,b,!0,c)};\nexports.hydrateRoot=function(a,b,c){if(!ol(a))throw Error(p(405));var d=null!=c&&c.hydratedSources||null,e=!1,f=\"\",g=ll;null!==c&&void 0!==c&&(!0===c.unstable_strictMode&&(e=!0),void 0!==c.identifierPrefix&&(f=c.identifierPrefix),void 0!==c.onRecoverableError&&(g=c.onRecoverableError));b=fl(b,null,a,1,null!=c?c:null,e,!1,f,g);a[uf]=b.current;sf(a);if(d)for(a=0;a<d.length;a++)c=d[a],e=c._getVersion,e=e(c._source),null==b.mutableSourceEagerHydrationData?b.mutableSourceEagerHydrationData=[c,e]:b.mutableSourceEagerHydrationData.push(c,\ne);return new nl(b)};exports.render=function(a,b,c){if(!pl(b))throw Error(p(200));return sl(null,a,b,!1,c)};exports.unmountComponentAtNode=function(a){if(!pl(a))throw Error(p(40));return a._reactRootContainer?(Sk(function(){sl(null,null,a,!1,function(){a._reactRootContainer=null;a[uf]=null})}),!0):!1};exports.unstable_batchedUpdates=Rk;\nexports.unstable_renderSubtreeIntoContainer=function(a,b,c,d){if(!pl(c))throw Error(p(200));if(null==a||void 0===a._reactInternals)throw Error(p(38));return sl(a,b,c,!1,d)};exports.version=\"18.2.0-next-9e3b772b8-20220608\";\n","'use strict';\n\nvar m = require('react-dom');\nif (process.env.NODE_ENV === 'production') {\n  exports.createRoot = m.createRoot;\n  exports.hydrateRoot = m.hydrateRoot;\n} else {\n  var i = m.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;\n  exports.createRoot = function(c, o) {\n    i.usingClientEntryPoint = true;\n    try {\n      return m.createRoot(c, o);\n    } finally {\n      i.usingClientEntryPoint = false;\n    }\n  };\n  exports.hydrateRoot = function(c, h, o) {\n    i.usingClientEntryPoint = true;\n    try {\n      return m.hydrateRoot(c, h, o);\n    } finally {\n      i.usingClientEntryPoint = false;\n    }\n  };\n}\n","'use strict';\n\nfunction checkDCE() {\n  /* global __REACT_DEVTOOLS_GLOBAL_HOOK__ */\n  if (\n    typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ === 'undefined' ||\n    typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE !== 'function'\n  ) {\n    return;\n  }\n  if (process.env.NODE_ENV !== 'production') {\n    // This branch is unreachable because this function is only called\n    // in production, but the condition is true only in development.\n    // Therefore if the branch is still here, dead code elimination wasn't\n    // properly applied.\n    // Don't change the message. React DevTools relies on it. Also make sure\n    // this message doesn't occur elsewhere in this function, or it will cause\n    // a false positive.\n    throw new Error('^_^');\n  }\n  try {\n    // Verify that the code above has been dead code eliminated (DCE'd).\n    __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(checkDCE);\n  } catch (err) {\n    // DevTools shouldn't crash React, no matter what.\n    // We should still report in case we break this code.\n    console.error(err);\n  }\n}\n\nif (process.env.NODE_ENV === 'production') {\n  // DCE check should happen before ReactDOM bundle executes so that\n  // DevTools can report bad minification during injection.\n  checkDCE();\n  module.exports = require('./cjs/react-dom.production.min.js');\n} else {\n  module.exports = require('./cjs/react-dom.development.js');\n}\n","/**\n * @license React\n * react-is.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n'use strict';var b=Symbol.for(\"react.element\"),c=Symbol.for(\"react.portal\"),d=Symbol.for(\"react.fragment\"),e=Symbol.for(\"react.strict_mode\"),f=Symbol.for(\"react.profiler\"),g=Symbol.for(\"react.provider\"),h=Symbol.for(\"react.context\"),k=Symbol.for(\"react.server_context\"),l=Symbol.for(\"react.forward_ref\"),m=Symbol.for(\"react.suspense\"),n=Symbol.for(\"react.suspense_list\"),p=Symbol.for(\"react.memo\"),q=Symbol.for(\"react.lazy\"),t=Symbol.for(\"react.offscreen\"),u;u=Symbol.for(\"react.module.reference\");\nfunction v(a){if(\"object\"===typeof a&&null!==a){var r=a.$$typeof;switch(r){case b:switch(a=a.type,a){case d:case f:case e:case m:case n:return a;default:switch(a=a&&a.$$typeof,a){case k:case h:case l:case q:case p:case g:return a;default:return r}}case c:return r}}}exports.ContextConsumer=h;exports.ContextProvider=g;exports.Element=b;exports.ForwardRef=l;exports.Fragment=d;exports.Lazy=q;exports.Memo=p;exports.Portal=c;exports.Profiler=f;exports.StrictMode=e;exports.Suspense=m;\nexports.SuspenseList=n;exports.isAsyncMode=function(){return!1};exports.isConcurrentMode=function(){return!1};exports.isContextConsumer=function(a){return v(a)===h};exports.isContextProvider=function(a){return v(a)===g};exports.isElement=function(a){return\"object\"===typeof a&&null!==a&&a.$$typeof===b};exports.isForwardRef=function(a){return v(a)===l};exports.isFragment=function(a){return v(a)===d};exports.isLazy=function(a){return v(a)===q};exports.isMemo=function(a){return v(a)===p};\nexports.isPortal=function(a){return v(a)===c};exports.isProfiler=function(a){return v(a)===f};exports.isStrictMode=function(a){return v(a)===e};exports.isSuspense=function(a){return v(a)===m};exports.isSuspenseList=function(a){return v(a)===n};\nexports.isValidElementType=function(a){return\"string\"===typeof a||\"function\"===typeof a||a===d||a===f||a===e||a===m||a===n||a===t||\"object\"===typeof a&&null!==a&&(a.$$typeof===q||a.$$typeof===p||a.$$typeof===g||a.$$typeof===h||a.$$typeof===l||a.$$typeof===u||void 0!==a.getModuleId)?!0:!1};exports.typeOf=v;\n","'use strict';\n\nif (process.env.NODE_ENV === 'production') {\n  module.exports = require('./cjs/react-is.production.min.js');\n} else {\n  module.exports = require('./cjs/react-is.development.js');\n}\n","/**\n * @license React\n * react-jsx-runtime.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n'use strict';var f=require(\"react\"),k=Symbol.for(\"react.element\"),l=Symbol.for(\"react.fragment\"),m=Object.prototype.hasOwnProperty,n=f.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner,p={key:!0,ref:!0,__self:!0,__source:!0};\nfunction q(c,a,g){var b,d={},e=null,h=null;void 0!==g&&(e=\"\"+g);void 0!==a.key&&(e=\"\"+a.key);void 0!==a.ref&&(h=a.ref);for(b in a)m.call(a,b)&&!p.hasOwnProperty(b)&&(d[b]=a[b]);if(c&&c.defaultProps)for(b in a=c.defaultProps,a)void 0===d[b]&&(d[b]=a[b]);return{$$typeof:k,type:c,key:e,ref:h,props:d,_owner:n.current}}exports.Fragment=l;exports.jsx=q;exports.jsxs=q;\n","/**\n * @license React\n * react.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n'use strict';var l=Symbol.for(\"react.element\"),n=Symbol.for(\"react.portal\"),p=Symbol.for(\"react.fragment\"),q=Symbol.for(\"react.strict_mode\"),r=Symbol.for(\"react.profiler\"),t=Symbol.for(\"react.provider\"),u=Symbol.for(\"react.context\"),v=Symbol.for(\"react.forward_ref\"),w=Symbol.for(\"react.suspense\"),x=Symbol.for(\"react.memo\"),y=Symbol.for(\"react.lazy\"),z=Symbol.iterator;function A(a){if(null===a||\"object\"!==typeof a)return null;a=z&&a[z]||a[\"@@iterator\"];return\"function\"===typeof a?a:null}\nvar B={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},C=Object.assign,D={};function E(a,b,e){this.props=a;this.context=b;this.refs=D;this.updater=e||B}E.prototype.isReactComponent={};\nE.prototype.setState=function(a,b){if(\"object\"!==typeof a&&\"function\"!==typeof a&&null!=a)throw Error(\"setState(...): takes an object of state variables to update or a function which returns an object of state variables.\");this.updater.enqueueSetState(this,a,b,\"setState\")};E.prototype.forceUpdate=function(a){this.updater.enqueueForceUpdate(this,a,\"forceUpdate\")};function F(){}F.prototype=E.prototype;function G(a,b,e){this.props=a;this.context=b;this.refs=D;this.updater=e||B}var H=G.prototype=new F;\nH.constructor=G;C(H,E.prototype);H.isPureReactComponent=!0;var I=Array.isArray,J=Object.prototype.hasOwnProperty,K={current:null},L={key:!0,ref:!0,__self:!0,__source:!0};\nfunction M(a,b,e){var d,c={},k=null,h=null;if(null!=b)for(d in void 0!==b.ref&&(h=b.ref),void 0!==b.key&&(k=\"\"+b.key),b)J.call(b,d)&&!L.hasOwnProperty(d)&&(c[d]=b[d]);var g=arguments.length-2;if(1===g)c.children=e;else if(1<g){for(var f=Array(g),m=0;m<g;m++)f[m]=arguments[m+2];c.children=f}if(a&&a.defaultProps)for(d in g=a.defaultProps,g)void 0===c[d]&&(c[d]=g[d]);return{$$typeof:l,type:a,key:k,ref:h,props:c,_owner:K.current}}\nfunction N(a,b){return{$$typeof:l,type:a.type,key:b,ref:a.ref,props:a.props,_owner:a._owner}}function O(a){return\"object\"===typeof a&&null!==a&&a.$$typeof===l}function escape(a){var b={\"=\":\"=0\",\":\":\"=2\"};return\"$\"+a.replace(/[=:]/g,function(a){return b[a]})}var P=/\\/+/g;function Q(a,b){return\"object\"===typeof a&&null!==a&&null!=a.key?escape(\"\"+a.key):b.toString(36)}\nfunction R(a,b,e,d,c){var k=typeof a;if(\"undefined\"===k||\"boolean\"===k)a=null;var h=!1;if(null===a)h=!0;else switch(k){case \"string\":case \"number\":h=!0;break;case \"object\":switch(a.$$typeof){case l:case n:h=!0}}if(h)return h=a,c=c(h),a=\"\"===d?\".\"+Q(h,0):d,I(c)?(e=\"\",null!=a&&(e=a.replace(P,\"$&/\")+\"/\"),R(c,b,e,\"\",function(a){return a})):null!=c&&(O(c)&&(c=N(c,e+(!c.key||h&&h.key===c.key?\"\":(\"\"+c.key).replace(P,\"$&/\")+\"/\")+a)),b.push(c)),1;h=0;d=\"\"===d?\".\":d+\":\";if(I(a))for(var g=0;g<a.length;g++){k=\na[g];var f=d+Q(k,g);h+=R(k,b,e,f,c)}else if(f=A(a),\"function\"===typeof f)for(a=f.call(a),g=0;!(k=a.next()).done;)k=k.value,f=d+Q(k,g++),h+=R(k,b,e,f,c);else if(\"object\"===k)throw b=String(a),Error(\"Objects are not valid as a React child (found: \"+(\"[object Object]\"===b?\"object with keys {\"+Object.keys(a).join(\", \")+\"}\":b)+\"). If you meant to render a collection of children, use an array instead.\");return h}\nfunction S(a,b,e){if(null==a)return a;var d=[],c=0;R(a,d,\"\",\"\",function(a){return b.call(e,a,c++)});return d}function T(a){if(-1===a._status){var b=a._result;b=b();b.then(function(b){if(0===a._status||-1===a._status)a._status=1,a._result=b},function(b){if(0===a._status||-1===a._status)a._status=2,a._result=b});-1===a._status&&(a._status=0,a._result=b)}if(1===a._status)return a._result.default;throw a._result;}\nvar U={current:null},V={transition:null},W={ReactCurrentDispatcher:U,ReactCurrentBatchConfig:V,ReactCurrentOwner:K};exports.Children={map:S,forEach:function(a,b,e){S(a,function(){b.apply(this,arguments)},e)},count:function(a){var b=0;S(a,function(){b++});return b},toArray:function(a){return S(a,function(a){return a})||[]},only:function(a){if(!O(a))throw Error(\"React.Children.only expected to receive a single React element child.\");return a}};exports.Component=E;exports.Fragment=p;\nexports.Profiler=r;exports.PureComponent=G;exports.StrictMode=q;exports.Suspense=w;exports.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=W;\nexports.cloneElement=function(a,b,e){if(null===a||void 0===a)throw Error(\"React.cloneElement(...): The argument must be a React element, but you passed \"+a+\".\");var d=C({},a.props),c=a.key,k=a.ref,h=a._owner;if(null!=b){void 0!==b.ref&&(k=b.ref,h=K.current);void 0!==b.key&&(c=\"\"+b.key);if(a.type&&a.type.defaultProps)var g=a.type.defaultProps;for(f in b)J.call(b,f)&&!L.hasOwnProperty(f)&&(d[f]=void 0===b[f]&&void 0!==g?g[f]:b[f])}var f=arguments.length-2;if(1===f)d.children=e;else if(1<f){g=Array(f);\nfor(var m=0;m<f;m++)g[m]=arguments[m+2];d.children=g}return{$$typeof:l,type:a.type,key:c,ref:k,props:d,_owner:h}};exports.createContext=function(a){a={$$typeof:u,_currentValue:a,_currentValue2:a,_threadCount:0,Provider:null,Consumer:null,_defaultValue:null,_globalName:null};a.Provider={$$typeof:t,_context:a};return a.Consumer=a};exports.createElement=M;exports.createFactory=function(a){var b=M.bind(null,a);b.type=a;return b};exports.createRef=function(){return{current:null}};\nexports.forwardRef=function(a){return{$$typeof:v,render:a}};exports.isValidElement=O;exports.lazy=function(a){return{$$typeof:y,_payload:{_status:-1,_result:a},_init:T}};exports.memo=function(a,b){return{$$typeof:x,type:a,compare:void 0===b?null:b}};exports.startTransition=function(a){var b=V.transition;V.transition={};try{a()}finally{V.transition=b}};exports.unstable_act=function(){throw Error(\"act(...) is not supported in production builds of React.\");};\nexports.useCallback=function(a,b){return U.current.useCallback(a,b)};exports.useContext=function(a){return U.current.useContext(a)};exports.useDebugValue=function(){};exports.useDeferredValue=function(a){return U.current.useDeferredValue(a)};exports.useEffect=function(a,b){return U.current.useEffect(a,b)};exports.useId=function(){return U.current.useId()};exports.useImperativeHandle=function(a,b,e){return U.current.useImperativeHandle(a,b,e)};\nexports.useInsertionEffect=function(a,b){return U.current.useInsertionEffect(a,b)};exports.useLayoutEffect=function(a,b){return U.current.useLayoutEffect(a,b)};exports.useMemo=function(a,b){return U.current.useMemo(a,b)};exports.useReducer=function(a,b,e){return U.current.useReducer(a,b,e)};exports.useRef=function(a){return U.current.useRef(a)};exports.useState=function(a){return U.current.useState(a)};exports.useSyncExternalStore=function(a,b,e){return U.current.useSyncExternalStore(a,b,e)};\nexports.useTransition=function(){return U.current.useTransition()};exports.version=\"18.2.0\";\n","'use strict';\n\nif (process.env.NODE_ENV === 'production') {\n  module.exports = require('./cjs/react.production.min.js');\n} else {\n  module.exports = require('./cjs/react.development.js');\n}\n","'use strict';\n\nif (process.env.NODE_ENV === 'production') {\n  module.exports = require('./cjs/react-jsx-runtime.production.min.js');\n} else {\n  module.exports = require('./cjs/react-jsx-runtime.development.js');\n}\n","/**\n * @license React\n * scheduler.production.min.js\n *\n * Copyright (c) Facebook, Inc. and its affiliates.\n *\n * This source code is licensed under the MIT license found in the\n * LICENSE file in the root directory of this source tree.\n */\n'use strict';function f(a,b){var c=a.length;a.push(b);a:for(;0<c;){var d=c-1>>>1,e=a[d];if(0<g(e,b))a[d]=b,a[c]=e,c=d;else break a}}function h(a){return 0===a.length?null:a[0]}function k(a){if(0===a.length)return null;var b=a[0],c=a.pop();if(c!==b){a[0]=c;a:for(var d=0,e=a.length,w=e>>>1;d<w;){var m=2*(d+1)-1,C=a[m],n=m+1,x=a[n];if(0>g(C,c))n<e&&0>g(x,C)?(a[d]=x,a[n]=c,d=n):(a[d]=C,a[m]=c,d=m);else if(n<e&&0>g(x,c))a[d]=x,a[n]=c,d=n;else break a}}return b}\nfunction g(a,b){var c=a.sortIndex-b.sortIndex;return 0!==c?c:a.id-b.id}if(\"object\"===typeof performance&&\"function\"===typeof performance.now){var l=performance;exports.unstable_now=function(){return l.now()}}else{var p=Date,q=p.now();exports.unstable_now=function(){return p.now()-q}}var r=[],t=[],u=1,v=null,y=3,z=!1,A=!1,B=!1,D=\"function\"===typeof setTimeout?setTimeout:null,E=\"function\"===typeof clearTimeout?clearTimeout:null,F=\"undefined\"!==typeof setImmediate?setImmediate:null;\n\"undefined\"!==typeof navigator&&void 0!==navigator.scheduling&&void 0!==navigator.scheduling.isInputPending&&navigator.scheduling.isInputPending.bind(navigator.scheduling);function G(a){for(var b=h(t);null!==b;){if(null===b.callback)k(t);else if(b.startTime<=a)k(t),b.sortIndex=b.expirationTime,f(r,b);else break;b=h(t)}}function H(a){B=!1;G(a);if(!A)if(null!==h(r))A=!0,I(J);else{var b=h(t);null!==b&&K(H,b.startTime-a)}}\nfunction J(a,b){A=!1;B&&(B=!1,E(L),L=-1);z=!0;var c=y;try{G(b);for(v=h(r);null!==v&&(!(v.expirationTime>b)||a&&!M());){var d=v.callback;if(\"function\"===typeof d){v.callback=null;y=v.priorityLevel;var e=d(v.expirationTime<=b);b=exports.unstable_now();\"function\"===typeof e?v.callback=e:v===h(r)&&k(r);G(b)}else k(r);v=h(r)}if(null!==v)var w=!0;else{var m=h(t);null!==m&&K(H,m.startTime-b);w=!1}return w}finally{v=null,y=c,z=!1}}var N=!1,O=null,L=-1,P=5,Q=-1;\nfunction M(){return exports.unstable_now()-Q<P?!1:!0}function R(){if(null!==O){var a=exports.unstable_now();Q=a;var b=!0;try{b=O(!0,a)}finally{b?S():(N=!1,O=null)}}else N=!1}var S;if(\"function\"===typeof F)S=function(){F(R)};else if(\"undefined\"!==typeof MessageChannel){var T=new MessageChannel,U=T.port2;T.port1.onmessage=R;S=function(){U.postMessage(null)}}else S=function(){D(R,0)};function I(a){O=a;N||(N=!0,S())}function K(a,b){L=D(function(){a(exports.unstable_now())},b)}\nexports.unstable_IdlePriority=5;exports.unstable_ImmediatePriority=1;exports.unstable_LowPriority=4;exports.unstable_NormalPriority=3;exports.unstable_Profiling=null;exports.unstable_UserBlockingPriority=2;exports.unstable_cancelCallback=function(a){a.callback=null};exports.unstable_continueExecution=function(){A||z||(A=!0,I(J))};\nexports.unstable_forceFrameRate=function(a){0>a||125<a?console.error(\"forceFrameRate takes a positive int between 0 and 125, forcing frame rates higher than 125 fps is not supported\"):P=0<a?Math.floor(1E3/a):5};exports.unstable_getCurrentPriorityLevel=function(){return y};exports.unstable_getFirstCallbackNode=function(){return h(r)};exports.unstable_next=function(a){switch(y){case 1:case 2:case 3:var b=3;break;default:b=y}var c=y;y=b;try{return a()}finally{y=c}};exports.unstable_pauseExecution=function(){};\nexports.unstable_requestPaint=function(){};exports.unstable_runWithPriority=function(a,b){switch(a){case 1:case 2:case 3:case 4:case 5:break;default:a=3}var c=y;y=a;try{return b()}finally{y=c}};\nexports.unstable_scheduleCallback=function(a,b,c){var d=exports.unstable_now();\"object\"===typeof c&&null!==c?(c=c.delay,c=\"number\"===typeof c&&0<c?d+c:d):c=d;switch(a){case 1:var e=-1;break;case 2:e=250;break;case 5:e=1073741823;break;case 4:e=1E4;break;default:e=5E3}e=c+e;a={id:u++,callback:b,priorityLevel:a,startTime:c,expirationTime:e,sortIndex:-1};c>d?(a.sortIndex=c,f(t,a),null===h(r)&&a===h(t)&&(B?(E(L),L=-1):B=!0,K(H,c-d))):(a.sortIndex=e,f(r,a),A||z||(A=!0,I(J)));return a};\nexports.unstable_shouldYield=M;exports.unstable_wrapCallback=function(a){var b=y;return function(){var c=y;y=b;try{return a.apply(this,arguments)}finally{y=c}}};\n","'use strict';\n\nif (process.env.NODE_ENV === 'production') {\n  module.exports = require('./cjs/scheduler.production.min.js');\n} else {\n  module.exports = require('./cjs/scheduler.development.js');\n}\n","//\n\nmodule.exports = function shallowEqual(objA, objB, compare, compareContext) {\n  var ret = compare ? compare.call(compareContext, objA, objB) : void 0;\n\n  if (ret !== void 0) {\n    return !!ret;\n  }\n\n  if (objA === objB) {\n    return true;\n  }\n\n  if (typeof objA !== \"object\" || !objA || typeof objB !== \"object\" || !objB) {\n    return false;\n  }\n\n  var keysA = Object.keys(objA);\n  var keysB = Object.keys(objB);\n\n  if (keysA.length !== keysB.length) {\n    return false;\n  }\n\n  var bHasOwnProperty = Object.prototype.hasOwnProperty.bind(objB);\n\n  // Test for A's keys different from B.\n  for (var idx = 0; idx < keysA.length; idx++) {\n    var key = keysA[idx];\n\n    if (!bHasOwnProperty(key)) {\n      return false;\n    }\n\n    var valueA = objA[key];\n    var valueB = objB[key];\n\n    ret = compare ? compare.call(compareContext, valueA, valueB, key) : void 0;\n\n    if (ret === false || (ret === void 0 && valueA !== valueB)) {\n      return false;\n    }\n  }\n\n  return true;\n};\n","// The module cache\nvar __webpack_module_cache__ = {};\n\n// The require function\nfunction __webpack_require__(moduleId) {\n\t// Check if module is in cache\n\tvar cachedModule = __webpack_module_cache__[moduleId];\n\tif (cachedModule !== undefined) {\n\t\treturn cachedModule.exports;\n\t}\n\t// Create a new module (and put it into the cache)\n\tvar module = __webpack_module_cache__[moduleId] = {\n\t\t// no module.id needed\n\t\t// no module.loaded needed\n\t\texports: {}\n\t};\n\n\t// Execute the module function\n\t__webpack_modules__[moduleId](module, module.exports, __webpack_require__);\n\n\t// Return the exports of the module\n\treturn module.exports;\n}\n\n","// getDefaultExport function for compatibility with non-harmony modules\n__webpack_require__.n = (module) => {\n\tvar getter = module && module.__esModule ?\n\t\t() => (module['default']) :\n\t\t() => (module);\n\t__webpack_require__.d(getter, { a: getter });\n\treturn getter;\n};","// define getter functions for harmony exports\n__webpack_require__.d = (exports, definition) => {\n\tfor(var key in definition) {\n\t\tif(__webpack_require__.o(definition, key) && !__webpack_require__.o(exports, key)) {\n\t\t\tObject.defineProperty(exports, key, { enumerable: true, get: definition[key] });\n\t\t}\n\t}\n};","__webpack_require__.o = (obj, prop) => (Object.prototype.hasOwnProperty.call(obj, prop))","__webpack_require__.nc = undefined;","function stylis_min (W) {\n  function M(d, c, e, h, a) {\n    for (var m = 0, b = 0, v = 0, n = 0, q, g, x = 0, K = 0, k, u = k = q = 0, l = 0, r = 0, I = 0, t = 0, B = e.length, J = B - 1, y, f = '', p = '', F = '', G = '', C; l < B;) {\n      g = e.charCodeAt(l);\n      l === J && 0 !== b + n + v + m && (0 !== b && (g = 47 === b ? 10 : 47), n = v = m = 0, B++, J++);\n\n      if (0 === b + n + v + m) {\n        if (l === J && (0 < r && (f = f.replace(N, '')), 0 < f.trim().length)) {\n          switch (g) {\n            case 32:\n            case 9:\n            case 59:\n            case 13:\n            case 10:\n              break;\n\n            default:\n              f += e.charAt(l);\n          }\n\n          g = 59;\n        }\n\n        switch (g) {\n          case 123:\n            f = f.trim();\n            q = f.charCodeAt(0);\n            k = 1;\n\n            for (t = ++l; l < B;) {\n              switch (g = e.charCodeAt(l)) {\n                case 123:\n                  k++;\n                  break;\n\n                case 125:\n                  k--;\n                  break;\n\n                case 47:\n                  switch (g = e.charCodeAt(l + 1)) {\n                    case 42:\n                    case 47:\n                      a: {\n                        for (u = l + 1; u < J; ++u) {\n                          switch (e.charCodeAt(u)) {\n                            case 47:\n                              if (42 === g && 42 === e.charCodeAt(u - 1) && l + 2 !== u) {\n                                l = u + 1;\n                                break a;\n                              }\n\n                              break;\n\n                            case 10:\n                              if (47 === g) {\n                                l = u + 1;\n                                break a;\n                              }\n\n                          }\n                        }\n\n                        l = u;\n                      }\n\n                  }\n\n                  break;\n\n                case 91:\n                  g++;\n\n                case 40:\n                  g++;\n\n                case 34:\n                case 39:\n                  for (; l++ < J && e.charCodeAt(l) !== g;) {\n                  }\n\n              }\n\n              if (0 === k) break;\n              l++;\n            }\n\n            k = e.substring(t, l);\n            0 === q && (q = (f = f.replace(ca, '').trim()).charCodeAt(0));\n\n            switch (q) {\n              case 64:\n                0 < r && (f = f.replace(N, ''));\n                g = f.charCodeAt(1);\n\n                switch (g) {\n                  case 100:\n                  case 109:\n                  case 115:\n                  case 45:\n                    r = c;\n                    break;\n\n                  default:\n                    r = O;\n                }\n\n                k = M(c, r, k, g, a + 1);\n                t = k.length;\n                0 < A && (r = X(O, f, I), C = H(3, k, r, c, D, z, t, g, a, h), f = r.join(''), void 0 !== C && 0 === (t = (k = C.trim()).length) && (g = 0, k = ''));\n                if (0 < t) switch (g) {\n                  case 115:\n                    f = f.replace(da, ea);\n\n                  case 100:\n                  case 109:\n                  case 45:\n                    k = f + '{' + k + '}';\n                    break;\n\n                  case 107:\n                    f = f.replace(fa, '$1 $2');\n                    k = f + '{' + k + '}';\n                    k = 1 === w || 2 === w && L('@' + k, 3) ? '@-webkit-' + k + '@' + k : '@' + k;\n                    break;\n\n                  default:\n                    k = f + k, 112 === h && (k = (p += k, ''));\n                } else k = '';\n                break;\n\n              default:\n                k = M(c, X(c, f, I), k, h, a + 1);\n            }\n\n            F += k;\n            k = I = r = u = q = 0;\n            f = '';\n            g = e.charCodeAt(++l);\n            break;\n\n          case 125:\n          case 59:\n            f = (0 < r ? f.replace(N, '') : f).trim();\n            if (1 < (t = f.length)) switch (0 === u && (q = f.charCodeAt(0), 45 === q || 96 < q && 123 > q) && (t = (f = f.replace(' ', ':')).length), 0 < A && void 0 !== (C = H(1, f, c, d, D, z, p.length, h, a, h)) && 0 === (t = (f = C.trim()).length) && (f = '\\x00\\x00'), q = f.charCodeAt(0), g = f.charCodeAt(1), q) {\n              case 0:\n                break;\n\n              case 64:\n                if (105 === g || 99 === g) {\n                  G += f + e.charAt(l);\n                  break;\n                }\n\n              default:\n                58 !== f.charCodeAt(t - 1) && (p += P(f, q, g, f.charCodeAt(2)));\n            }\n            I = r = u = q = 0;\n            f = '';\n            g = e.charCodeAt(++l);\n        }\n      }\n\n      switch (g) {\n        case 13:\n        case 10:\n          47 === b ? b = 0 : 0 === 1 + q && 107 !== h && 0 < f.length && (r = 1, f += '\\x00');\n          0 < A * Y && H(0, f, c, d, D, z, p.length, h, a, h);\n          z = 1;\n          D++;\n          break;\n\n        case 59:\n        case 125:\n          if (0 === b + n + v + m) {\n            z++;\n            break;\n          }\n\n        default:\n          z++;\n          y = e.charAt(l);\n\n          switch (g) {\n            case 9:\n            case 32:\n              if (0 === n + m + b) switch (x) {\n                case 44:\n                case 58:\n                case 9:\n                case 32:\n                  y = '';\n                  break;\n\n                default:\n                  32 !== g && (y = ' ');\n              }\n              break;\n\n            case 0:\n              y = '\\\\0';\n              break;\n\n            case 12:\n              y = '\\\\f';\n              break;\n\n            case 11:\n              y = '\\\\v';\n              break;\n\n            case 38:\n              0 === n + b + m && (r = I = 1, y = '\\f' + y);\n              break;\n\n            case 108:\n              if (0 === n + b + m + E && 0 < u) switch (l - u) {\n                case 2:\n                  112 === x && 58 === e.charCodeAt(l - 3) && (E = x);\n\n                case 8:\n                  111 === K && (E = K);\n              }\n              break;\n\n            case 58:\n              0 === n + b + m && (u = l);\n              break;\n\n            case 44:\n              0 === b + v + n + m && (r = 1, y += '\\r');\n              break;\n\n            case 34:\n            case 39:\n              0 === b && (n = n === g ? 0 : 0 === n ? g : n);\n              break;\n\n            case 91:\n              0 === n + b + v && m++;\n              break;\n\n            case 93:\n              0 === n + b + v && m--;\n              break;\n\n            case 41:\n              0 === n + b + m && v--;\n              break;\n\n            case 40:\n              if (0 === n + b + m) {\n                if (0 === q) switch (2 * x + 3 * K) {\n                  case 533:\n                    break;\n\n                  default:\n                    q = 1;\n                }\n                v++;\n              }\n\n              break;\n\n            case 64:\n              0 === b + v + n + m + u + k && (k = 1);\n              break;\n\n            case 42:\n            case 47:\n              if (!(0 < n + m + v)) switch (b) {\n                case 0:\n                  switch (2 * g + 3 * e.charCodeAt(l + 1)) {\n                    case 235:\n                      b = 47;\n                      break;\n\n                    case 220:\n                      t = l, b = 42;\n                  }\n\n                  break;\n\n                case 42:\n                  47 === g && 42 === x && t + 2 !== l && (33 === e.charCodeAt(t + 2) && (p += e.substring(t, l + 1)), y = '', b = 0);\n              }\n          }\n\n          0 === b && (f += y);\n      }\n\n      K = x;\n      x = g;\n      l++;\n    }\n\n    t = p.length;\n\n    if (0 < t) {\n      r = c;\n      if (0 < A && (C = H(2, p, r, d, D, z, t, h, a, h), void 0 !== C && 0 === (p = C).length)) return G + p + F;\n      p = r.join(',') + '{' + p + '}';\n\n      if (0 !== w * E) {\n        2 !== w || L(p, 2) || (E = 0);\n\n        switch (E) {\n          case 111:\n            p = p.replace(ha, ':-moz-$1') + p;\n            break;\n\n          case 112:\n            p = p.replace(Q, '::-webkit-input-$1') + p.replace(Q, '::-moz-$1') + p.replace(Q, ':-ms-input-$1') + p;\n        }\n\n        E = 0;\n      }\n    }\n\n    return G + p + F;\n  }\n\n  function X(d, c, e) {\n    var h = c.trim().split(ia);\n    c = h;\n    var a = h.length,\n        m = d.length;\n\n    switch (m) {\n      case 0:\n      case 1:\n        var b = 0;\n\n        for (d = 0 === m ? '' : d[0] + ' '; b < a; ++b) {\n          c[b] = Z(d, c[b], e).trim();\n        }\n\n        break;\n\n      default:\n        var v = b = 0;\n\n        for (c = []; b < a; ++b) {\n          for (var n = 0; n < m; ++n) {\n            c[v++] = Z(d[n] + ' ', h[b], e).trim();\n          }\n        }\n\n    }\n\n    return c;\n  }\n\n  function Z(d, c, e) {\n    var h = c.charCodeAt(0);\n    33 > h && (h = (c = c.trim()).charCodeAt(0));\n\n    switch (h) {\n      case 38:\n        return c.replace(F, '$1' + d.trim());\n\n      case 58:\n        return d.trim() + c.replace(F, '$1' + d.trim());\n\n      default:\n        if (0 < 1 * e && 0 < c.indexOf('\\f')) return c.replace(F, (58 === d.charCodeAt(0) ? '' : '$1') + d.trim());\n    }\n\n    return d + c;\n  }\n\n  function P(d, c, e, h) {\n    var a = d + ';',\n        m = 2 * c + 3 * e + 4 * h;\n\n    if (944 === m) {\n      d = a.indexOf(':', 9) + 1;\n      var b = a.substring(d, a.length - 1).trim();\n      b = a.substring(0, d).trim() + b + ';';\n      return 1 === w || 2 === w && L(b, 1) ? '-webkit-' + b + b : b;\n    }\n\n    if (0 === w || 2 === w && !L(a, 1)) return a;\n\n    switch (m) {\n      case 1015:\n        return 97 === a.charCodeAt(10) ? '-webkit-' + a + a : a;\n\n      case 951:\n        return 116 === a.charCodeAt(3) ? '-webkit-' + a + a : a;\n\n      case 963:\n        return 110 === a.charCodeAt(5) ? '-webkit-' + a + a : a;\n\n      case 1009:\n        if (100 !== a.charCodeAt(4)) break;\n\n      case 969:\n      case 942:\n        return '-webkit-' + a + a;\n\n      case 978:\n        return '-webkit-' + a + '-moz-' + a + a;\n\n      case 1019:\n      case 983:\n        return '-webkit-' + a + '-moz-' + a + '-ms-' + a + a;\n\n      case 883:\n        if (45 === a.charCodeAt(8)) return '-webkit-' + a + a;\n        if (0 < a.indexOf('image-set(', 11)) return a.replace(ja, '$1-webkit-$2') + a;\n        break;\n\n      case 932:\n        if (45 === a.charCodeAt(4)) switch (a.charCodeAt(5)) {\n          case 103:\n            return '-webkit-box-' + a.replace('-grow', '') + '-webkit-' + a + '-ms-' + a.replace('grow', 'positive') + a;\n\n          case 115:\n            return '-webkit-' + a + '-ms-' + a.replace('shrink', 'negative') + a;\n\n          case 98:\n            return '-webkit-' + a + '-ms-' + a.replace('basis', 'preferred-size') + a;\n        }\n        return '-webkit-' + a + '-ms-' + a + a;\n\n      case 964:\n        return '-webkit-' + a + '-ms-flex-' + a + a;\n\n      case 1023:\n        if (99 !== a.charCodeAt(8)) break;\n        b = a.substring(a.indexOf(':', 15)).replace('flex-', '').replace('space-between', 'justify');\n        return '-webkit-box-pack' + b + '-webkit-' + a + '-ms-flex-pack' + b + a;\n\n      case 1005:\n        return ka.test(a) ? a.replace(aa, ':-webkit-') + a.replace(aa, ':-moz-') + a : a;\n\n      case 1e3:\n        b = a.substring(13).trim();\n        c = b.indexOf('-') + 1;\n\n        switch (b.charCodeAt(0) + b.charCodeAt(c)) {\n          case 226:\n            b = a.replace(G, 'tb');\n            break;\n\n          case 232:\n            b = a.replace(G, 'tb-rl');\n            break;\n\n          case 220:\n            b = a.replace(G, 'lr');\n            break;\n\n          default:\n            return a;\n        }\n\n        return '-webkit-' + a + '-ms-' + b + a;\n\n      case 1017:\n        if (-1 === a.indexOf('sticky', 9)) break;\n\n      case 975:\n        c = (a = d).length - 10;\n        b = (33 === a.charCodeAt(c) ? a.substring(0, c) : a).substring(d.indexOf(':', 7) + 1).trim();\n\n        switch (m = b.charCodeAt(0) + (b.charCodeAt(7) | 0)) {\n          case 203:\n            if (111 > b.charCodeAt(8)) break;\n\n          case 115:\n            a = a.replace(b, '-webkit-' + b) + ';' + a;\n            break;\n\n          case 207:\n          case 102:\n            a = a.replace(b, '-webkit-' + (102 < m ? 'inline-' : '') + 'box') + ';' + a.replace(b, '-webkit-' + b) + ';' + a.replace(b, '-ms-' + b + 'box') + ';' + a;\n        }\n\n        return a + ';';\n\n      case 938:\n        if (45 === a.charCodeAt(5)) switch (a.charCodeAt(6)) {\n          case 105:\n            return b = a.replace('-items', ''), '-webkit-' + a + '-webkit-box-' + b + '-ms-flex-' + b + a;\n\n          case 115:\n            return '-webkit-' + a + '-ms-flex-item-' + a.replace(ba, '') + a;\n\n          default:\n            return '-webkit-' + a + '-ms-flex-line-pack' + a.replace('align-content', '').replace(ba, '') + a;\n        }\n        break;\n\n      case 973:\n      case 989:\n        if (45 !== a.charCodeAt(3) || 122 === a.charCodeAt(4)) break;\n\n      case 931:\n      case 953:\n        if (!0 === la.test(d)) return 115 === (b = d.substring(d.indexOf(':') + 1)).charCodeAt(0) ? P(d.replace('stretch', 'fill-available'), c, e, h).replace(':fill-available', ':stretch') : a.replace(b, '-webkit-' + b) + a.replace(b, '-moz-' + b.replace('fill-', '')) + a;\n        break;\n\n      case 962:\n        if (a = '-webkit-' + a + (102 === a.charCodeAt(5) ? '-ms-' + a : '') + a, 211 === e + h && 105 === a.charCodeAt(13) && 0 < a.indexOf('transform', 10)) return a.substring(0, a.indexOf(';', 27) + 1).replace(ma, '$1-webkit-$2') + a;\n    }\n\n    return a;\n  }\n\n  function L(d, c) {\n    var e = d.indexOf(1 === c ? ':' : '{'),\n        h = d.substring(0, 3 !== c ? e : 10);\n    e = d.substring(e + 1, d.length - 1);\n    return R(2 !== c ? h : h.replace(na, '$1'), e, c);\n  }\n\n  function ea(d, c) {\n    var e = P(c, c.charCodeAt(0), c.charCodeAt(1), c.charCodeAt(2));\n    return e !== c + ';' ? e.replace(oa, ' or ($1)').substring(4) : '(' + c + ')';\n  }\n\n  function H(d, c, e, h, a, m, b, v, n, q) {\n    for (var g = 0, x = c, w; g < A; ++g) {\n      switch (w = S[g].call(B, d, x, e, h, a, m, b, v, n, q)) {\n        case void 0:\n        case !1:\n        case !0:\n        case null:\n          break;\n\n        default:\n          x = w;\n      }\n    }\n\n    if (x !== c) return x;\n  }\n\n  function T(d) {\n    switch (d) {\n      case void 0:\n      case null:\n        A = S.length = 0;\n        break;\n\n      default:\n        if ('function' === typeof d) S[A++] = d;else if ('object' === typeof d) for (var c = 0, e = d.length; c < e; ++c) {\n          T(d[c]);\n        } else Y = !!d | 0;\n    }\n\n    return T;\n  }\n\n  function U(d) {\n    d = d.prefix;\n    void 0 !== d && (R = null, d ? 'function' !== typeof d ? w = 1 : (w = 2, R = d) : w = 0);\n    return U;\n  }\n\n  function B(d, c) {\n    var e = d;\n    33 > e.charCodeAt(0) && (e = e.trim());\n    V = e;\n    e = [V];\n\n    if (0 < A) {\n      var h = H(-1, c, e, e, D, z, 0, 0, 0, 0);\n      void 0 !== h && 'string' === typeof h && (c = h);\n    }\n\n    var a = M(O, e, c, 0, 0);\n    0 < A && (h = H(-2, a, e, e, D, z, a.length, 0, 0, 0), void 0 !== h && (a = h));\n    V = '';\n    E = 0;\n    z = D = 1;\n    return a;\n  }\n\n  var ca = /^\\0+/g,\n      N = /[\\0\\r\\f]/g,\n      aa = /: */g,\n      ka = /zoo|gra/,\n      ma = /([,: ])(transform)/g,\n      ia = /,\\r+?/g,\n      F = /([\\t\\r\\n ])*\\f?&/g,\n      fa = /@(k\\w+)\\s*(\\S*)\\s*/,\n      Q = /::(place)/g,\n      ha = /:(read-only)/g,\n      G = /[svh]\\w+-[tblr]{2}/,\n      da = /\\(\\s*(.*)\\s*\\)/g,\n      oa = /([\\s\\S]*?);/g,\n      ba = /-self|flex-/g,\n      na = /[^]*?(:[rp][el]a[\\w-]+)[^]*/,\n      la = /stretch|:\\s*\\w+\\-(?:conte|avail)/,\n      ja = /([^-])(image-set\\()/,\n      z = 1,\n      D = 1,\n      E = 0,\n      w = 1,\n      O = [],\n      S = [],\n      A = 0,\n      R = null,\n      Y = 0,\n      V = '';\n  B.use = T;\n  B.set = U;\n  void 0 !== W && U(W);\n  return B;\n}\n\nexport default stylis_min;\n","var unitlessKeys = {\n  animationIterationCount: 1,\n  borderImageOutset: 1,\n  borderImageSlice: 1,\n  borderImageWidth: 1,\n  boxFlex: 1,\n  boxFlexGroup: 1,\n  boxOrdinalGroup: 1,\n  columnCount: 1,\n  columns: 1,\n  flex: 1,\n  flexGrow: 1,\n  flexPositive: 1,\n  flexShrink: 1,\n  flexNegative: 1,\n  flexOrder: 1,\n  gridRow: 1,\n  gridRowEnd: 1,\n  gridRowSpan: 1,\n  gridRowStart: 1,\n  gridColumn: 1,\n  gridColumnEnd: 1,\n  gridColumnSpan: 1,\n  gridColumnStart: 1,\n  msGridRow: 1,\n  msGridRowSpan: 1,\n  msGridColumn: 1,\n  msGridColumnSpan: 1,\n  fontWeight: 1,\n  lineHeight: 1,\n  opacity: 1,\n  order: 1,\n  orphans: 1,\n  tabSize: 1,\n  widows: 1,\n  zIndex: 1,\n  zoom: 1,\n  WebkitLineClamp: 1,\n  // SVG-related properties\n  fillOpacity: 1,\n  floodOpacity: 1,\n  stopOpacity: 1,\n  strokeDasharray: 1,\n  strokeDashoffset: 1,\n  strokeMiterlimit: 1,\n  strokeOpacity: 1,\n  strokeWidth: 1\n};\n\nexport default unitlessKeys;\n","function memoize(fn) {\n  var cache = Object.create(null);\n  return function (arg) {\n    if (cache[arg] === undefined) cache[arg] = fn(arg);\n    return cache[arg];\n  };\n}\n\nexport { memoize as default };\n","import memoize from '@emotion/memoize';\n\nvar reactPropsRegex = /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|cellPadding|cellSpacing|challenge|charSet|checked|cite|classID|className|cols|colSpan|content|contentEditable|contextMenu|controls|controlsList|coords|crossOrigin|data|dateTime|decoding|default|defer|dir|disabled|disablePictureInPicture|download|draggable|encType|enterKeyHint|form|formAction|formEncType|formMethod|formNoValidate|formTarget|frameBorder|headers|height|hidden|high|href|hrefLang|htmlFor|httpEquiv|id|inputMode|integrity|is|keyParams|keyType|kind|label|lang|list|loading|loop|low|marginHeight|marginWidth|max|maxLength|media|mediaGroup|method|min|minLength|multiple|muted|name|nonce|noValidate|open|optimum|pattern|placeholder|playsInline|poster|preload|profile|radioGroup|readOnly|referrerPolicy|rel|required|reversed|role|rows|rowSpan|sandbox|scope|scoped|scrolling|seamless|selected|shape|size|sizes|slot|span|spellCheck|src|srcDoc|srcLang|srcSet|start|step|style|summary|tabIndex|target|title|translate|type|useMap|value|width|wmode|wrap|about|datatype|inlist|prefix|property|resource|typeof|vocab|autoCapitalize|autoCorrect|autoSave|color|incremental|fallback|inert|itemProp|itemScope|itemType|itemID|itemRef|on|option|results|security|unselectable|accentHeight|accumulate|additive|alignmentBaseline|allowReorder|alphabetic|amplitude|arabicForm|ascent|attributeName|attributeType|autoReverse|azimuth|baseFrequency|baselineShift|baseProfile|bbox|begin|bias|by|calcMode|capHeight|clip|clipPathUnits|clipPath|clipRule|colorInterpolation|colorInterpolationFilters|colorProfile|colorRendering|contentScriptType|contentStyleType|cursor|cx|cy|d|decelerate|descent|diffuseConstant|direction|display|divisor|dominantBaseline|dur|dx|dy|edgeMode|elevation|enableBackground|end|exponent|externalResourcesRequired|fill|fillOpacity|fillRule|filter|filterRes|filterUnits|floodColor|floodOpacity|focusable|fontFamily|fontSize|fontSizeAdjust|fontStretch|fontStyle|fontVariant|fontWeight|format|from|fr|fx|fy|g1|g2|glyphName|glyphOrientationHorizontal|glyphOrientationVertical|glyphRef|gradientTransform|gradientUnits|hanging|horizAdvX|horizOriginX|ideographic|imageRendering|in|in2|intercept|k|k1|k2|k3|k4|kernelMatrix|kernelUnitLength|kerning|keyPoints|keySplines|keyTimes|lengthAdjust|letterSpacing|lightingColor|limitingConeAngle|local|markerEnd|markerMid|markerStart|markerHeight|markerUnits|markerWidth|mask|maskContentUnits|maskUnits|mathematical|mode|numOctaves|offset|opacity|operator|order|orient|orientation|origin|overflow|overlinePosition|overlineThickness|panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectRatio|primitiveUnits|r|radius|refX|refY|renderingIntent|repeatCount|repeatDur|requiredExtensions|requiredFeatures|restart|result|rotate|rx|ry|scale|seed|shapeRendering|slope|spacing|specularConstant|specularExponent|speed|spreadMethod|startOffset|stdDeviation|stemh|stemv|stitchTiles|stopColor|stopOpacity|strikethroughPosition|strikethroughThickness|string|stroke|strokeDasharray|strokeDashoffset|strokeLinecap|strokeLinejoin|strokeMiterlimit|strokeOpacity|strokeWidth|surfaceScale|systemLanguage|tableValues|targetX|targetY|textAnchor|textDecoration|textRendering|textLength|to|transform|u1|u2|underlinePosition|underlineThickness|unicode|unicodeBidi|unicodeRange|unitsPerEm|vAlphabetic|vHanging|vIdeographic|vMathematical|values|vectorEffect|version|vertAdvY|vertOriginX|vertOriginY|viewBox|viewTarget|visibility|widths|wordSpacing|writingMode|x|xHeight|x1|x2|xChannelSelector|xlinkActuate|xlinkArcrole|xlinkHref|xlinkRole|xlinkShow|xlinkTitle|xlinkType|xmlBase|xmlns|xmlnsXlink|xmlLang|xmlSpace|y|y1|y2|yChannelSelector|z|zoomAndPan|for|class|autofocus)|(([Dd][Aa][Tt][Aa]|[Aa][Rr][Ii][Aa]|x)-.*))$/; // https://esbench.com/bench/5bfee68a4cd7e6009ef61d23\n\nvar isPropValid = /* #__PURE__ */memoize(function (prop) {\n  return reactPropsRegex.test(prop) || prop.charCodeAt(0) === 111\n  /* o */\n  && prop.charCodeAt(1) === 110\n  /* n */\n  && prop.charCodeAt(2) < 91;\n}\n/* Z+1 */\n);\n\nexport { isPropValid as default };\n","// @flow\nimport type { Interpolation } from '../types';\n\nexport default (\n  strings: Array<string>,\n  interpolations: Array<Interpolation>\n): Array<Interpolation> => {\n  const result = [strings[0]];\n\n  for (let i = 0, len = interpolations.length; i < len; i += 1) {\n    result.push(interpolations[i], strings[i + 1]);\n  }\n\n  return result;\n};\n","// @flow\nimport { typeOf } from 'react-is';\n\nexport default (x: any): boolean =>\n  x !== null &&\n  typeof x === 'object' &&\n  (x.toString ? x.toString() : Object.prototype.toString.call(x)) === '[object Object]' &&\n  !typeOf(x);\n","// @flow\nexport const EMPTY_ARRAY = Object.freeze([]);\nexport const EMPTY_OBJECT = Object.freeze({});\n","// @flow\nexport default function isFunction(test: any): boolean %checks {\n  return typeof test === 'function';\n}\n","// @flow\nimport type { IStyledComponent } from '../types';\n\nexport default function getComponentName(\n  target: $PropertyType<IStyledComponent, 'target'>\n): string {\n  return (\n    (process.env.NODE_ENV !== 'production' ? typeof target === 'string' && target : false) ||\n    // $FlowFixMe\n    target.displayName ||\n    // $FlowFixMe\n    target.name ||\n    'Component'\n  );\n}\n","// @flow\nexport default function isStyledComponent(target: any): boolean %checks {\n  return target && typeof target.styledComponentId === 'string';\n}\n","// @flow\n\ndeclare var SC_DISABLE_SPEEDY: ?boolean;\ndeclare var __VERSION__: string;\n\nexport const SC_ATTR: string =\n  (typeof process !== 'undefined' &&\n    typeof process.env !== 'undefined' &&\n    (process.env.REACT_APP_SC_ATTR || process.env.SC_ATTR)) ||\n  'data-styled';\n\nexport const SC_ATTR_ACTIVE = 'active';\nexport const SC_ATTR_VERSION = 'data-styled-version';\nexport const SC_VERSION = __VERSION__;\nexport const SPLITTER = '/*!sc*/\\n';\n\nexport const IS_BROWSER = typeof window !== 'undefined' && 'HTMLElement' in window;\n\nexport const DISABLE_SPEEDY = Boolean(\n  typeof SC_DISABLE_SPEEDY === 'boolean'\n    ? SC_DISABLE_SPEEDY\n    : typeof process !== 'undefined' && typeof process.env !== 'undefined'\n    ? typeof process.env.REACT_APP_SC_DISABLE_SPEEDY !== 'undefined' &&\n      process.env.REACT_APP_SC_DISABLE_SPEEDY !== ''\n      ? process.env.REACT_APP_SC_DISABLE_SPEEDY === 'false'\n        ? false\n        : process.env.REACT_APP_SC_DISABLE_SPEEDY\n      : typeof process.env.SC_DISABLE_SPEEDY !== 'undefined' && process.env.SC_DISABLE_SPEEDY !== ''\n      ? process.env.SC_DISABLE_SPEEDY === 'false'\n        ? false\n        : process.env.SC_DISABLE_SPEEDY\n      : process.env.NODE_ENV !== 'production'\n    : false\n);\n\n// Shared empty execution context when generating static styles\nexport const STATIC_EXECUTION_CONTEXT = {};\n","// @flow\nimport errorMap from './errors';\n\nconst ERRORS = process.env.NODE_ENV !== 'production' ? errorMap : {};\n\n/**\n * super basic version of sprintf\n */\nfunction format(...args) {\n  let a = args[0];\n  const b = [];\n\n  for (let c = 1, len = args.length; c < len; c += 1) {\n    b.push(args[c]);\n  }\n\n  b.forEach(d => {\n    a = a.replace(/%[a-z]/, d);\n  });\n\n  return a;\n}\n\n/**\n * Create an error file out of errors.md for development and a simple web link to the full errors\n * in production mode.\n */\nexport default function throwStyledComponentsError(\n  code: string | number,\n  ...interpolations: Array<any>\n) {\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      `An error occurred. See https://git.io/JUIaE#${code} for more information.${\n        interpolations.length > 0 ? ` Args: ${interpolations.join(', ')}` : ''\n      }`\n    );\n  } else {\n    throw new Error(format(ERRORS[code], ...interpolations).trim());\n  }\n}\n","// @flow\n/* eslint-disable no-use-before-define */\n\nimport type { GroupedTag, Tag } from './types';\nimport { SPLITTER } from '../constants';\nimport throwStyledError from '../utils/error';\n\n/** Create a GroupedTag with an underlying Tag implementation */\nexport const makeGroupedTag = (tag: Tag): GroupedTag => {\n  return new DefaultGroupedTag(tag);\n};\n\nconst BASE_SIZE = 1 << 9;\n\nclass DefaultGroupedTag implements GroupedTag {\n  groupSizes: Uint32Array;\n\n  length: number;\n\n  tag: Tag;\n\n  constructor(tag: Tag) {\n    this.groupSizes = new Uint32Array(BASE_SIZE);\n    this.length = BASE_SIZE;\n    this.tag = tag;\n  }\n\n  indexOfGroup(group: number): number {\n    let index = 0;\n    for (let i = 0; i < group; i++) {\n      index += this.groupSizes[i];\n    }\n\n    return index;\n  }\n\n  insertRules(group: number, rules: string[]): void {\n    if (group >= this.groupSizes.length) {\n      const oldBuffer = this.groupSizes;\n      const oldSize = oldBuffer.length;\n\n      let newSize = oldSize;\n      while (group >= newSize) {\n        newSize <<= 1;\n        if (newSize < 0) {\n          throwStyledError(16, `${group}`);\n        }\n      }\n\n      this.groupSizes = new Uint32Array(newSize);\n      this.groupSizes.set(oldBuffer);\n      this.length = newSize;\n\n      for (let i = oldSize; i < newSize; i++) {\n        this.groupSizes[i] = 0;\n      }\n    }\n\n    let ruleIndex = this.indexOfGroup(group + 1);\n    for (let i = 0, l = rules.length; i < l; i++) {\n      if (this.tag.insertRule(ruleIndex, rules[i])) {\n        this.groupSizes[group]++;\n        ruleIndex++;\n      }\n    }\n  }\n\n  clearGroup(group: number): void {\n    if (group < this.length) {\n      const length = this.groupSizes[group];\n      const startIndex = this.indexOfGroup(group);\n      const endIndex = startIndex + length;\n\n      this.groupSizes[group] = 0;\n\n      for (let i = startIndex; i < endIndex; i++) {\n        this.tag.deleteRule(startIndex);\n      }\n    }\n  }\n\n  getGroup(group: number): string {\n    let css = '';\n    if (group >= this.length || this.groupSizes[group] === 0) {\n      return css;\n    }\n\n    const length = this.groupSizes[group];\n    const startIndex = this.indexOfGroup(group);\n    const endIndex = startIndex + length;\n\n    for (let i = startIndex; i < endIndex; i++) {\n      css += `${this.tag.getRule(i)}${SPLITTER}`;\n    }\n\n    return css;\n  }\n}\n","// @flow\n\nimport throwStyledError from '../utils/error';\n\nconst MAX_SMI = 1 << 31 - 1;\n\nlet groupIDRegister: Map<string, number> = new Map();\nlet reverseRegister: Map<number, string> = new Map();\nlet nextFreeGroup = 1;\n\nexport const resetGroupIds = () => {\n  groupIDRegister = new Map();\n  reverseRegister = new Map();\n  nextFreeGroup = 1;\n};\n\nexport const getGroupForId = (id: string): number => {\n  if (groupIDRegister.has(id)) {\n    return (groupIDRegister.get(id): any);\n  }\n\n  while (reverseRegister.has(nextFreeGroup)) {\n    nextFreeGroup++;\n  }\n\n  const group = nextFreeGroup++;\n\n  if (\n    process.env.NODE_ENV !== 'production' &&\n    ((group | 0) < 0 || group > MAX_SMI)\n  ) {\n    throwStyledError(16, `${group}`);\n  }\n\n  groupIDRegister.set(id, group);\n  reverseRegister.set(group, id);\n  return group;\n};\n\nexport const getIdForGroup = (group: number): void | string => {\n  return reverseRegister.get(group);\n};\n\nexport const setGroupForId = (id: string, group: number) => {\n  if (group >= nextFreeGroup) {\n    nextFreeGroup = group + 1;\n  }\n\n  groupIDRegister.set(id, group);\n  reverseRegister.set(group, id);\n};\n","// @flow\n\nimport { SPLITTER, SC_ATTR, SC_ATTR_ACTIVE, SC_ATTR_VERSION, SC_VERSION } from '../constants';\nimport { getIdForGroup, setGroupForId } from './GroupIDAllocator';\nimport type { Sheet } from './types';\n\nconst SELECTOR = `style[${SC_ATTR}][${SC_ATTR_VERSION}=\"${SC_VERSION}\"]`;\nconst MARKER_RE = new RegExp(`^${SC_ATTR}\\\\.g(\\\\d+)\\\\[id=\"([\\\\w\\\\d-]+)\"\\\\].*?\"([^\"]*)`);\n\nexport const outputSheet = (sheet: Sheet) => {\n  const tag = sheet.getTag();\n  const { length } = tag;\n\n  let css = '';\n  for (let group = 0; group < length; group++) {\n    const id = getIdForGroup(group);\n    if (id === undefined) continue;\n\n    const names = sheet.names.get(id);\n    const rules = tag.getGroup(group);\n    if (!names || !rules || !names.size) continue;\n\n    const selector = `${SC_ATTR}.g${group}[id=\"${id}\"]`;\n\n    let content = '';\n    if (names !== undefined) {\n      names.forEach(name => {\n        if (name.length > 0) {\n          content += `${name},`;\n        }\n      });\n    }\n\n    // NOTE: It's easier to collect rules and have the marker\n    // after the actual rules to simplify the rehydration\n    css += `${rules}${selector}{content:\"${content}\"}${SPLITTER}`;\n  }\n\n  return css;\n};\n\nconst rehydrateNamesFromContent = (sheet: Sheet, id: string, content: string) => {\n  const names = content.split(',');\n  let name;\n\n  for (let i = 0, l = names.length; i < l; i++) {\n    // eslint-disable-next-line\n    if ((name = names[i])) {\n      sheet.registerName(id, name);\n    }\n  }\n};\n\nconst rehydrateSheetFromTag = (sheet: Sheet, style: HTMLStyleElement) => {\n  const parts = (style.textContent || '').split(SPLITTER);\n  const rules: string[] = [];\n\n  for (let i = 0, l = parts.length; i < l; i++) {\n    const part = parts[i].trim();\n    if (!part) continue;\n\n    const marker = part.match(MARKER_RE);\n\n    if (marker) {\n      const group = parseInt(marker[1], 10) | 0;\n      const id = marker[2];\n\n      if (group !== 0) {\n        // Rehydrate componentId to group index mapping\n        setGroupForId(id, group);\n        // Rehydrate names and rules\n        // looks like: data-styled.g11[id=\"idA\"]{content:\"nameA,\"}\n        rehydrateNamesFromContent(sheet, id, marker[3]);\n        sheet.getTag().insertRules(group, rules);\n      }\n\n      rules.length = 0;\n    } else {\n      rules.push(part);\n    }\n  }\n};\n\nexport const rehydrateSheet = (sheet: Sheet) => {\n  const nodes = document.querySelectorAll(SELECTOR);\n\n  for (let i = 0, l = nodes.length; i < l; i++) {\n    const node = ((nodes[i]: any): HTMLStyleElement);\n    if (node && node.getAttribute(SC_ATTR) !== SC_ATTR_ACTIVE) {\n      rehydrateSheetFromTag(sheet, node);\n\n      if (node.parentNode) {\n        node.parentNode.removeChild(node);\n      }\n    }\n  }\n};\n","// @flow\n/* eslint-disable camelcase, no-undef */\n\ndeclare var __webpack_nonce__: string;\n\nconst getNonce = () => {\n  return typeof __webpack_nonce__ !== 'undefined' ? __webpack_nonce__ : null;\n};\n\nexport default getNonce;\n","// @flow\n\nimport { SC_ATTR, SC_ATTR_ACTIVE, SC_ATTR_VERSION, SC_VERSION } from '../constants';\nimport getNonce from '../utils/nonce';\nimport throwStyledError from '../utils/error';\n\nconst ELEMENT_TYPE = 1; /* Node.ELEMENT_TYPE */\n\n/** Find last style element if any inside target */\nconst findLastStyleTag = (target: HTMLElement): void | HTMLStyleElement => {\n  const { childNodes } = target;\n\n  for (let i = childNodes.length; i >= 0; i--) {\n    const child = ((childNodes[i]: any): ?HTMLElement);\n    if (child && child.nodeType === ELEMENT_TYPE && child.hasAttribute(SC_ATTR)) {\n      return ((child: any): HTMLStyleElement);\n    }\n  }\n\n  return undefined;\n};\n\n/** Create a style element inside `target` or <head> after the last */\nexport const makeStyleTag = (target?: HTMLElement): HTMLStyleElement => {\n  const head = ((document.head: any): HTMLElement);\n  const parent = target || head;\n  const style = document.createElement('style');\n  const prevStyle = findLastStyleTag(parent);\n  const nextSibling = prevStyle !== undefined ? prevStyle.nextSibling : null;\n\n  style.setAttribute(SC_ATTR, SC_ATTR_ACTIVE);\n  style.setAttribute(SC_ATTR_VERSION, SC_VERSION);\n\n  const nonce = getNonce();\n\n  if (nonce) style.setAttribute('nonce', nonce);\n\n  parent.insertBefore(style, nextSibling);\n\n  return style;\n};\n\n/** Get the CSSStyleSheet instance for a given style element */\nexport const getSheet = (tag: HTMLStyleElement): CSSStyleSheet => {\n  if (tag.sheet) {\n    return ((tag.sheet: any): CSSStyleSheet);\n  }\n\n  // Avoid Firefox quirk where the style element might not have a sheet property\n  const { styleSheets } = document;\n  for (let i = 0, l = styleSheets.length; i < l; i++) {\n    const sheet = styleSheets[i];\n    if (sheet.ownerNode === tag) {\n      return ((sheet: any): CSSStyleSheet);\n    }\n  }\n\n  throwStyledError(17);\n  return (undefined: any);\n};\n","// @flow\n/* eslint-disable no-use-before-define */\n\nimport { makeStyleTag, getSheet } from './dom';\nimport type { SheetOptions, Tag } from './types';\n\n/** Create a CSSStyleSheet-like tag depending on the environment */\nexport const makeTag = ({ isServer, useCSSOMInjection, target }: SheetOptions): Tag => {\n  if (isServer) {\n    return new VirtualTag(target);\n  } else if (useCSSOMInjection) {\n    return new CSSOMTag(target);\n  } else {\n    return new TextTag(target);\n  }\n};\n\nexport class CSSOMTag implements Tag {\n  element: HTMLStyleElement;\n\n  sheet: CSSStyleSheet;\n\n  length: number;\n\n  constructor(target?: HTMLElement) {\n    const element = (this.element = makeStyleTag(target));\n\n    // Avoid Edge bug where empty style elements don't create sheets\n    element.appendChild(document.createTextNode(''));\n\n    this.sheet = getSheet(element);\n    this.length = 0;\n  }\n\n  insertRule(index: number, rule: string): boolean {\n    try {\n      this.sheet.insertRule(rule, index);\n      this.length++;\n      return true;\n    } catch (_error) {\n      return false;\n    }\n  }\n\n  deleteRule(index: number): void {\n    this.sheet.deleteRule(index);\n    this.length--;\n  }\n\n  getRule(index: number): string {\n    const rule = this.sheet.cssRules[index];\n    // Avoid IE11 quirk where cssText is inaccessible on some invalid rules\n    if (rule !== undefined && typeof rule.cssText === 'string') {\n      return rule.cssText;\n    } else {\n      return '';\n    }\n  }\n}\n\n/** A Tag that emulates the CSSStyleSheet API but uses text nodes */\nexport class TextTag implements Tag {\n  element: HTMLStyleElement;\n\n  nodes: NodeList<Node>;\n\n  length: number;\n\n  constructor(target?: HTMLElement) {\n    const element = (this.element = makeStyleTag(target));\n    this.nodes = element.childNodes;\n    this.length = 0;\n  }\n\n  insertRule(index: number, rule: string): boolean {\n    if (index <= this.length && index >= 0) {\n      const node = document.createTextNode(rule);\n      const refNode = this.nodes[index];\n      this.element.insertBefore(node, refNode || null);\n      this.length++;\n      return true;\n    } else {\n      return false;\n    }\n  }\n\n  deleteRule(index: number): void {\n    this.element.removeChild(this.nodes[index]);\n    this.length--;\n  }\n\n  getRule(index: number): string {\n    if (index < this.length) {\n      return this.nodes[index].textContent;\n    } else {\n      return '';\n    }\n  }\n}\n\n/** A completely virtual (server-side) Tag that doesn't manipulate the DOM */\nexport class VirtualTag implements Tag {\n  rules: string[];\n\n  length: number;\n\n  constructor(_target?: HTMLElement) {\n    this.rules = [];\n    this.length = 0;\n  }\n\n  insertRule(index: number, rule: string): boolean {\n    if (index <= this.length) {\n      this.rules.splice(index, 0, rule);\n      this.length++;\n      return true;\n    } else {\n      return false;\n    }\n  }\n\n  deleteRule(index: number): void {\n    this.rules.splice(index, 1);\n    this.length--;\n  }\n\n  getRule(index: number): string {\n    if (index < this.length) {\n      return this.rules[index];\n    } else {\n      return '';\n    }\n  }\n}\n","// @flow\nimport { DISABLE_SPEEDY, IS_BROWSER } from '../constants';\nimport { EMPTY_OBJECT } from '../utils/empties';\nimport { makeGroupedTag } from './GroupedTag';\nimport { getGroupForId } from './GroupIDAllocator';\nimport { outputSheet, rehydrateSheet } from './Rehydration';\nimport { makeTag } from './Tag';\nimport type { GroupedTag, Sheet, SheetOptions } from './types';\n\nlet SHOULD_REHYDRATE = IS_BROWSER;\n\ntype SheetConstructorArgs = {\n  isServer?: boolean,\n  useCSSOMInjection?: boolean,\n  target?: HTMLElement,\n};\n\ntype GlobalStylesAllocationMap = { [key: string]: number };\ntype NamesAllocationMap = Map<string, Set<string>>;\n\nconst defaultOptions: SheetOptions = {\n  isServer: !IS_BROWSER,\n  useCSSOMInjection: !DISABLE_SPEEDY,\n};\n\n/** Contains the main stylesheet logic for stringification and caching */\nexport default class StyleSheet implements Sheet {\n  gs: GlobalStylesAllocationMap;\n\n  names: NamesAllocationMap;\n\n  options: SheetOptions;\n\n  server: boolean;\n\n  tag: void | GroupedTag;\n\n  /** Register a group ID to give it an index */\n  static registerId(id: string): number {\n    return getGroupForId(id);\n  }\n\n  constructor(\n    options: SheetConstructorArgs = EMPTY_OBJECT,\n    globalStyles?: GlobalStylesAllocationMap = {},\n    names?: NamesAllocationMap\n  ) {\n    this.options = {\n      ...defaultOptions,\n      ...options,\n    };\n\n    this.gs = globalStyles;\n    this.names = new Map(names);\n    this.server = !!options.isServer;\n\n    // We rehydrate only once and use the sheet that is created first\n    if (!this.server && IS_BROWSER && SHOULD_REHYDRATE) {\n      SHOULD_REHYDRATE = false;\n      rehydrateSheet(this);\n    }\n  }\n\n  reconstructWithOptions(options: SheetConstructorArgs, withNames?: boolean = true) {\n    return new StyleSheet(\n      { ...this.options, ...options },\n      this.gs,\n      (withNames && this.names) || undefined\n    );\n  }\n\n  allocateGSInstance(id: string) {\n    return (this.gs[id] = (this.gs[id] || 0) + 1);\n  }\n\n  /** Lazily initialises a GroupedTag for when it's actually needed */\n  getTag(): GroupedTag {\n    return this.tag || (this.tag = makeGroupedTag(makeTag(this.options)));\n  }\n\n  /** Check whether a name is known for caching */\n  hasNameForId(id: string, name: string): boolean {\n    return this.names.has(id) && (this.names.get(id): any).has(name);\n  }\n\n  /** Mark a group's name as known for caching */\n  registerName(id: string, name: string) {\n    getGroupForId(id);\n\n    if (!this.names.has(id)) {\n      const groupNames = new Set();\n      groupNames.add(name);\n      this.names.set(id, groupNames);\n    } else {\n      (this.names.get(id): any).add(name);\n    }\n  }\n\n  /** Insert new rules which also marks the name as known */\n  insertRules(id: string, name: string, rules: string[]) {\n    this.registerName(id, name);\n    this.getTag().insertRules(getGroupForId(id), rules);\n  }\n\n  /** Clears all cached names for a given group ID */\n  clearNames(id: string) {\n    if (this.names.has(id)) {\n      (this.names.get(id): any).clear();\n    }\n  }\n\n  /** Clears all rules for a given group ID */\n  clearRules(id: string) {\n    this.getTag().clearGroup(getGroupForId(id));\n    this.clearNames(id);\n  }\n\n  /** Clears the entire tag which deletes all rules but not its names */\n  clearTag() {\n    // NOTE: This does not clear the names, since it's only used during SSR\n    // so that we can continuously output only new rules\n    this.tag = undefined;\n  }\n\n  /** Outputs the current sheet as a CSS string with markers for SSR */\n  toString(): string {\n    return outputSheet(this);\n  }\n}\n","// @flow\n/* eslint-disable no-bitwise */\n\nconst AD_REPLACER_R = /(a)(d)/gi;\n\n/* This is the \"capacity\" of our alphabet i.e. 2x26 for all letters plus their capitalised\n * counterparts */\nconst charsLength = 52;\n\n/* start at 75 for 'a' until 'z' (25) and then start at 65 for capitalised letters */\nconst getAlphabeticChar = (code: number): string =>\n  String.fromCharCode(code + (code > 25 ? 39 : 97));\n\n/* input a number, usually a hash and convert it to base-52 */\nexport default function generateAlphabeticName(code: number): string {\n  let name = '';\n  let x;\n\n  /* get a char and divide by alphabet-length */\n  for (x = Math.abs(code); x > charsLength; x = (x / charsLength) | 0) {\n    name = getAlphabeticChar(x % charsLength) + name;\n  }\n\n  return (getAlphabeticChar(x % charsLength) + name).replace(AD_REPLACER_R, '$1-$2');\n}\n","// @flow\n/* eslint-disable */\n\nexport const SEED = 5381;\n\n// When we have separate strings it's useful to run a progressive\n// version of djb2 where we pretend that we're still looping over\n// the same string\nexport const phash = (h: number, x: string): number => {\n  let i = x.length;\n\n  while (i) {\n    h = (h * 33) ^ x.charCodeAt(--i);\n  }\n\n  return h;\n};\n\n// This is a djb2 hashing function\nexport const hash = (x: string): number => {\n  return phash(SEED, x);\n};\n","// @flow\nimport isFunction from './isFunction';\nimport isStyledComponent from './isStyledComponent';\nimport type { RuleSet } from '../types';\n\nexport default function isStaticRules(rules: RuleSet): boolean {\n  for (let i = 0; i < rules.length; i += 1) {\n    const rule = rules[i];\n\n    if (isFunction(rule) && !isStyledComponent(rule)) {\n      // functions are allowed to be static if they're just being\n      // used to get the classname of a nested styled component\n      return false;\n    }\n  }\n\n  return true;\n}\n","// @flow\nimport { SC_VERSION } from '../constants';\nimport StyleSheet from '../sheet';\nimport type { RuleSet, Stringifier } from '../types';\nimport flatten from '../utils/flatten';\nimport generateName from '../utils/generateAlphabeticName';\nimport { hash, phash } from '../utils/hash';\nimport isStaticRules from '../utils/isStaticRules';\n\nconst SEED = hash(SC_VERSION);\n\n/**\n * ComponentStyle is all the CSS-specific stuff, not the React-specific stuff.\n */\nexport default class ComponentStyle {\n  baseHash: number;\n\n  baseStyle: ?ComponentStyle;\n\n  componentId: string;\n\n  isStatic: boolean;\n\n  rules: RuleSet;\n\n  staticRulesId: string;\n\n  constructor(rules: RuleSet, componentId: string, baseStyle?: ComponentStyle) {\n    this.rules = rules;\n    this.staticRulesId = '';\n    this.isStatic = process.env.NODE_ENV === 'production' &&\n      (baseStyle === undefined || baseStyle.isStatic) &&\n      isStaticRules(rules);\n    this.componentId = componentId;\n\n    // SC_VERSION gives us isolation between multiple runtimes on the page at once\n    // this is improved further with use of the babel plugin \"namespace\" feature\n    this.baseHash = phash(SEED, componentId);\n\n    this.baseStyle = baseStyle;\n\n    // NOTE: This registers the componentId, which ensures a consistent order\n    // for this component's styles compared to others\n    StyleSheet.registerId(componentId);\n  }\n\n  /*\n   * Flattens a rule set into valid CSS\n   * Hashes it, wraps the whole chunk in a .hash1234 {}\n   * Returns the hash to be injected on render()\n   * */\n  generateAndInjectStyles(executionContext: Object, styleSheet: StyleSheet, stylis: Stringifier) {\n    const { componentId } = this;\n\n    const names = [];\n\n    if (this.baseStyle) {\n      names.push(this.baseStyle.generateAndInjectStyles(executionContext, styleSheet, stylis));\n    }\n\n    // force dynamic classnames if user-supplied stylis plugins are in use\n    if (this.isStatic && !stylis.hash) {\n      if (this.staticRulesId && styleSheet.hasNameForId(componentId, this.staticRulesId)) {\n        names.push(this.staticRulesId);\n      } else {\n        const cssStatic = flatten(this.rules, executionContext, styleSheet, stylis).join('');\n        const name = generateName(phash(this.baseHash, cssStatic) >>> 0);\n\n        if (!styleSheet.hasNameForId(componentId, name)) {\n          const cssStaticFormatted = stylis(cssStatic, `.${name}`, undefined, componentId);\n\n          styleSheet.insertRules(componentId, name, cssStaticFormatted);\n        }\n\n        names.push(name);\n        this.staticRulesId = name;\n      }\n    } else {\n      const { length } = this.rules;\n      let dynamicHash = phash(this.baseHash, stylis.hash);\n      let css = '';\n\n      for (let i = 0; i < length; i++) {\n        const partRule = this.rules[i];\n\n        if (typeof partRule === 'string') {\n          css += partRule;\n\n          if (process.env.NODE_ENV !== 'production') dynamicHash = phash(dynamicHash, partRule + i);\n        } else if (partRule) {\n          const partChunk = flatten(partRule, executionContext, styleSheet, stylis);\n          const partString = Array.isArray(partChunk) ? partChunk.join('') : partChunk;\n          dynamicHash = phash(dynamicHash, partString + i);\n          css += partString;\n        }\n      }\n\n      if (css) {\n        const name = generateName(dynamicHash >>> 0);\n\n        if (!styleSheet.hasNameForId(componentId, name)) {\n          const cssFormatted = stylis(css, `.${name}`, undefined, componentId);\n          styleSheet.insertRules(componentId, name, cssFormatted);\n        }\n\n        names.push(name);\n      }\n    }\n\n    return names.join(' ');\n  }\n}\n","import Stylis from '@emotion/stylis';\nimport { type Stringifier } from '../types';\nimport { EMPTY_ARRAY, EMPTY_OBJECT } from './empties';\nimport throwStyledError from './error';\nimport { phash, SEED } from './hash';\nimport insertRulePlugin from './stylisPluginInsertRule';\n\nconst COMMENT_REGEX = /^\\s*\\/\\/.*$/gm;\nconst COMPLEX_SELECTOR_PREFIX = [':', '[', '.', '#'];\n\ntype StylisInstanceConstructorArgs = {\n  options?: Object,\n  plugins?: Array<Function>,\n};\n\nexport default function createStylisInstance({\n  options = EMPTY_OBJECT,\n  plugins = EMPTY_ARRAY,\n}: StylisInstanceConstructorArgs = EMPTY_OBJECT) {\n  const stylis = new Stylis(options);\n\n  // Wrap `insertRulePlugin to build a list of rules,\n  // and then make our own plugin to return the rules. This\n  // makes it easier to hook into the existing SSR architecture\n\n  let parsingRules = [];\n\n  // eslint-disable-next-line consistent-return\n  const returnRulesPlugin = context => {\n    if (context === -2) {\n      const parsedRules = parsingRules;\n      parsingRules = [];\n      return parsedRules;\n    }\n  };\n\n  const parseRulesPlugin = insertRulePlugin(rule => {\n    parsingRules.push(rule);\n  });\n\n  let _componentId: string;\n  let _selector: string;\n  let _selectorRegexp: RegExp;\n  let _consecutiveSelfRefRegExp: RegExp;\n\n  const selfReferenceReplacer = (match, offset, string) => {\n    if (\n      // do not replace the first occurrence if it is complex (has a modifier)\n      (offset === 0 ? COMPLEX_SELECTOR_PREFIX.indexOf(string[_selector.length]) === -1 : true) &&\n      // no consecutive self refs (.b.b); that is a precedence boost and treated differently\n      !string.match(_consecutiveSelfRefRegExp)\n    ) {\n      return `.${_componentId}`;\n    }\n\n    return match;\n  };\n\n  /**\n   * When writing a style like\n   *\n   * & + & {\n   *   color: red;\n   * }\n   *\n   * The second ampersand should be a reference to the static component class. stylis\n   * has no knowledge of static class so we have to intelligently replace the base selector.\n   *\n   * https://github.com/thysultan/stylis.js/tree/v3.5.4#plugins <- more info about the context phase values\n   * \"2\" means this plugin is taking effect at the very end after all other processing is complete\n   */\n  const selfReferenceReplacementPlugin = (context, _, selectors) => {\n    if (context === 2 && selectors.length && selectors[0].lastIndexOf(_selector) > 0) {\n      // eslint-disable-next-line no-param-reassign\n      selectors[0] = selectors[0].replace(_selectorRegexp, selfReferenceReplacer);\n    }\n  };\n\n  stylis.use([...plugins, selfReferenceReplacementPlugin, parseRulesPlugin, returnRulesPlugin]);\n\n  function stringifyRules(css, selector, prefix, componentId = '&'): Stringifier {\n    const flatCSS = css.replace(COMMENT_REGEX, '');\n    const cssStr = selector && prefix ? `${prefix} ${selector} { ${flatCSS} }` : flatCSS;\n\n    // stylis has no concept of state to be passed to plugins\n    // but since JS is single-threaded, we can rely on that to ensure\n    // these properties stay in sync with the current stylis run\n    _componentId = componentId;\n    _selector = selector;\n    _selectorRegexp = new RegExp(`\\\\${_selector}\\\\b`, 'g');\n    _consecutiveSelfRefRegExp = new RegExp(`(\\\\${_selector}\\\\b){2,}`);\n\n    return stylis(prefix || !selector ? '' : selector, cssStr);\n  }\n\n  stringifyRules.hash = plugins.length\n    ? plugins\n        .reduce((acc, plugin) => {\n          if (!plugin.name) {\n            throwStyledError(15);\n          }\n\n          return phash(acc, plugin.name);\n        }, SEED)\n        .toString()\n    : '';\n\n  return stringifyRules;\n}\n","/**\n * MIT License\n *\n * Copyright (c) 2016 Sultan Tarimo\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy of\n * this software and associated documentation files (the \"Software\"),\n * to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or\n * sell copies of the Software and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS\n * OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\n * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\n * IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n */\n/* eslint-disable */\n\nexport default function(insertRule) {\n  const delimiter = '/*|*/';\n  const needle = `${delimiter}}`;\n\n  function toSheet(block) {\n    if (block) {\n      try {\n        insertRule(`${block}}`);\n      } catch (e) {}\n    }\n  }\n\n  return function ruleSheet(\n    context,\n    content,\n    selectors,\n    parents,\n    line,\n    column,\n    length,\n    ns,\n    depth,\n    at\n  ) {\n    switch (context) {\n      // property\n      case 1:\n        // @import\n        if (depth === 0 && content.charCodeAt(0) === 64) return insertRule(`${content};`), '';\n        break;\n      // selector\n      case 2:\n        if (ns === 0) return content + delimiter;\n        break;\n      // at-rule\n      case 3:\n        switch (ns) {\n          // @font-face, @page\n          case 102:\n          case 112:\n            return insertRule(selectors[0] + content), '';\n          default:\n            return content + (at === 0 ? delimiter : '');\n        }\n      case -2:\n        content.split(needle).forEach(toSheet);\n    }\n  };\n}\n","// @flow\nimport React, { type Context, type Node, useContext, useEffect, useMemo, useState } from 'react';\nimport shallowequal from 'shallowequal';\nimport StyleSheet from '../sheet';\nimport type { Stringifier } from '../types';\nimport createStylisInstance from '../utils/stylis';\n\ntype Props = {\n  children?: Node,\n  disableCSSOMInjection?: boolean,\n  disableVendorPrefixes?: boolean,\n  sheet?: StyleSheet,\n  stylisPlugins?: Array<Function>,\n  target?: HTMLElement,\n};\n\nexport const StyleSheetContext: Context<StyleSheet | void> = React.createContext();\nexport const StyleSheetConsumer = StyleSheetContext.Consumer;\nexport const StylisContext: Context<Stringifier | void> = React.createContext();\nexport const StylisConsumer = StylisContext.Consumer;\n\nexport const masterSheet: StyleSheet = new StyleSheet();\nexport const masterStylis: Stringifier = createStylisInstance();\n\nexport function useStyleSheet(): StyleSheet {\n  return useContext(StyleSheetContext) || masterSheet;\n}\n\nexport function useStylis(): Stringifier {\n  return useContext(StylisContext) || masterStylis;\n}\n\nexport default function StyleSheetManager(props: Props) {\n  const [plugins, setPlugins] = useState(props.stylisPlugins);\n  const contextStyleSheet = useStyleSheet();\n\n  const styleSheet = useMemo(() => {\n    let sheet = contextStyleSheet;\n\n    if (props.sheet) {\n      // eslint-disable-next-line prefer-destructuring\n      sheet = props.sheet;\n    } else if (props.target) {\n      sheet = sheet.reconstructWithOptions({ target: props.target }, false);\n    }\n\n    if (props.disableCSSOMInjection) {\n      sheet = sheet.reconstructWithOptions({ useCSSOMInjection: false });\n    }\n\n    return sheet;\n  }, [props.disableCSSOMInjection, props.sheet, props.target]);\n\n  const stylis = useMemo(\n    () =>\n      createStylisInstance({\n        options: { prefix: !props.disableVendorPrefixes },\n        plugins,\n      }),\n    [props.disableVendorPrefixes, plugins]\n  );\n\n  useEffect(() => {\n    if (!shallowequal(plugins, props.stylisPlugins)) setPlugins(props.stylisPlugins);\n  }, [props.stylisPlugins]);\n\n  return (\n    <StyleSheetContext.Provider value={styleSheet}>\n      <StylisContext.Provider value={stylis}>\n        {process.env.NODE_ENV !== 'production'\n          ? React.Children.only(props.children)\n          : props.children}\n      </StylisContext.Provider>\n    </StyleSheetContext.Provider>\n  );\n}\n","// @flow\nimport StyleSheet from '../sheet';\nimport { type Stringifier } from '../types';\nimport throwStyledError from '../utils/error';\nimport { masterStylis } from './StyleSheetManager';\n\nexport default class Keyframes {\n  id: string;\n\n  name: string;\n\n  rules: string;\n\n  constructor(name: string, rules: string) {\n    this.name = name;\n    this.id = `sc-keyframes-${name}`;\n    this.rules = rules;\n  }\n\n  inject = (styleSheet: StyleSheet, stylisInstance: Stringifier = masterStylis) => {\n    const resolvedName = this.name + stylisInstance.hash;\n\n    if (!styleSheet.hasNameForId(this.id, resolvedName)) {\n      styleSheet.insertRules(\n        this.id,\n        resolvedName,\n        stylisInstance(this.rules, resolvedName, '@keyframes')\n      );\n    }\n  };\n\n  toString = () => {\n    return throwStyledError(12, String(this.name));\n  };\n\n  getName(stylisInstance: Stringifier = masterStylis) {\n    return this.name + stylisInstance.hash;\n  }\n}\n","// @flow\n\n/**\n * inlined version of\n * https://github.com/facebook/fbjs/blob/master/packages/fbjs/src/core/hyphenateStyleName.js\n */\n\nconst uppercaseCheck = /([A-Z])/;\nconst uppercasePattern = /([A-Z])/g;\nconst msPattern = /^ms-/;\nconst prefixAndLowerCase = (char: string): string => `-${char.toLowerCase()}`;\n\n/**\n * Hyphenates a camelcased CSS property name, for example:\n *\n *   > hyphenateStyleName('backgroundColor')\n *   < \"background-color\"\n *   > hyphenateStyleName('MozTransition')\n *   < \"-moz-transition\"\n *   > hyphenateStyleName('msTransition')\n *   < \"-ms-transition\"\n *\n * As Modernizr suggests (http://modernizr.com/docs/#prefixed), an `ms` prefix\n * is converted to `-ms-`.\n *\n * @param {string} string\n * @return {string}\n */\nexport default function hyphenateStyleName(string: string): string {\n  return uppercaseCheck.test(string)\n  ? string\n    .replace(uppercasePattern, prefixAndLowerCase)\n    .replace(msPattern, '-ms-')\n  : string;\n}\n","// @flow\nimport { isElement } from 'react-is';\nimport getComponentName from './getComponentName';\nimport isFunction from './isFunction';\nimport isStatelessFunction from './isStatelessFunction';\nimport isPlainObject from './isPlainObject';\nimport isStyledComponent from './isStyledComponent';\nimport Keyframes from '../models/Keyframes';\nimport hyphenate from './hyphenateStyleName';\nimport addUnitIfNeeded from './addUnitIfNeeded';\nimport { type Stringifier } from '../types';\n\n/**\n * It's falsish not falsy because 0 is allowed.\n */\nconst isFalsish = chunk => chunk === undefined || chunk === null || chunk === false || chunk === '';\n\nexport const objToCssArray = (obj: Object, prevKey?: string): Array<string | Function> => {\n  const rules = [];\n\n  for (const key in obj) {\n    if (!obj.hasOwnProperty(key) || isFalsish(obj[key])) continue;\n\n    if ((Array.isArray(obj[key]) && obj[key].isCss) || isFunction(obj[key])) {\n      rules.push(`${hyphenate(key)}:`, obj[key], ';');\n    } else if (isPlainObject(obj[key])) {\n      rules.push(...objToCssArray(obj[key], key));\n    } else {\n      rules.push(`${hyphenate(key)}: ${addUnitIfNeeded(key, obj[key])};`);\n    }\n  }\n\n  return prevKey ? [`${prevKey} {`, ...rules, '}'] : rules;\n};\n\nexport default function flatten(\n  chunk: any,\n  executionContext: ?Object,\n  styleSheet: ?Object,\n  stylisInstance: ?Stringifier\n): any {\n  if (Array.isArray(chunk)) {\n    const ruleSet = [];\n\n    for (let i = 0, len = chunk.length, result; i < len; i += 1) {\n      result = flatten(chunk[i], executionContext, styleSheet, stylisInstance);\n\n      if (result === '') continue;\n      else if (Array.isArray(result)) ruleSet.push(...result);\n      else ruleSet.push(result);\n    }\n\n    return ruleSet;\n  }\n\n  if (isFalsish(chunk)) {\n    return '';\n  }\n\n  /* Handle other components */\n  if (isStyledComponent(chunk)) {\n    return `.${chunk.styledComponentId}`;\n  }\n\n  /* Either execute or defer the function */\n  if (isFunction(chunk)) {\n    if (isStatelessFunction(chunk) && executionContext) {\n      const result = chunk(executionContext);\n\n      if (process.env.NODE_ENV !== 'production' && isElement(result)) {\n        // eslint-disable-next-line no-console\n        console.warn(\n          `${getComponentName(\n            chunk\n          )} is not a styled component and cannot be referred to via component selector. See https://www.styled-components.com/docs/advanced#referring-to-other-components for more details.`\n        );\n      }\n\n      return flatten(result, executionContext, styleSheet, stylisInstance);\n    } else return chunk;\n  }\n\n  if (chunk instanceof Keyframes) {\n    if (styleSheet) {\n      chunk.inject(styleSheet, stylisInstance);\n      return chunk.getName(stylisInstance);\n    } else return chunk;\n  }\n\n  /* Handle objects */\n  return isPlainObject(chunk) ? objToCssArray(chunk) : chunk.toString();\n}\n","// @flow\nexport default function isStatelessFunction(test: any): boolean {\n  return (\n    typeof test === 'function'\n    && !(\n      test.prototype\n      && test.prototype.isReactComponent\n    )\n  );\n}\n","// @flow\nimport unitless from '@emotion/unitless';\n\n// Taken from https://github.com/facebook/react/blob/b87aabdfe1b7461e7331abb3601d9e6bb27544bc/packages/react-dom/src/shared/dangerousStyleValue.js\nexport default function addUnitIfNeeded(name: string, value: any): any {\n  // https://github.com/amilajack/eslint-plugin-flowtype-errors/issues/133\n  // $FlowFixMe\n  if (value == null || typeof value === 'boolean' || value === '') {\n    return '';\n  }\n\n  if (typeof value === 'number' && value !== 0 && !(name in unitless) && !name.startsWith('--')) {\n    return `${value}px`; // Presumes implicit 'px' suffix for unitless numbers except for CSS variables\n  }\n\n  return String(value).trim();\n}\n","// @flow\nimport interleave from '../utils/interleave';\nimport isPlainObject from '../utils/isPlainObject';\nimport { EMPTY_ARRAY } from '../utils/empties';\nimport isFunction from '../utils/isFunction';\nimport flatten from '../utils/flatten';\nimport type { Interpolation, RuleSet, Styles } from '../types';\n\n/**\n * Used when flattening object styles to determine if we should\n * expand an array of styles.\n */\nconst addTag = arg => {\n  if (Array.isArray(arg)) {\n    // eslint-disable-next-line no-param-reassign\n    arg.isCss = true;\n  }\n  return arg;\n};\n\nexport default function css(styles: Styles, ...interpolations: Array<Interpolation>): RuleSet {\n  if (isFunction(styles) || isPlainObject(styles)) {\n    // $FlowFixMe\n    return addTag(flatten(interleave(EMPTY_ARRAY, [styles, ...interpolations])));\n  }\n\n  if (interpolations.length === 0 && styles.length === 1 && typeof styles[0] === 'string') {\n    // $FlowFixMe\n    return styles;\n  }\n\n  // $FlowFixMe\n  return addTag(flatten(interleave(styles, interpolations)));\n}\n","// @flow\n\nimport { useRef } from 'react';\n\nconst invalidHookCallRe = /invalid hook call/i;\nconst seen = new Set();\n\nexport const checkDynamicCreation = (displayName: string, componentId?: string) => {\n  if (process.env.NODE_ENV !== 'production') {\n    const parsedIdString = componentId ? ` with the id of \"${componentId}\"` : '';\n    const message =\n      `The component ${displayName}${parsedIdString} has been created dynamically.\\n` +\n      \"You may see this warning because you've called styled inside another component.\\n\" +\n      'To resolve this only create new StyledComponents outside of any render method and function component.';\n\n    // If a hook is called outside of a component:\n    // React 17 and earlier throw an error\n    // React 18 and above use console.error\n\n    const originalConsoleError = console.error // eslint-disable-line no-console\n    try {\n      let didNotCallInvalidHook = true\n      /* $FlowIgnore[cannot-write] */\n      console.error = (consoleErrorMessage, ...consoleErrorArgs) => { // eslint-disable-line no-console\n      // The error here is expected, since we're expecting anything that uses `checkDynamicCreation` to\n      // be called outside of a React component.\n        if (invalidHookCallRe.test(consoleErrorMessage)) {\n          didNotCallInvalidHook = false\n          // This shouldn't happen, but resets `warningSeen` if we had this error happen intermittently\n          seen.delete(message);\n        } else {\n          originalConsoleError(consoleErrorMessage, ...consoleErrorArgs);\n        }\n      }\n      // We purposefully call `useRef` outside of a component and expect it to throw\n      // If it doesn't, then we're inside another component.\n      // eslint-disable-next-line react-hooks/rules-of-hooks\n      useRef();\n\n      if (didNotCallInvalidHook && !seen.has(message)) {\n        // eslint-disable-next-line no-console\n        console.warn(message);\n        seen.add(message);\n      }\n    } catch (error) {\n      // The error here is expected, since we're expecting anything that uses `checkDynamicCreation` to\n      // be called outside of a React component.\n      if (invalidHookCallRe.test(error.message)) {\n        // This shouldn't happen, but resets `warningSeen` if we had this error happen intermittently\n        seen.delete(message);\n      }\n    } finally {\n      /* $FlowIgnore[cannot-write] */\n      console.error = originalConsoleError; // eslint-disable-line no-console\n    }\n  }\n};\n","// @flow\nimport { EMPTY_OBJECT } from './empties';\n\ntype Props = {\n  theme?: any,\n};\n\nexport default (props: Props, providedTheme: any, defaultProps: any = EMPTY_OBJECT) => {\n  return (props.theme !== defaultProps.theme && props.theme) || providedTheme || defaultProps.theme;\n};\n","// @flow\n\n// Source: https://www.w3.org/TR/cssom-1/#serialize-an-identifier\n// Control characters and non-letter first symbols are not supported\nconst escapeRegex = /[!\"#$%&'()*+,./:;<=>?@[\\\\\\]^`{|}~-]+/g;\n\nconst dashesAtEnds = /(^-|-$)/g;\n\n/**\n * TODO: Explore using CSS.escape when it becomes more available\n * in evergreen browsers.\n */\nexport default function escape(str: string): string {\n  return (\n    str\n      // Replace all possible CSS selectors\n      .replace(escapeRegex, '-')\n\n      // Remove extraneous hyphens at the start and end\n      .replace(dashesAtEnds, '')\n  );\n}\n","// @flow\n/* eslint-disable */\nimport generateAlphabeticName from './generateAlphabeticName';\nimport { hash } from './hash';\n\nexport default (str: string): string => {\n  return generateAlphabeticName(hash(str) >>> 0);\n};\n","// @flow\nimport type { IStyledComponent } from '../types';\n\nexport default function isTag(target: $PropertyType<IStyledComponent, 'target'>): boolean %checks {\n  return (\n    typeof target === 'string' &&\n    (process.env.NODE_ENV !== 'production'\n      ? target.charAt(0) === target.charAt(0).toLowerCase()\n      : true)\n  );\n}\n","/* eslint-disable */\n/**\n  mixin-deep; https://github.com/jonschlinkert/mixin-deep\n  Inlined such that it will be consistently transpiled to an IE-compatible syntax.\n\n  The MIT License (MIT)\n\n  Copyright (c) 2014-present, Jon Schlinkert.\n\n  Permission is hereby granted, free of charge, to any person obtaining a copy\n  of this software and associated documentation files (the \"Software\"), to deal\n  in the Software without restriction, including without limitation the rights\n  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n  copies of the Software, and to permit persons to whom the Software is\n  furnished to do so, subject to the following conditions:\n\n  The above copyright notice and this permission notice shall be included in\n  all copies or substantial portions of the Software.\n\n  THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\n  THE SOFTWARE.\n*/\n\nconst isObject = val => {\n  return (\n    typeof val === 'function' || (typeof val === 'object' && val !== null && !Array.isArray(val))\n  );\n};\n\nconst isValidKey = key => {\n  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';\n};\n\nfunction mixin(target, val, key) {\n  const obj = target[key];\n  if (isObject(val) && isObject(obj)) {\n    mixinDeep(obj, val);\n  } else {\n    target[key] = val;\n  }\n}\n\nexport default function mixinDeep(target, ...rest) {\n  for (const obj of rest) {\n    if (isObject(obj)) {\n      for (const key in obj) {\n        if (isValidKey(key)) {\n          mixin(target, obj[key], key);\n        }\n      }\n    }\n  }\n\n  return target;\n}\n","// @flow\nimport React, { useContext, useMemo, type Element, type Context } from 'react';\nimport throwStyledError from '../utils/error';\nimport isFunction from '../utils/isFunction';\n\nexport type Theme = { [key: string]: mixed };\n\ntype ThemeArgument = Theme | ((outerTheme?: Theme) => Theme);\n\ntype Props = {\n  children?: Element<any>,\n  theme: ThemeArgument,\n};\n\nexport const ThemeContext: Context<Theme | void> = React.createContext();\n\nexport const ThemeConsumer = ThemeContext.Consumer;\n\nfunction mergeTheme(theme: ThemeArgument, outerTheme?: Theme): Theme {\n  if (!theme) {\n    return throwStyledError(14);\n  }\n\n  if (isFunction(theme)) {\n    const mergedTheme = theme(outerTheme);\n\n    if (\n      process.env.NODE_ENV !== 'production' &&\n      (mergedTheme === null || Array.isArray(mergedTheme) || typeof mergedTheme !== 'object')\n    ) {\n      return throwStyledError(7);\n    }\n\n    return mergedTheme;\n  }\n\n  if (Array.isArray(theme) || typeof theme !== 'object') {\n    return throwStyledError(8);\n  }\n\n  return outerTheme ? { ...outerTheme, ...theme } : theme;\n}\n\n/**\n * Provide a theme to an entire react component tree via context\n */\nexport default function ThemeProvider(props: Props) {\n  const outerTheme = useContext(ThemeContext);\n  const themeContext = useMemo(() => mergeTheme(props.theme, outerTheme), [\n    props.theme,\n    outerTheme,\n  ]);\n\n  if (!props.children) {\n    return null;\n  }\n\n  return <ThemeContext.Provider value={themeContext}>{props.children}</ThemeContext.Provider>;\n}\n","// @flow\nimport validAttr from '@emotion/is-prop-valid';\nimport hoist from 'hoist-non-react-statics';\nimport React, { createElement, type Ref, useContext } from 'react';\nimport { SC_VERSION } from '../constants';\nimport type {\n  Attrs,\n  IStyledComponent,\n  IStyledStatics,\n  RuleSet,\n  ShouldForwardProp,\n  Target,\n} from '../types';\nimport { checkDynamicCreation } from '../utils/checkDynamicCreation';\nimport createWarnTooManyClasses from '../utils/createWarnTooManyClasses';\nimport determineTheme from '../utils/determineTheme';\nimport { EMPTY_ARRAY, EMPTY_OBJECT } from '../utils/empties';\nimport escape from '../utils/escape';\nimport generateComponentId from '../utils/generateComponentId';\nimport generateDisplayName from '../utils/generateDisplayName';\nimport getComponentName from '../utils/getComponentName';\nimport isFunction from '../utils/isFunction';\nimport isStyledComponent from '../utils/isStyledComponent';\nimport isTag from '../utils/isTag';\nimport joinStrings from '../utils/joinStrings';\nimport merge from '../utils/mixinDeep';\nimport ComponentStyle from './ComponentStyle';\nimport { useStyleSheet, useStylis } from './StyleSheetManager';\nimport { ThemeContext } from './ThemeProvider';\n\nconst identifiers = {};\n\n/* We depend on components having unique IDs */\nfunction generateId(displayName?: string, parentComponentId?: string) {\n  const name = typeof displayName !== 'string' ? 'sc' : escape(displayName);\n  // Ensure that no displayName can lead to duplicate componentIds\n  identifiers[name] = (identifiers[name] || 0) + 1;\n\n  const componentId = `${name}-${generateComponentId(\n    // SC_VERSION gives us isolation between multiple runtimes on the page at once\n    // this is improved further with use of the babel plugin \"namespace\" feature\n    SC_VERSION + name + identifiers[name]\n  )}`;\n\n  return parentComponentId ? `${parentComponentId}-${componentId}` : componentId;\n}\n\nfunction useResolvedAttrs<Config>(theme: any = EMPTY_OBJECT, props: Config, attrs: Attrs) {\n  // NOTE: can't memoize this\n  // returns [context, resolvedAttrs]\n  // where resolvedAttrs is only the things injected by the attrs themselves\n  const context = { ...props, theme };\n  const resolvedAttrs = {};\n\n  attrs.forEach(attrDef => {\n    let resolvedAttrDef = attrDef;\n    let key;\n\n    if (isFunction(resolvedAttrDef)) {\n      resolvedAttrDef = resolvedAttrDef(context);\n    }\n\n    /* eslint-disable guard-for-in */\n    for (key in resolvedAttrDef) {\n      context[key] = resolvedAttrs[key] =\n        key === 'className'\n          ? joinStrings(resolvedAttrs[key], resolvedAttrDef[key])\n          : resolvedAttrDef[key];\n    }\n    /* eslint-enable guard-for-in */\n  });\n\n  return [context, resolvedAttrs];\n}\n\nfunction useInjectedStyle<T>(\n  componentStyle: ComponentStyle,\n  isStatic: boolean,\n  resolvedAttrs: T,\n  warnTooManyClasses?: $Call<typeof createWarnTooManyClasses, string, string>\n) {\n  const styleSheet = useStyleSheet();\n  const stylis = useStylis();\n\n  const className = isStatic\n    ? componentStyle.generateAndInjectStyles(EMPTY_OBJECT, styleSheet, stylis)\n    : componentStyle.generateAndInjectStyles(resolvedAttrs, styleSheet, stylis);\n\n  if (process.env.NODE_ENV !== 'production' && !isStatic && warnTooManyClasses) {\n    warnTooManyClasses(className);\n  }\n\n  return className;\n}\n\nfunction useStyledComponentImpl(\n  forwardedComponent: IStyledComponent,\n  props: Object,\n  forwardedRef: Ref<any>,\n  isStatic: boolean\n) {\n  const {\n    attrs: componentAttrs,\n    componentStyle,\n    defaultProps,\n    foldedComponentIds,\n    shouldForwardProp,\n    styledComponentId,\n    target,\n  } = forwardedComponent;\n\n  // NOTE: the non-hooks version only subscribes to this when !componentStyle.isStatic,\n  // but that'd be against the rules-of-hooks. We could be naughty and do it anyway as it\n  // should be an immutable value, but behave for now.\n  const theme = determineTheme(props, useContext(ThemeContext), defaultProps);\n\n  const [context, attrs] = useResolvedAttrs(theme || EMPTY_OBJECT, props, componentAttrs);\n\n  const generatedClassName = useInjectedStyle(\n    componentStyle,\n    isStatic,\n    context,\n    process.env.NODE_ENV !== 'production' ? forwardedComponent.warnTooManyClasses : undefined\n  );\n\n  const refToForward = forwardedRef;\n\n  const elementToBeCreated: Target = attrs.$as || props.$as || attrs.as || props.as || target;\n\n  const isTargetTag = isTag(elementToBeCreated);\n  const computedProps = attrs !== props ? { ...props, ...attrs } : props;\n  const propsForElement = {};\n\n  // eslint-disable-next-line guard-for-in\n  for (const key in computedProps) {\n    if (key[0] === '$' || key === 'as') continue;\n    else if (key === 'forwardedAs') {\n      propsForElement.as = computedProps[key];\n    } else if (\n      shouldForwardProp\n        ? shouldForwardProp(key, validAttr, elementToBeCreated)\n        : isTargetTag\n        ? validAttr(key)\n        : true\n    ) {\n      // Don't pass through non HTML tags through to HTML elements\n      propsForElement[key] = computedProps[key];\n    }\n  }\n\n  if (props.style && attrs.style !== props.style) {\n    propsForElement.style = { ...props.style, ...attrs.style };\n  }\n\n  propsForElement.className = Array.prototype\n    .concat(\n      foldedComponentIds,\n      styledComponentId,\n      generatedClassName !== styledComponentId ? generatedClassName : null,\n      props.className,\n      attrs.className\n    )\n    .filter(Boolean)\n    .join(' ');\n\n  propsForElement.ref = refToForward;\n\n  return createElement(elementToBeCreated, propsForElement);\n}\n\nexport default function createStyledComponent(\n  target: $PropertyType<IStyledComponent, 'target'>,\n  options: {\n    attrs?: Attrs,\n    componentId: string,\n    displayName?: string,\n    parentComponentId?: string,\n    shouldForwardProp?: ShouldForwardProp,\n  },\n  rules: RuleSet\n) {\n  const isTargetStyledComp = isStyledComponent(target);\n  const isCompositeComponent = !isTag(target);\n\n  const {\n    attrs = EMPTY_ARRAY,\n    componentId = generateId(options.displayName, options.parentComponentId),\n    displayName = generateDisplayName(target),\n  } = options;\n\n  const styledComponentId =\n    options.displayName && options.componentId\n      ? `${escape(options.displayName)}-${options.componentId}`\n      : options.componentId || componentId;\n\n  // fold the underlying StyledComponent attrs up (implicit extend)\n  const finalAttrs =\n    isTargetStyledComp && ((target: any): IStyledComponent).attrs\n      ? Array.prototype.concat(((target: any): IStyledComponent).attrs, attrs).filter(Boolean)\n      : attrs;\n\n  // eslint-disable-next-line prefer-destructuring\n  let shouldForwardProp = options.shouldForwardProp;\n\n  if (isTargetStyledComp && target.shouldForwardProp) {\n    if (options.shouldForwardProp) {\n      // compose nested shouldForwardProp calls\n      shouldForwardProp = (prop, filterFn, elementToBeCreated) =>\n        ((((target: any): IStyledComponent).shouldForwardProp: any): ShouldForwardProp)(\n          prop,\n          filterFn,\n          elementToBeCreated\n        ) &&\n        ((options.shouldForwardProp: any): ShouldForwardProp)(prop, filterFn, elementToBeCreated);\n    } else {\n      // eslint-disable-next-line prefer-destructuring\n      shouldForwardProp = ((target: any): IStyledComponent).shouldForwardProp;\n    }\n  }\n\n  const componentStyle = new ComponentStyle(\n    rules,\n    styledComponentId,\n    isTargetStyledComp ? ((target: Object).componentStyle: ComponentStyle) : undefined\n  );\n\n  // statically styled-components don't need to build an execution context object,\n  // and shouldn't be increasing the number of class names\n  const isStatic = componentStyle.isStatic && attrs.length === 0;\n\n  /**\n   * forwardRef creates a new interim component, which we'll take advantage of\n   * instead of extending ParentComponent to create _another_ interim class\n   */\n  let WrappedStyledComponent: IStyledComponent;\n\n  const forwardRef = (props, ref) =>\n    // eslint-disable-next-line\n    useStyledComponentImpl(WrappedStyledComponent, props, ref, isStatic);\n\n  forwardRef.displayName = displayName;\n\n  WrappedStyledComponent = ((React.forwardRef(forwardRef): any): IStyledComponent);\n  WrappedStyledComponent.attrs = finalAttrs;\n  WrappedStyledComponent.componentStyle = componentStyle;\n  WrappedStyledComponent.displayName = displayName;\n  WrappedStyledComponent.shouldForwardProp = shouldForwardProp;\n\n  // this static is used to preserve the cascade of static classes for component selector\n  // purposes; this is especially important with usage of the css prop\n  WrappedStyledComponent.foldedComponentIds = isTargetStyledComp\n    ? Array.prototype.concat(\n        ((target: any): IStyledComponent).foldedComponentIds,\n        ((target: any): IStyledComponent).styledComponentId\n      )\n    : EMPTY_ARRAY;\n\n  WrappedStyledComponent.styledComponentId = styledComponentId;\n\n  // fold the underlying StyledComponent target up since we folded the styles\n  WrappedStyledComponent.target = isTargetStyledComp\n    ? ((target: any): IStyledComponent).target\n    : target;\n\n  WrappedStyledComponent.withComponent = function withComponent(tag: Target) {\n    const { componentId: previousComponentId, ...optionsToCopy } = options;\n\n    const newComponentId =\n      previousComponentId &&\n      `${previousComponentId}-${isTag(tag) ? tag : escape(getComponentName(tag))}`;\n\n    const newOptions = {\n      ...optionsToCopy,\n      attrs: finalAttrs,\n      componentId: newComponentId,\n    };\n\n    return createStyledComponent(tag, newOptions, rules);\n  };\n\n  Object.defineProperty(WrappedStyledComponent, 'defaultProps', {\n    get() {\n      return this._foldedDefaultProps;\n    },\n\n    set(obj) {\n      this._foldedDefaultProps = isTargetStyledComp\n        ? merge({}, ((target: any): IStyledComponent).defaultProps, obj)\n        : obj;\n    },\n  });\n\n  if (process.env.NODE_ENV !== 'production') {\n    checkDynamicCreation(displayName, styledComponentId);\n\n    WrappedStyledComponent.warnTooManyClasses = createWarnTooManyClasses(\n      displayName,\n      styledComponentId\n    );\n  }\n\n  // If the Object prototype is frozen, the \"toString\" property is non-writable. This means that any objects which inherit this property\n  // cannot have the property changed using an assignment. If using strict mode, attempting that will cause an error. If not using strict\n  // mode, attempting that will be silently ignored.\n  // However, we can still explicitly shadow the prototype's \"toString\" property by defining a new \"toString\" property on this object.\n  Object.defineProperty(WrappedStyledComponent, 'toString', { value: () => `.${WrappedStyledComponent.styledComponentId}` });\n\n  if (isCompositeComponent) {\n    hoist<\n      IStyledStatics,\n      $PropertyType<IStyledComponent, 'target'>,\n      { [key: $Keys<IStyledStatics>]: true }\n    >(WrappedStyledComponent, ((target: any): $PropertyType<IStyledComponent, 'target'>), {\n      // all SC-specific things should not be hoisted\n      attrs: true,\n      componentStyle: true,\n      displayName: true,\n      foldedComponentIds: true,\n      shouldForwardProp: true,\n      styledComponentId: true,\n      target: true,\n      withComponent: true,\n    });\n  }\n\n  return WrappedStyledComponent;\n}\n","// @flow\nimport type { IStyledComponent } from '../types';\nimport getComponentName from './getComponentName';\nimport isTag from './isTag';\n\nexport default function generateDisplayName(\n  target: $PropertyType<IStyledComponent, 'target'>\n): string {\n  return isTag(target) ? `styled.${target}` : `Styled(${getComponentName(target)})`;\n}\n","/**\n * Convenience function for joining strings to form className chains\n */\nexport default function joinStrings(a: ?String, b: ?String): ?String {\n  return a && b ? `${a} ${b}` : a || b;\n}\n","// @flow\n// Thanks to ReactDOMFactories for this handy list!\n\nexport default [\n  'a',\n  'abbr',\n  'address',\n  'area',\n  'article',\n  'aside',\n  'audio',\n  'b',\n  'base',\n  'bdi',\n  'bdo',\n  'big',\n  'blockquote',\n  'body',\n  'br',\n  'button',\n  'canvas',\n  'caption',\n  'cite',\n  'code',\n  'col',\n  'colgroup',\n  'data',\n  'datalist',\n  'dd',\n  'del',\n  'details',\n  'dfn',\n  'dialog',\n  'div',\n  'dl',\n  'dt',\n  'em',\n  'embed',\n  'fieldset',\n  'figcaption',\n  'figure',\n  'footer',\n  'form',\n  'h1',\n  'h2',\n  'h3',\n  'h4',\n  'h5',\n  'h6',\n  'head',\n  'header',\n  'hgroup',\n  'hr',\n  'html',\n  'i',\n  'iframe',\n  'img',\n  'input',\n  'ins',\n  'kbd',\n  'keygen',\n  'label',\n  'legend',\n  'li',\n  'link',\n  'main',\n  'map',\n  'mark',\n  'marquee',\n  'menu',\n  'menuitem',\n  'meta',\n  'meter',\n  'nav',\n  'noscript',\n  'object',\n  'ol',\n  'optgroup',\n  'option',\n  'output',\n  'p',\n  'param',\n  'picture',\n  'pre',\n  'progress',\n  'q',\n  'rp',\n  'rt',\n  'ruby',\n  's',\n  'samp',\n  'script',\n  'section',\n  'select',\n  'small',\n  'source',\n  'span',\n  'strong',\n  'style',\n  'sub',\n  'summary',\n  'sup',\n  'table',\n  'tbody',\n  'td',\n  'textarea',\n  'tfoot',\n  'th',\n  'thead',\n  'time',\n  'title',\n  'tr',\n  'track',\n  'u',\n  'ul',\n  'var',\n  'video',\n  'wbr',\n\n  // SVG\n  'circle',\n  'clipPath',\n  'defs',\n  'ellipse',\n  'foreignObject',\n  'g',\n  'image',\n  'line',\n  'linearGradient',\n  'marker',\n  'mask',\n  'path',\n  'pattern',\n  'polygon',\n  'polyline',\n  'radialGradient',\n  'rect',\n  'stop',\n  'svg',\n  'text',\n  'textPath',\n  'tspan',\n];\n","// @flow\nimport constructWithOptions from './constructWithOptions';\nimport StyledComponent from '../models/StyledComponent';\nimport domElements from '../utils/domElements';\n\nimport type { Target } from '../types';\n\nconst styled = (tag: Target) => constructWithOptions(StyledComponent, tag);\n\n// Shorthands for all valid HTML Elements\ndomElements.forEach(domElement => {\n  styled[domElement] = styled(domElement);\n});\n\nexport default styled;\n","// @flow\nimport { isValidElementType } from 'react-is';\nimport css from './css';\nimport throwStyledError from '../utils/error';\nimport { EMPTY_OBJECT } from '../utils/empties';\n\nimport type { Target } from '../types';\n\nexport default function constructWithOptions(\n  componentConstructor: Function,\n  tag: Target,\n  options: Object = EMPTY_OBJECT\n) {\n  if (!isValidElementType(tag)) {\n    return throwStyledError(1, String(tag));\n  }\n\n  /* This is callable directly as a template function */\n  // $FlowFixMe: Not typed to avoid destructuring arguments\n  const templateFunction = (...args) => componentConstructor(tag, options, css(...args));\n\n  /* If config methods are called, wrap up a new template function and merge options */\n  templateFunction.withConfig = config =>\n    constructWithOptions(componentConstructor, tag, { ...options, ...config });\n\n  /* Modify/inject new props at runtime */\n  templateFunction.attrs = attrs =>\n    constructWithOptions(componentConstructor, tag, {\n      ...options,\n      attrs: Array.prototype.concat(options.attrs, attrs).filter(Boolean),\n    });\n\n  return templateFunction;\n}\n","// @flow\nimport StyleSheet from '../sheet';\nimport type { RuleSet, Stringifier } from '../types';\nimport flatten from '../utils/flatten';\nimport isStaticRules from '../utils/isStaticRules';\n\nexport default class GlobalStyle {\n  componentId: string;\n\n  isStatic: boolean;\n\n  rules: RuleSet;\n\n  constructor(rules: RuleSet, componentId: string) {\n    this.rules = rules;\n    this.componentId = componentId;\n    this.isStatic = isStaticRules(rules);\n\n    // pre-register the first instance to ensure global styles\n    // load before component ones\n    StyleSheet.registerId(this.componentId + 1);\n  }\n\n  createStyles(\n    instance: number,\n    executionContext: Object,\n    styleSheet: StyleSheet,\n    stylis: Stringifier\n  ) {\n    const flatCSS = flatten(this.rules, executionContext, styleSheet, stylis);\n    const css = stylis(flatCSS.join(''), '');\n    const id = this.componentId + instance;\n\n    // NOTE: We use the id as a name as well, since these rules never change\n    styleSheet.insertRules(id, id, css);\n  }\n\n  removeStyles(instance: number, styleSheet: StyleSheet) {\n    styleSheet.clearRules(this.componentId + instance);\n  }\n\n  renderStyles(\n    instance: number,\n    executionContext: Object,\n    styleSheet: StyleSheet,\n    stylis: Stringifier\n  ) {\n    if (instance > 2) StyleSheet.registerId(this.componentId + instance);\n\n    // NOTE: Remove old styles, then inject the new ones\n    this.removeStyles(instance, styleSheet);\n    this.createStyles(instance, executionContext, styleSheet, stylis);\n  }\n}\n","// @flow\n/* eslint-disable no-underscore-dangle */\nimport React from 'react';\nimport { IS_BROWSER, SC_ATTR, SC_ATTR_VERSION, SC_VERSION } from '../constants';\nimport throwStyledError from '../utils/error';\nimport getNonce from '../utils/nonce';\nimport StyleSheet from '../sheet';\nimport StyleSheetManager from './StyleSheetManager';\n\ndeclare var __SERVER__: boolean;\n\nconst CLOSING_TAG_R = /^\\s*<\\/[a-z]/i;\n\nexport default class ServerStyleSheet {\n  isStreaming: boolean;\n\n  instance: StyleSheet;\n\n  sealed: boolean;\n\n  constructor() {\n    this.instance = new StyleSheet({ isServer: true });\n    this.sealed = false;\n  }\n\n  _emitSheetCSS = (): string => {\n    const css = this.instance.toString();\n    if (!css) return '';\n\n    const nonce = getNonce();\n    const attrs = [nonce && `nonce=\"${nonce}\"`, `${SC_ATTR}=\"true\"`, `${SC_ATTR_VERSION}=\"${SC_VERSION}\"`];\n    const htmlAttr = attrs.filter(Boolean).join(' ');\n\n    return `<style ${htmlAttr}>${css}</style>`;\n  };\n\n  collectStyles(children: any) {\n    if (this.sealed) {\n      return throwStyledError(2);\n    }\n\n    return <StyleSheetManager sheet={this.instance}>{children}</StyleSheetManager>;\n  }\n\n  getStyleTags = (): string => {\n    if (this.sealed) {\n      return throwStyledError(2);\n    }\n\n    return this._emitSheetCSS();\n  };\n\n  getStyleElement = () => {\n    if (this.sealed) {\n      return throwStyledError(2);\n    }\n\n    const props = {\n      [SC_ATTR]: '',\n      [SC_ATTR_VERSION]: SC_VERSION,\n      dangerouslySetInnerHTML: {\n        __html: this.instance.toString(),\n      },\n    };\n\n    const nonce = getNonce();\n    if (nonce) {\n      (props: any).nonce = nonce;\n    }\n\n    // v4 returned an array for this fn, so we'll do the same for v5 for backward compat\n    return [<style {...props} key=\"sc-0-0\" />];\n  };\n\n  // eslint-disable-next-line consistent-return\n  interleaveWithNodeStream(input: any) {\n    if (!__SERVER__ || IS_BROWSER) {\n      return throwStyledError(3);\n    } else if (this.sealed) {\n      return throwStyledError(2);\n    }\n\n    if (__SERVER__) {\n      this.seal();\n\n      // eslint-disable-next-line global-require\n      const { Readable, Transform } = require('stream');\n\n      const readableStream: Readable = input;\n      const { instance: sheet, _emitSheetCSS } = this;\n\n      const transformer = new Transform({\n        transform: function appendStyleChunks(chunk, /* encoding */ _, callback) {\n          // Get the chunk and retrieve the sheet's CSS as an HTML chunk,\n          // then reset its rules so we get only new ones for the next chunk\n          const renderedHtml = chunk.toString();\n          const html = _emitSheetCSS();\n\n          sheet.clearTag();\n\n          // prepend style html to chunk, unless the start of the chunk is a\n          // closing tag in which case append right after that\n          if (CLOSING_TAG_R.test(renderedHtml)) {\n            const endOfClosingTag = renderedHtml.indexOf('>') + 1;\n            const before = renderedHtml.slice(0, endOfClosingTag);\n            const after = renderedHtml.slice(endOfClosingTag);\n\n            this.push(before + html + after);\n          } else {\n            this.push(html + renderedHtml);\n          }\n\n          callback();\n        },\n      });\n\n      readableStream.on('error', err => {\n        // forward the error to the transform stream\n        transformer.emit('error', err);\n      });\n\n      return readableStream.pipe(transformer);\n    }\n  }\n\n  seal = () => {\n    this.sealed = true;\n  };\n}\n","// @flow\n/* Import singletons */\nimport isStyledComponent from './utils/isStyledComponent';\nimport css from './constructors/css';\nimport createGlobalStyle from './constructors/createGlobalStyle';\nimport keyframes from './constructors/keyframes';\nimport ServerStyleSheet from './models/ServerStyleSheet';\nimport { SC_VERSION } from './constants';\n\nimport StyleSheetManager, {\n  StyleSheetContext,\n  StyleSheetConsumer,\n} from './models/StyleSheetManager';\n\n/* Import components */\nimport ThemeProvider, { ThemeContext, ThemeConsumer } from './models/ThemeProvider';\n\n/* Import Higher Order Components */\nimport withTheme from './hoc/withTheme';\n\n/* Import hooks */\nimport useTheme from './hooks/useTheme';\n\ndeclare var __SERVER__: boolean;\n\n/* Warning if you've imported this file on React Native */\nif (\n  process.env.NODE_ENV !== 'production' &&\n  typeof navigator !== 'undefined' &&\n  navigator.product === 'ReactNative'\n) {\n  // eslint-disable-next-line no-console\n  console.warn(\n    \"It looks like you've imported 'styled-components' on React Native.\\n\" +\n      \"Perhaps you're looking to import 'styled-components/native'?\\n\" +\n      'Read more about this at https://www.styled-components.com/docs/basics#react-native'\n  );\n}\n\n/* Warning if there are several instances of styled-components */\nif (process.env.NODE_ENV !== 'production' && process.env.NODE_ENV !== 'test' && typeof window !== 'undefined') {\n  window['__styled-components-init__'] = window['__styled-components-init__'] || 0;\n\n  if (window['__styled-components-init__'] === 1) {\n    // eslint-disable-next-line no-console\n    console.warn(\n      \"It looks like there are several instances of 'styled-components' initialized in this application. \" +\n        'This may cause dynamic styles to not render properly, errors during the rehydration process, ' +\n        'a missing theme prop, and makes your application bigger without good reason.\\n\\n' +\n        'See https://s-c.sh/2BAXzed for more info.'\n    );\n  }\n\n  window['__styled-components-init__'] += 1;\n}\n\n/* Export everything */\nexport * from './secretInternals';\nexport {\n  createGlobalStyle,\n  css,\n  isStyledComponent,\n  keyframes,\n  ServerStyleSheet,\n  StyleSheetConsumer,\n  StyleSheetContext,\n  StyleSheetManager,\n  ThemeConsumer,\n  ThemeContext,\n  ThemeProvider,\n  useTheme,\n  SC_VERSION as version,\n  withTheme,\n};\n","import styled from 'styled-components'\n\nconst parseInlineStyle = (style: string) => {\n  const template = document.createElement('template')\n  template.setAttribute('style', style)\n  return Object.entries(template.style)\n    .filter(([key]) => !/^[0-9]+$/.test(key))\n    .filter(([, value]) => Boolean(value))\n    .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n}\n\nconst StyledButton = styled.a`\n  display: flex;\n  align-items: center;\n  height: 44px;\n  padding: 0 12px;\n  background-color: #54b4cd;\n  border-radius: 8px;\n  font-size: 1rem;\n  font-weight: 700;\n  text-decoration: none;\n  color: #ffffff;\n  position: relative;\n\n  span {\n    margin-bottom: 1px;\n  }\n\n  &:hover {\n    filter: brightness(110%);\n  }\n`\n\nconst HubButton = ({ style }: { style?: string }) => {\n  return (\n    <StyledButton\n      href=\"https://traefik.io/upgrade-traefik\"\n      target=\"_blank\"\n      style={style ? parseInlineStyle(style) : {}}\n    >\n      <span>Upgrade to Traefik Hub</span>\n    </StyledButton>\n  )\n}\n\nexport default HubButton\n","import HubButton from 'components/HubButton'\n\nexport const App = ({ style }: { style?: string }) => {\n  return <HubButton style={style} />\n}\n\nexport default App\n","import type { ComponentType } from 'react'\nimport React from 'react'\nimport ReactDOM from 'react-dom/client'\nimport { StyleSheetManager } from 'styled-components'\n\ntype BaseProps = { [key: string]: string | undefined }\n\ntype Args<P extends BaseProps> = {\n  name: string\n  component: ComponentType<P>\n  attributes?: string[]\n}\n\n/**\n * Register a custom element that wraps a React component.\n *\n * @param name       - the name of the custom element\n * @param component  - the React component\n */\nexport default function registerCustomElement<P extends BaseProps>({\n  name,\n  component: Component,\n}: Args<P>) {\n  const webComponentClass = class extends HTMLElement {\n    private readonly styleHost: HTMLElement\n    private readonly mountPoint: HTMLElement\n\n    constructor() {\n      super()\n\n      this.styleHost = document.createElement('head')\n      this.mountPoint = document.createElement('div')\n      this.attachShadow({ mode: 'open' })\n    }\n\n    connectedCallback() {\n      if (this.isConnected) {\n        const attrs = Object.assign({}, ...Array.from(this.attributes, ({ name, value }) => ({ [name]: value })))\n\n        this.shadowRoot?.appendChild(this.styleHost)\n        this.shadowRoot?.appendChild(this.mountPoint)\n\n        const mount = ReactDOM.createRoot(this.mountPoint)\n        mount.render(\n          <StyleSheetManager target={this.styleHost}>\n            <Component {...attrs} />\n          </StyleSheetManager>,\n        )\n      }\n    }\n\n    disconnectedCallback() {\n      if (!this.isConnected) {\n        this.shadowRoot?.removeChild(this.mountPoint)\n        this.shadowRoot?.removeChild(this.styleHost)\n      }\n    }\n  }\n\n  customElements.define(name, webComponentClass)\n}\n","import App from 'App'\nimport registerCustomElement from 'utils/register-custom-element'\n\nregisterCustomElement({\n  name: 'hub-button-app',\n  component: App,\n})\n"],"names":["reactIs","require","REACT_STATICS","childContextTypes","contextType","contextTypes","defaultProps","displayName","getDefaultProps","getDerivedStateFromError","getDerivedStateFromProps","mixins","propTypes","type","KNOWN_STATICS","name","length","prototype","caller","callee","arguments","arity","MEMO_STATICS","compare","TYPE_STATICS","getStatics","component","isMemo","ForwardRef","render","Memo","defineProperty","Object","getOwnPropertyNames","getOwnPropertySymbols","getOwnPropertyDescriptor","getPrototypeOf","objectPrototype","module","exports","hoistNonReactStatics","targetComponent","sourceComponent","blacklist","inheritedComponent","keys","concat","targetStatics","sourceStatics","i","key","descriptor","e","b","Symbol","for","c","d","f","g","h","k","l","m","n","p","q","r","t","v","w","x","y","z","a","u","$$typeof","A","AsyncMode","ConcurrentMode","ContextConsumer","ContextProvider","Element","Fragment","Lazy","Portal","Profiler","StrictMode","Suspense","isAsyncMode","isConcurrentMode","isContextConsumer","isContextProvider","isElement","isForwardRef","isFragment","isLazy","isPortal","isProfiler","isStrictMode","isSuspense","isValidElementType","typeOf","aa","ca","encodeURIComponent","da","Set","ea","fa","ha","add","ia","window","document","createElement","ja","hasOwnProperty","ka","la","ma","this","acceptsBooleans","attributeName","attributeNamespace","mustUseProperty","propertyName","sanitizeURL","removeEmptyString","split","forEach","toLowerCase","ra","sa","toUpperCase","ta","slice","pa","isNaN","qa","call","test","oa","removeAttribute","setAttribute","setAttributeNS","replace","xlinkHref","ua","__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED","va","wa","ya","za","Aa","Ba","Ca","Da","Ea","Fa","Ga","Ha","Ia","Ja","iterator","Ka","La","assign","Ma","Error","stack","trim","match","Na","Oa","prepareStackTrace","set","Reflect","construct","includes","Pa","tag","Qa","_context","_payload","_init","Ra","Sa","Ta","nodeName","Va","_valueTracker","constructor","get","configurable","enumerable","getValue","setValue","stopTracking","Ua","Wa","checked","value","Xa","activeElement","body","Ya","defaultChecked","defaultValue","_wrapperState","initialChecked","Za","initialValue","controlled","ab","bb","cb","db","ownerDocument","eb","Array","isArray","fb","options","selected","defaultSelected","disabled","gb","dangerouslySetInnerHTML","children","hb","ib","jb","textContent","kb","lb","mb","nb","namespaceURI","innerHTML","valueOf","toString","firstChild","removeChild","appendChild","MSApp","execUnsafeLocalFunction","ob","lastChild","nodeType","nodeValue","pb","animationIterationCount","aspectRatio","borderImageOutset","borderImageSlice","borderImageWidth","boxFlex","boxFlexGroup","boxOrdinalGroup","columnCount","columns","flex","flexGrow","flexPositive","flexShrink","flexNegative","flexOrder","gridArea","gridRow","gridRowEnd","gridRowSpan","gridRowStart","gridColumn","gridColumnEnd","gridColumnSpan","gridColumnStart","fontWeight","lineClamp","lineHeight","opacity","order","orphans","tabSize","widows","zIndex","zoom","fillOpacity","floodOpacity","stopOpacity","strokeDasharray","strokeDashoffset","strokeMiterlimit","strokeOpacity","strokeWidth","qb","rb","sb","style","indexOf","setProperty","charAt","substring","tb","menuitem","area","base","br","col","embed","hr","img","input","keygen","link","meta","param","source","track","wbr","ub","vb","is","wb","xb","target","srcElement","correspondingUseElement","parentNode","yb","zb","Ab","Bb","Cb","stateNode","Db","Eb","push","Fb","Gb","Hb","Ib","Jb","Kb","Lb","Mb","addEventListener","removeEventListener","Nb","apply","onError","Ob","Pb","Qb","Rb","Sb","Tb","Vb","alternate","return","flags","Wb","memoizedState","dehydrated","Xb","Zb","child","sibling","current","Yb","$b","ac","unstable_scheduleCallback","bc","unstable_cancelCallback","cc","unstable_shouldYield","dc","unstable_requestPaint","B","unstable_now","ec","unstable_getCurrentPriorityLevel","fc","unstable_ImmediatePriority","gc","unstable_UserBlockingPriority","hc","unstable_NormalPriority","ic","unstable_LowPriority","jc","unstable_IdlePriority","kc","lc","oc","Math","clz32","pc","qc","log","LN2","rc","sc","tc","uc","pendingLanes","suspendedLanes","pingedLanes","entangledLanes","entanglements","vc","xc","yc","zc","Ac","eventTimes","Cc","C","Dc","Ec","Fc","Gc","Hc","Ic","Jc","Kc","Lc","Mc","Nc","Oc","Map","Pc","Qc","Rc","Sc","delete","pointerId","Tc","nativeEvent","blockedOn","domEventName","eventSystemFlags","targetContainers","Vc","Wc","priority","isDehydrated","containerInfo","Xc","Yc","dispatchEvent","shift","Zc","$c","ad","bd","cd","ReactCurrentBatchConfig","dd","ed","transition","fd","gd","hd","id","Uc","stopPropagation","jd","kd","ld","md","nd","od","keyCode","charCode","pd","qd","rd","_reactName","_targetInst","currentTarget","isDefaultPrevented","defaultPrevented","returnValue","isPropagationStopped","preventDefault","cancelBubble","persist","isPersistent","wd","xd","yd","sd","eventPhase","bubbles","cancelable","timeStamp","Date","now","isTrusted","td","ud","view","detail","vd","Ad","screenX","screenY","clientX","clientY","pageX","pageY","ctrlKey","shiftKey","altKey","metaKey","getModifierState","zd","button","buttons","relatedTarget","fromElement","toElement","movementX","movementY","Bd","Dd","dataTransfer","Fd","Hd","animationName","elapsedTime","pseudoElement","Id","clipboardData","Jd","Ld","data","Md","Esc","Spacebar","Left","Up","Right","Down","Del","Win","Menu","Apps","Scroll","MozPrintableKey","Nd","Od","Alt","Control","Meta","Shift","Pd","Qd","String","fromCharCode","code","location","repeat","locale","which","Rd","Td","width","height","pressure","tangentialPressure","tiltX","tiltY","twist","pointerType","isPrimary","Vd","touches","targetTouches","changedTouches","Xd","Yd","deltaX","wheelDeltaX","deltaY","wheelDeltaY","wheelDelta","deltaZ","deltaMode","Zd","$d","ae","be","documentMode","ce","de","ee","fe","ge","he","ie","le","color","date","datetime","email","month","number","password","range","search","tel","text","time","url","week","me","ne","oe","event","listeners","pe","qe","re","se","te","ue","ve","we","xe","ye","ze","oninput","Ae","detachEvent","Be","Ce","attachEvent","De","Ee","Fe","He","Ie","Je","Ke","node","offset","nextSibling","Le","contains","compareDocumentPosition","Me","HTMLIFrameElement","contentWindow","href","Ne","contentEditable","Oe","focusedElem","selectionRange","documentElement","start","end","selectionStart","selectionEnd","min","defaultView","getSelection","extend","rangeCount","anchorNode","anchorOffset","focusNode","focusOffset","createRange","setStart","removeAllRanges","addRange","setEnd","element","left","scrollLeft","top","scrollTop","focus","Pe","Qe","Re","Se","Te","Ue","Ve","We","animationend","animationiteration","animationstart","transitionend","Xe","Ye","Ze","animation","$e","af","bf","cf","df","ef","ff","gf","hf","lf","mf","nf","Ub","instance","listener","D","of","has","pf","qf","rf","random","sf","bind","capture","passive","J","F","tf","uf","parentWindow","vf","wf","na","xa","$a","ba","je","char","ke","unshift","xf","yf","zf","Af","Bf","Cf","Df","Ef","__html","Ff","setTimeout","Gf","clearTimeout","Hf","Promise","Jf","queueMicrotask","resolve","then","catch","If","Kf","Lf","Mf","previousSibling","Nf","Of","Pf","Qf","Rf","Sf","Tf","Uf","E","G","Vf","H","Wf","Xf","Yf","__reactInternalMemoizedUnmaskedChildContext","__reactInternalMemoizedMaskedChildContext","Zf","$f","ag","bg","getChildContext","cg","__reactInternalMemoizedMergedChildContext","dg","eg","fg","gg","hg","jg","kg","lg","mg","ng","og","pg","qg","rg","sg","tg","ug","vg","wg","xg","yg","I","zg","Ag","Bg","elementType","deletions","Cg","pendingProps","overflow","treeContext","retryLane","Dg","mode","Eg","Fg","Gg","memoizedProps","Hg","Ig","Jg","Kg","Lg","Mg","Ng","Og","Pg","Qg","Rg","_currentValue","Sg","childLanes","Tg","dependencies","firstContext","lanes","Ug","Vg","context","memoizedValue","next","Wg","Xg","Yg","interleaved","Zg","$g","ah","updateQueue","baseState","firstBaseUpdate","lastBaseUpdate","shared","pending","effects","bh","ch","eventTime","lane","payload","callback","dh","K","eh","fh","gh","hh","ih","jh","Component","refs","kh","nh","isMounted","_reactInternals","enqueueSetState","L","lh","mh","enqueueReplaceState","enqueueForceUpdate","oh","shouldComponentUpdate","isPureReactComponent","ph","state","updater","qh","componentWillReceiveProps","UNSAFE_componentWillReceiveProps","rh","props","getSnapshotBeforeUpdate","UNSAFE_componentWillMount","componentWillMount","componentDidMount","sh","ref","_owner","_stringRef","th","join","uh","vh","index","wh","xh","yh","implementation","zh","Ah","done","Bh","Ch","Dh","Eh","Fh","Gh","Hh","Ih","tagName","Jh","Kh","Lh","M","Mh","revealOrder","Nh","Oh","_workInProgressVersionPrimary","Ph","ReactCurrentDispatcher","Qh","Rh","N","O","P","Sh","Th","Uh","Vh","Q","Wh","Xh","Yh","Zh","$h","ai","bi","ci","baseQueue","queue","di","ei","fi","lastRenderedReducer","action","hasEagerState","eagerState","lastRenderedState","dispatch","gi","hi","ii","ji","ki","getSnapshot","li","mi","R","ni","lastEffect","stores","oi","pi","qi","ri","create","destroy","deps","si","ti","ui","vi","wi","xi","yi","zi","Ai","Bi","Ci","Di","Ei","Fi","Gi","Hi","Ii","Ji","readContext","useCallback","useContext","useEffect","useImperativeHandle","useInsertionEffect","useLayoutEffect","useMemo","useReducer","useRef","useState","useDebugValue","useDeferredValue","useTransition","useMutableSource","useSyncExternalStore","useId","unstable_isNewReconciler","identifierPrefix","Ki","message","digest","Li","Mi","console","error","Ni","WeakMap","Oi","Pi","Qi","Ri","componentDidCatch","Si","componentStack","Ti","pingCache","Ui","Vi","Wi","Xi","ReactCurrentOwner","Yi","Zi","$i","aj","bj","cj","dj","ej","baseLanes","cachePool","transitions","fj","gj","hj","ij","jj","UNSAFE_componentWillUpdate","componentWillUpdate","componentDidUpdate","kj","lj","pendingContext","mj","Aj","Bj","Cj","Dj","nj","oj","pj","fallback","qj","rj","tj","dataset","dgst","uj","vj","_reactRetry","sj","subtreeFlags","wj","xj","isBackwards","rendering","renderingStartTime","last","tail","tailMode","yj","Ej","S","Fj","Gj","wasMultiple","multiple","suppressHydrationWarning","onClick","onclick","size","createElementNS","autoFocus","createTextNode","T","Hj","Ij","Jj","Kj","U","Lj","WeakSet","V","Mj","W","Nj","Oj","Qj","Rj","Sj","Tj","Uj","Vj","Wj","insertBefore","_reactRootContainer","Xj","X","Yj","Zj","ak","onCommitFiberUnmount","componentWillUnmount","bk","ck","dk","ek","fk","isHidden","gk","hk","display","ik","jk","kk","lk","__reactInternalSnapshotBeforeUpdate","src","Wk","mk","ceil","nk","ok","pk","Y","Z","qk","rk","sk","tk","uk","Infinity","vk","wk","xk","yk","zk","Ak","Bk","Ck","Dk","Ek","callbackNode","expirationTimes","expiredLanes","wc","callbackPriority","ig","Fk","Gk","Hk","Ik","Jk","Kk","Lk","Mk","Nk","Ok","Pk","finishedWork","finishedLanes","Qk","timeoutHandle","Rk","Sk","Tk","Uk","Vk","mutableReadLanes","Bc","Pj","onCommitFiberRoot","mc","onRecoverableError","Xk","onPostCommitFiberRoot","Yk","Zk","al","isReactComponent","pendingChildren","bl","mutableSourceEagerHydrationData","cl","cache","pendingSuspenseBoundaries","el","fl","gl","hl","il","jl","zj","$k","ll","reportError","ml","_internalRoot","nl","ol","pl","ql","sl","rl","unmount","unstable_scheduleHydration","splice","querySelectorAll","JSON","stringify","form","tl","usingClientEntryPoint","Events","ul","findFiberByHostInstance","bundleType","version","rendererPackageName","vl","rendererConfig","overrideHookState","overrideHookStateDeletePath","overrideHookStateRenamePath","overrideProps","overridePropsDeletePath","overridePropsRenamePath","setErrorHandler","setSuspenseHandler","scheduleUpdate","currentDispatcherRef","findHostInstanceByFiber","findHostInstancesForRefresh","scheduleRefresh","scheduleRoot","setRefreshHandler","getCurrentFiber","reconcilerVersion","__REACT_DEVTOOLS_GLOBAL_HOOK__","wl","isDisabled","supportsFiber","inject","createPortal","dl","createRoot","unstable_strictMode","findDOMNode","flushSync","hydrate","hydrateRoot","hydratedSources","_getVersion","_source","unmountComponentAtNode","unstable_batchedUpdates","unstable_renderSubtreeIntoContainer","checkDCE","err","getModuleId","__self","__source","jsx","setState","forceUpdate","escape","_status","_result","default","Children","map","count","toArray","only","PureComponent","cloneElement","createContext","_currentValue2","_threadCount","Provider","Consumer","_defaultValue","_globalName","createFactory","createRef","forwardRef","isValidElement","lazy","memo","startTransition","unstable_act","pop","sortIndex","performance","setImmediate","startTime","expirationTime","priorityLevel","navigator","scheduling","isInputPending","MessageChannel","port2","port1","onmessage","postMessage","unstable_Profiling","unstable_continueExecution","unstable_forceFrameRate","floor","unstable_getFirstCallbackNode","unstable_next","unstable_pauseExecution","unstable_runWithPriority","delay","unstable_wrapCallback","objA","objB","compareContext","ret","keysA","keysB","bHasOwnProperty","idx","valueA","valueB","__webpack_module_cache__","__webpack_require__","moduleId","cachedModule","undefined","__webpack_modules__","getter","__esModule","definition","o","obj","prop","nc","charCodeAt","prefix","use","msGridRow","msGridRowSpan","msGridColumn","msGridColumnSpan","WebkitLineClamp","memoize","fn","arg","reactPropsRegex","isPropValid","freeze","_","styledComponentId","process","REACT_APP_SC_ATTR","SC_ATTR","Boolean","SC_DISABLE_SPEEDY","REACT_APP_SC_DISABLE_SPEEDY","j","groupSizes","Uint32Array","indexOfGroup","insertRules","s","insertRule","clearGroup","deleteRule","getGroup","getRule","RegExp","registerName","parseInt","getTag","__webpack_nonce__","head","childNodes","hasAttribute","sheet","styleSheets","ownerNode","cssRules","cssText","$","nodes","rules","isServer","useCSSOMInjection","gs","names","server","getAttribute","registerId","reconstructWithOptions","allocateGSInstance","hasNameForId","clearNames","clear","clearRules","clearTag","abs","staticRulesId","isStatic","componentId","baseHash","baseStyle","generateAndInjectStyles","hash","_e","plugins","lastIndexOf","reduce","stylisPlugins","disableCSSOMInjection","disableVendorPrefixes","getName","isCss","startsWith","theme","attrs","parentComponentId","filter","shouldForwardProp","componentStyle","foldedComponentIds","$as","as","className","withComponent","_foldedDefaultProps","withConfig","createStyles","removeStyles","renderStyles","_emitSheetCSS","getStyleTags","sealed","getStyleElement","nonce","seal","collectStyles","interleaveWithNodeStream","parseInlineStyle","template","entries","_ref","_ref2","acc","_ref3","StyledButton","styled","_ref4","_jsx","HubButton","webComponentClass","HTMLElement","super","styleHost","mountPoint","attachShadow","connectedCallback","isConnected","_this$shadowRoot","_this$shadowRoot2","from","attributes","shadowRoot","ReactDOM","StyleSheetManager","disconnectedCallback","_this$shadowRoot3","_this$shadowRoot4","customElements","define","registerCustomElement","App"],"sourceRoot":""}
\ No newline at end of file
diff --git a/webui/src/App.tsx b/webui/src/App.tsx
index a3dd0e387..8e256437f 100644
--- a/webui/src/App.tsx
+++ b/webui/src/App.tsx
@@ -1,5 +1,5 @@
-import { Box, darkTheme, FaencyProvider, lightTheme } from '@traefiklabs/faency'
-import { Suspense, useEffect } from 'react'
+import { globalCss, Box, darkTheme, FaencyProvider, lightTheme } from '@traefiklabs/faency'
+import { Suspense, useContext, useEffect } from 'react'
 import { HelmetProvider } from 'react-helmet-async'
 import { HashRouter, Navigate, Route, Routes as RouterRoutes, useLocation } from 'react-router-dom'
 import { SWRConfig } from 'swr'
@@ -12,6 +12,7 @@ import { useIsDarkMode } from 'hooks/use-theme'
 import ErrorSuspenseWrapper from 'layout/ErrorSuspenseWrapper'
 import { Dashboard, HTTPPages, NotFound, TCPPages, UDPPages } from 'pages'
 import { DashboardSkeleton } from 'pages/dashboard/Dashboard'
+import { HubDemoContext, HubDemoProvider } from 'pages/hub-demo/demoNavContext'
 
 export const LIGHT_THEME = lightTheme('blue')
 export const DARK_THEME = darkTheme('blue')
@@ -33,44 +34,59 @@ const ScrollToTop = () => {
 }
 
 export const Routes = () => {
+  const { routes: hubDemoRoutes } = useContext(HubDemoContext)
+
   return (
-    <Suspense fallback={<PageLoader />}>
-      <RouterRoutes>
-        <Route
-          path="/"
-          element={
-            <ErrorSuspenseWrapper suspenseFallback={<DashboardSkeleton />}>
-              <Dashboard />
-            </ErrorSuspenseWrapper>
-          }
-        />
-        <Route path="/http/routers" element={<HTTPPages.HttpRouters />} />
-        <Route path="/http/services" element={<HTTPPages.HttpServices />} />
-        <Route path="/http/middlewares" element={<HTTPPages.HttpMiddlewares />} />
-        <Route path="/tcp/routers" element={<TCPPages.TcpRouters />} />
-        <Route path="/tcp/services" element={<TCPPages.TcpServices />} />
-        <Route path="/tcp/middlewares" element={<TCPPages.TcpMiddlewares />} />
-        <Route path="/udp/routers" element={<UDPPages.UdpRouters />} />
-        <Route path="/udp/services" element={<UDPPages.UdpServices />} />
-        <Route path="/http/routers/:name" element={<HTTPPages.HttpRouter />} />
-        <Route path="/http/services/:name" element={<HTTPPages.HttpService />} />
-        <Route path="/http/middlewares/:name" element={<HTTPPages.HttpMiddleware />} />
-        <Route path="/tcp/routers/:name" element={<TCPPages.TcpRouter />} />
-        <Route path="/tcp/services/:name" element={<TCPPages.TcpService />} />
-        <Route path="/tcp/middlewares/:name" element={<TCPPages.TcpMiddleware />} />
-        <Route path="/udp/routers/:name" element={<UDPPages.UdpRouter />} />
-        <Route path="/udp/services/:name" element={<UDPPages.UdpService />} />
-        <Route path="/http" element={<Navigate to="/http/routers" replace />} />
-        <Route path="/tcp" element={<Navigate to="/tcp/routers" replace />} />
-        <Route path="/udp" element={<Navigate to="/udp/routers" replace />} />
-        <Route path="*" element={<NotFound />} />
-      </RouterRoutes>
-    </Suspense>
+    <Page>
+      <Suspense fallback={<PageLoader />}>
+        <RouterRoutes>
+          <Route
+            path="/"
+            element={
+              <ErrorSuspenseWrapper suspenseFallback={<DashboardSkeleton />}>
+                <Dashboard />
+              </ErrorSuspenseWrapper>
+            }
+          />
+          <Route path="/http/routers" element={<HTTPPages.HttpRouters />} />
+          <Route path="/http/services" element={<HTTPPages.HttpServices />} />
+          <Route path="/http/middlewares" element={<HTTPPages.HttpMiddlewares />} />
+          <Route path="/tcp/routers" element={<TCPPages.TcpRouters />} />
+          <Route path="/tcp/services" element={<TCPPages.TcpServices />} />
+          <Route path="/tcp/middlewares" element={<TCPPages.TcpMiddlewares />} />
+          <Route path="/udp/routers" element={<UDPPages.UdpRouters />} />
+          <Route path="/udp/services" element={<UDPPages.UdpServices />} />
+          <Route path="/http/routers/:name" element={<HTTPPages.HttpRouter />} />
+          <Route path="/http/services/:name" element={<HTTPPages.HttpService />} />
+          <Route path="/http/middlewares/:name" element={<HTTPPages.HttpMiddleware />} />
+          <Route path="/tcp/routers/:name" element={<TCPPages.TcpRouter />} />
+          <Route path="/tcp/services/:name" element={<TCPPages.TcpService />} />
+          <Route path="/tcp/middlewares/:name" element={<TCPPages.TcpMiddleware />} />
+          <Route path="/udp/routers/:name" element={<UDPPages.UdpRouter />} />
+          <Route path="/udp/services/:name" element={<UDPPages.UdpService />} />
+          <Route path="/http" element={<Navigate to="/http/routers" replace />} />
+          <Route path="/tcp" element={<Navigate to="/tcp/routers" replace />} />
+          <Route path="/udp" element={<Navigate to="/udp/routers" replace />} />
+
+          {/* Hub Dashboard demo content */}
+          {hubDemoRoutes?.map((route, idx) => <Route key={`hub-${idx}`} path={route.path} element={route.element} />)}
+
+          <Route path="*" element={<NotFound />} />
+        </RouterRoutes>
+      </Suspense>
+    </Page>
   )
 }
 
 const isDev = import.meta.env.NODE_ENV === 'development'
 
+const customGlobalStyle = globalCss({
+  // target the AriaTd component, but exclude anything inside hub-ui-demo-app
+  'body:not(:has(hub-ui-demo-app)) span[role=cell]': {
+    p: '$2 $3',
+  },
+})
+
 const App = () => {
   const isDarkMode = useIsDarkMode()
 
@@ -95,8 +111,11 @@ const App = () => {
         >
           <VersionProvider>
             <HashRouter basename={import.meta.env.VITE_APP_BASE_URL || ''}>
-              <ScrollToTop />
-              <Routes />
+              <HubDemoProvider basePath={'/hub-dashboard'}>
+                {customGlobalStyle()}
+                <ScrollToTop />
+                <Routes />
+              </HubDemoProvider>
             </HashRouter>
           </VersionProvider>
         </SWRConfig>
diff --git a/webui/src/components/SpinnerLoader.tsx b/webui/src/components/SpinnerLoader.tsx
index 663130307..e336fc436 100644
--- a/webui/src/components/SpinnerLoader.tsx
+++ b/webui/src/components/SpinnerLoader.tsx
@@ -2,17 +2,17 @@ import { Flex } from '@traefiklabs/faency'
 import { motion } from 'framer-motion'
 import { FiLoader } from 'react-icons/fi'
 
-export const SpinnerLoader = () => (
+export const SpinnerLoader = ({ size = 24 }: { size?: number }) => (
   <motion.div
     animate={{
       rotate: 360,
     }}
     transition={{ ease: 'linear', duration: 1, repeat: Infinity }}
-    style={{ width: 24, height: 24 }}
+    style={{ width: size, height: size }}
     data-testid="loading"
   >
     <Flex css={{ color: '$primary' }}>
-      <FiLoader size={24} />
+      <FiLoader size={size} />
     </Flex>
   </motion.div>
 )
diff --git a/webui/src/components/TableFilter.tsx b/webui/src/components/TableFilter.tsx
index ba0df2152..ab8c01938 100644
--- a/webui/src/components/TableFilter.tsx
+++ b/webui/src/components/TableFilter.tsx
@@ -1,6 +1,4 @@
-import { Box, Button, Flex, TextField } from '@traefiklabs/faency'
-// eslint-disable-next-line import/no-unresolved
-import { InputHandle } from '@traefiklabs/faency/dist/components/Input'
+import { Box, Button, Flex, TextField, InputHandle } from '@traefiklabs/faency'
 import { isUndefined, omitBy } from 'lodash'
 import { useCallback, useRef, useState } from 'react'
 import { FiSearch, FiXCircle } from 'react-icons/fi'
diff --git a/webui/src/components/icons/providers/Knative.tsx b/webui/src/components/icons/providers/Knative.tsx
new file mode 100644
index 000000000..8eaf21d50
--- /dev/null
+++ b/webui/src/components/icons/providers/Knative.tsx
@@ -0,0 +1,13 @@
+import { ProviderIconProps } from 'components/icons/providers'
+
+export default function Knative(props: ProviderIconProps) {
+  return (
+    <svg height="72" width="72" viewBox="-14 0 92 72" xmlns="http://www.w3.org/2000/svg" {...props}>
+      <path
+        d="m30.42 7.074 14.142000000000001 6.8100000000000005 -2.745 4.752000000000001a0.804 0.804 0 0 0 -0.096 0.546l1.821 10.323a0.789 0.789 0 0 0 0.279 0.48l8.028 6.735c0.14400000000000002 0.123 0.33 0.192 0.522 0.192h5.6339999999999995l1.521 6.66a1.476 1.476 0 0 1 -0.28500000000000003 1.2449999999999999l-15.711 19.701a1.4729999999999999 1.4729999999999999 0 0 1 -1.149 0.552h-25.200000000000003a1.4729999999999999 1.4729999999999999 0 0 1 -1.149 -0.552L0.321 44.817a1.476 1.476 0 0 1 -0.28500000000000003 -1.2449999999999999l5.607 -24.567a1.482 1.482 0 0 1 0.798 -0.9990000000000001l22.701 -10.932a1.47 1.47 0 0 1 1.278 0ZM21.732 49.878h5.001v-7.286999999999999l1.92 -2.3520000000000003 5.466 9.639h5.8950000000000005l-7.782 -12.818999999999999 7.386000000000001 -9.507h-6.195l-5.067 7.419c-0.498 0.795 -1.026 1.59 -1.524 2.4509999999999996h-0.099v-9.870000000000001H21.732v22.326ZM57.842999999999996 7.055999999999999l8.925 3.2489999999999997c0.162 0.06 0.29700000000000004 0.17400000000000002 0.384 0.324l4.749 8.225999999999999c0.08700000000000001 0.15000000000000002 0.11699999999999999 0.324 0.08700000000000001 0.495l-1.6500000000000001 9.354a0.729 0.729 0 0 1 -0.249 0.43499999999999994l-7.2780000000000005 6.105a0.735 0.735 0 0 1 -0.471 0.17400000000000002h-9.498a0.738 0.738 0 0 1 -0.474 -0.17400000000000002l-7.2749999999999995 -6.105a0.72 0.72 0 0 1 -0.252 -0.43499999999999994l-1.6500000000000001 -9.354a0.732 0.732 0 0 1 0.08700000000000001 -0.495l4.749 -8.225999999999999a0.735 0.735 0 0 1 0.387 -0.324l8.925 -3.2489999999999997a0.729 0.729 0 0 1 0.504 0Zm-2.13 10.212c-0.096 -0.276 -0.29400000000000004 -0.41100000000000003 -0.591 -0.41100000000000003h-1.4609999999999999V25.71h2.37V19.347c0.264 -0.258 0.54 -0.45899999999999996 0.8340000000000001 -0.6000000000000001a2.082 2.082 0 0 1 0.9359999999999999 -0.21599999999999997c0.44699999999999995 0 0.783 0.135 1.014 0.40800000000000003 0.22799999999999998 0.273 0.342 0.654 0.342 1.146V25.71h2.361V20.085c0 -0.492 -0.063 -0.9450000000000001 -0.192 -1.356a2.964 2.964 0 0 0 -0.5760000000000001 -1.065 2.625 2.625 0 0 0 -0.9390000000000001 -0.6960000000000001 3.6239999999999997 3.6239999999999997 0 0 0 -2.0909999999999997 -0.162 3.5279999999999996 3.5279999999999996 0 0 0 -1.308 0.609 5.868 5.868 0 0 0 -0.552 0.471l-0.14700000000000002 -0.618Z"
+        fill="currentColor"
+        stroke-width="3"
+      />
+    </svg>
+  )
+}
diff --git a/webui/src/components/icons/providers/index.tsx b/webui/src/components/icons/providers/index.tsx
index 388c66090..8745a7644 100644
--- a/webui/src/components/icons/providers/index.tsx
+++ b/webui/src/components/icons/providers/index.tsx
@@ -8,6 +8,7 @@ import File from 'components/icons/providers/File'
 import Http from 'components/icons/providers/Http'
 import Hub from 'components/icons/providers/Hub'
 import Internal from 'components/icons/providers/Internal'
+import Knative from 'components/icons/providers/Knative'
 import Kubernetes from 'components/icons/providers/Kubernetes'
 import Nomad from 'components/icons/providers/Nomad'
 import Plugin from 'components/icons/providers/Plugin'
@@ -49,6 +50,9 @@ export default function ProviderIcon({ name, size = 32 }: { name: string; size?:
     if (['kubernetes'].some((prefix) => nameLowerCase.startsWith(prefix))) {
       return Kubernetes
     }
+    if (['knative'].some((prefix) => nameLowerCase.startsWith(prefix))) {
+      return Knative
+    }
     if (['nomad', 'nomad-'].some((prefix) => nameLowerCase.startsWith(prefix))) {
       return Nomad
     }
diff --git a/webui/src/hooks/use-hub-upgrade-button.spec.tsx b/webui/src/hooks/use-hub-upgrade-button.spec.tsx
new file mode 100644
index 000000000..f0f914675
--- /dev/null
+++ b/webui/src/hooks/use-hub-upgrade-button.spec.tsx
@@ -0,0 +1,131 @@
+import { renderHook, waitFor } from '@testing-library/react'
+import { ReactNode } from 'react'
+
+import useHubUpgradeButton from './use-hub-upgrade-button'
+
+import { VersionContext } from 'contexts/version'
+import verifySignature from 'utils/workers/scriptVerification'
+
+vi.mock('utils/workers/scriptVerification')
+
+const mockVerifySignature = vi.mocked(verifySignature)
+
+const createWrapper = (showHubButton: boolean) => {
+  return ({ children }: { children: ReactNode }) => (
+    <VersionContext.Provider value={{ showHubButton, version: '1.0.0' }}>{children}</VersionContext.Provider>
+  )
+}
+
+describe('useHubUpgradeButton Hook', () => {
+  let originalCreateObjectURL: typeof URL.createObjectURL
+  let originalRevokeObjectURL: typeof URL.revokeObjectURL
+  const mockBlobUrl = 'blob:http://localhost:3000/mock-blob-url'
+
+  beforeEach(() => {
+    originalCreateObjectURL = URL.createObjectURL
+    originalRevokeObjectURL = URL.revokeObjectURL
+    URL.createObjectURL = vi.fn(() => mockBlobUrl)
+    URL.revokeObjectURL = vi.fn()
+  })
+
+  afterEach(() => {
+    URL.createObjectURL = originalCreateObjectURL
+    URL.revokeObjectURL = originalRevokeObjectURL
+    vi.clearAllMocks()
+  })
+
+  it('should not verify script when showHubButton is false', async () => {
+    renderHook(() => useHubUpgradeButton(), {
+      wrapper: createWrapper(false),
+    })
+
+    await waitFor(() => {
+      expect(mockVerifySignature).not.toHaveBeenCalled()
+    })
+  })
+
+  it('should verify script and create blob URL when showHubButton is true and verification succeeds', async () => {
+    const mockScriptContent = new ArrayBuffer(8)
+    mockVerifySignature.mockResolvedValue({
+      verified: true,
+      scriptContent: mockScriptContent,
+    })
+
+    const { result } = renderHook(() => useHubUpgradeButton(), {
+      wrapper: createWrapper(true),
+    })
+
+    await waitFor(() => {
+      expect(mockVerifySignature).toHaveBeenCalledWith(
+        'https://traefik.github.io/traefiklabs-hub-button-app/main-v1.js',
+        'https://traefik.github.io/traefiklabs-hub-button-app/main-v1.js.sig',
+        'MCowBQYDK2VwAyEAY0OZFFE5kSuqYK6/UprTL5RmvQ+8dpPTGMCw1MiO/Gs=',
+      )
+    })
+
+    await waitFor(() => {
+      expect(result.current.signatureVerified).toBe(true)
+    })
+
+    expect(result.current.scriptBlobUrl).toBe(mockBlobUrl)
+    expect(URL.createObjectURL).toHaveBeenCalledWith(expect.any(Blob))
+  })
+
+  it('should set signatureVerified to false when verification fails', async () => {
+    mockVerifySignature.mockResolvedValue({
+      verified: false,
+    })
+
+    const { result } = renderHook(() => useHubUpgradeButton(), {
+      wrapper: createWrapper(true),
+    })
+
+    await waitFor(() => {
+      expect(mockVerifySignature).toHaveBeenCalled()
+    })
+
+    await waitFor(() => {
+      expect(result.current.signatureVerified).toBe(false)
+    })
+
+    expect(result.current.scriptBlobUrl).toBeNull()
+    expect(URL.createObjectURL).not.toHaveBeenCalled()
+  })
+
+  it('should handle verification errors gracefully', async () => {
+    mockVerifySignature.mockRejectedValue(new Error('Verification failed'))
+
+    const { result } = renderHook(() => useHubUpgradeButton(), {
+      wrapper: createWrapper(true),
+    })
+
+    await waitFor(() => {
+      expect(mockVerifySignature).toHaveBeenCalled()
+    })
+
+    await waitFor(() => {
+      expect(result.current.signatureVerified).toBe(false)
+    })
+
+    expect(result.current.scriptBlobUrl).toBeNull()
+  })
+
+  it('should create blob with correct MIME type', async () => {
+    const mockScriptContent = new ArrayBuffer(8)
+    mockVerifySignature.mockResolvedValue({
+      verified: true,
+      scriptContent: mockScriptContent,
+    })
+
+    renderHook(() => useHubUpgradeButton(), {
+      wrapper: createWrapper(true),
+    })
+
+    await waitFor(() => {
+      expect(URL.createObjectURL).toHaveBeenCalled()
+    })
+    const blobCall = vi.mocked(URL.createObjectURL).mock.calls[0][0] as Blob
+    expect(blobCall).toBeInstanceOf(Blob)
+    expect(blobCall.type).toBe('application/javascript')
+  })
+})
diff --git a/webui/src/hooks/use-hub-upgrade-button.tsx b/webui/src/hooks/use-hub-upgrade-button.tsx
new file mode 100644
index 000000000..197572899
--- /dev/null
+++ b/webui/src/hooks/use-hub-upgrade-button.tsx
@@ -0,0 +1,61 @@
+import { useContext, useEffect, useState } from 'react'
+
+import { VersionContext } from 'contexts/version'
+import verifySignature from 'utils/workers/scriptVerification'
+
+const HUB_BUTTON_URL = 'https://traefik.github.io/traefiklabs-hub-button-app/main-v1.js'
+const PUBLIC_KEY = 'MCowBQYDK2VwAyEAY0OZFFE5kSuqYK6/UprTL5RmvQ+8dpPTGMCw1MiO/Gs='
+
+const useHubUpgradeButton = () => {
+  const [signatureVerified, setSignatureVerified] = useState(false)
+  const [scriptBlobUrl, setScriptBlobUrl] = useState<string | null>(null)
+  const [isCustomElementDefined, setIsCustomElementDefined] = useState(false)
+
+  const { showHubButton } = useContext(VersionContext)
+
+  useEffect(() => {
+    if (showHubButton) {
+      if (customElements.get('hub-button-app')) {
+        setSignatureVerified(true)
+        setIsCustomElementDefined(true)
+        return
+      }
+
+      const verifyAndLoadScript = async () => {
+        try {
+          const { verified, scriptContent: content } = await verifySignature(
+            HUB_BUTTON_URL,
+            `${HUB_BUTTON_URL}.sig`,
+            PUBLIC_KEY,
+          )
+          if (!verified || !content) {
+            setSignatureVerified(false)
+          } else {
+            const blob = new Blob([content], { type: 'application/javascript' })
+            const blobUrl = URL.createObjectURL(blob)
+
+            setScriptBlobUrl(blobUrl)
+            setSignatureVerified(true)
+          }
+        } catch {
+          setSignatureVerified(false)
+        }
+      }
+
+      verifyAndLoadScript()
+
+      return () => {
+        setScriptBlobUrl((currentUrl) => {
+          if (currentUrl) {
+            URL.revokeObjectURL(currentUrl)
+          }
+          return null
+        })
+      }
+    }
+  }, [showHubButton])
+
+  return { signatureVerified, scriptBlobUrl, isCustomElementDefined }
+}
+
+export default useHubUpgradeButton
diff --git a/webui/src/layout/EmptyPlaceholder.tsx b/webui/src/layout/EmptyPlaceholder.tsx
index e81ace9df..e62fcb112 100644
--- a/webui/src/layout/EmptyPlaceholder.tsx
+++ b/webui/src/layout/EmptyPlaceholder.tsx
@@ -1,9 +1,20 @@
-import { Flex, Text } from '@traefiklabs/faency'
+import { AriaTd, Flex, Text } from '@traefiklabs/faency'
 import { FiAlertTriangle } from 'react-icons/fi'
 
-export const EmptyPlaceholder = ({ message = 'No data available' }: { message?: string }) => (
+type EmptyPlaceholderProps = {
+  message?: string
+}
+export const EmptyPlaceholder = ({ message = 'No data available' }: EmptyPlaceholderProps) => (
   <Flex align="center" justify="center" css={{ py: '$5', color: '$primary' }}>
     <FiAlertTriangle size={16} />
     <Text css={{ pl: '$2' }}>{message}</Text>
   </Flex>
 )
+
+export const EmptyPlaceholderTd = (props: EmptyPlaceholderProps) => {
+  return (
+    <AriaTd css={{ pointerEvents: 'none' }} fullColSpan>
+      <EmptyPlaceholder {...props} />
+    </AriaTd>
+  )
+}
diff --git a/webui/src/layout/Navigation.spec.tsx b/webui/src/layout/Navigation.spec.tsx
index d19ab884a..44b1a8704 100644
--- a/webui/src/layout/Navigation.spec.tsx
+++ b/webui/src/layout/Navigation.spec.tsx
@@ -1,8 +1,27 @@
+import { waitFor } from '@testing-library/react'
+
 import { SideNav, TopNav } from './Navigation'
 
+import useHubUpgradeButton from 'hooks/use-hub-upgrade-button'
 import { renderWithProviders } from 'utils/test'
 
+vi.mock('hooks/use-hub-upgrade-button')
+
+const mockUseHubUpgradeButton = vi.mocked(useHubUpgradeButton)
+
 describe('Navigation', () => {
+  beforeEach(() => {
+    mockUseHubUpgradeButton.mockReturnValue({
+      signatureVerified: false,
+      scriptBlobUrl: null,
+      isCustomElementDefined: false,
+    })
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
   it('should render the side navigation bar', async () => {
     const { container } = renderWithProviders(<SideNav isExpanded={false} onSidePanelToggle={() => {}} />)
 
@@ -18,4 +37,60 @@ describe('Navigation', () => {
     expect(container.innerHTML).toContain('theme-switcher')
     expect(container.innerHTML).toContain('help-menu')
   })
+
+  describe('hub-button-app rendering', () => {
+    it('should NOT render hub-button-app when signatureVerified is false', async () => {
+      mockUseHubUpgradeButton.mockReturnValue({
+        signatureVerified: false,
+        scriptBlobUrl: null,
+        isCustomElementDefined: false,
+      })
+
+      const { container } = renderWithProviders(<TopNav />)
+
+      const hubButtonApp = container.querySelector('hub-button-app')
+      expect(hubButtonApp).toBeNull()
+    })
+
+    it('should NOT render hub-button-app when scriptBlobUrl is null', async () => {
+      mockUseHubUpgradeButton.mockReturnValue({
+        signatureVerified: true,
+        scriptBlobUrl: null,
+        isCustomElementDefined: false,
+      })
+
+      const { container } = renderWithProviders(<TopNav />)
+
+      const hubButtonApp = container.querySelector('hub-button-app')
+      expect(hubButtonApp).toBeNull()
+    })
+
+    it('should render hub-button-app when signatureVerified is true and scriptBlobUrl exists', async () => {
+      mockUseHubUpgradeButton.mockReturnValue({
+        signatureVerified: true,
+        scriptBlobUrl: 'blob:http://localhost:3000/mock-blob-url',
+        isCustomElementDefined: false,
+      })
+
+      const { container } = renderWithProviders(<TopNav />)
+
+      await waitFor(() => {
+        const hubButtonApp = container.querySelector('hub-button-app')
+        expect(hubButtonApp).not.toBeNull()
+      })
+    })
+
+    it('should NOT render hub-button-app when noHubButton prop is true', async () => {
+      mockUseHubUpgradeButton.mockReturnValue({
+        signatureVerified: true,
+        scriptBlobUrl: 'blob:http://localhost:3000/mock-blob-url',
+        isCustomElementDefined: false,
+      })
+
+      const { container } = renderWithProviders(<TopNav noHubButton={true} />)
+
+      const hubButtonApp = container.querySelector('hub-button-app')
+      expect(hubButtonApp).toBeNull()
+    })
+  })
 })
diff --git a/webui/src/layout/Navigation.tsx b/webui/src/layout/Navigation.tsx
index 62b29eedf..0f57405ab 100644
--- a/webui/src/layout/Navigation.tsx
+++ b/webui/src/layout/Navigation.tsx
@@ -2,6 +2,7 @@ import {
   Badge,
   Box,
   Button,
+  CSS,
   DialogTitle,
   DropdownMenu,
   DropdownMenuContent,
@@ -20,6 +21,7 @@ import {
   VisuallyHidden,
 } from '@traefiklabs/faency'
 import { useContext, useEffect, useMemo, useState } from 'react'
+import { Helmet } from 'react-helmet-async'
 import { BsChevronDoubleRight, BsChevronDoubleLeft } from 'react-icons/bs'
 import { FiBookOpen, FiGithub, FiHelpCircle } from 'react-icons/fi'
 import { matchPath, useHref } from 'react-router'
@@ -35,8 +37,10 @@ import { PluginsIcon } from 'components/icons/PluginsIcon'
 import ThemeSwitcher from 'components/ThemeSwitcher'
 import TooltipText from 'components/TooltipText'
 import { VersionContext } from 'contexts/version'
+import useHubUpgradeButton from 'hooks/use-hub-upgrade-button'
 import useTotals from 'hooks/use-overview-totals'
 import { useIsDarkMode } from 'hooks/use-theme'
+import ApimDemoNavMenu from 'pages/hub-demo/HubDemoNav'
 import { Route, ROUTES } from 'routes'
 
 export const LAPTOP_BP = 1025
@@ -54,7 +58,7 @@ const NavigationDrawer = styled(Flex, {
   },
 })
 
-const BasicNavigationItem = ({
+export const BasicNavigationItem = ({
   route,
   count,
   isSmallScreen,
@@ -270,7 +274,7 @@ export const SideNav = ({
             ))}
           </Flex>
         ))}
-        <Flex direction="column" css={{ borderTop: '1px solid $colors$tableRowBorder', borderRadius: 0, pt: '$3' }}>
+        <Flex direction="column" css={{ borderTop: '1px solid $colors$tableRowBorder', borderRadius: 0, py: '$3' }}>
           <NavigationLink
             startAdornment={<PluginsIcon />}
             css={{
@@ -283,14 +287,15 @@ export const SideNav = ({
             {!isSmallScreen || isExpanded ? 'Plugins' : ''}
           </NavigationLink>
         </Flex>
+
+        <ApimDemoNavMenu isResponsive={isResponsive} isSmallScreen={isSmallScreen} isExpanded={isExpanded} />
       </Container>
     </NavigationDrawer>
   )
 }
 
-export const TopNav = () => {
-  const [hasHubButtonComponent, setHasHubButtonComponent] = useState(false)
-  const { showHubButton, version } = useContext(VersionContext)
+export const TopNav = ({ css, noHubButton = false }: { css?: CSS; noHubButton?: boolean }) => {
+  const { version } = useContext(VersionContext)
   const isDarkMode = useIsDarkMode()
 
   const parsedVersion = useMemo(() => {
@@ -304,91 +309,73 @@ export const TopNav = () => {
     return matches ? 'v' + matches[1] : 'master'
   }, [version])
 
-  useEffect(() => {
-    if (!showHubButton) {
-      setHasHubButtonComponent(false)
-      return
-    }
+  const { signatureVerified, scriptBlobUrl, isCustomElementDefined } = useHubUpgradeButton()
 
-    if (customElements.get('hub-button-app')) {
-      setHasHubButtonComponent(true)
-      return
-    }
-
-    const scripts: HTMLScriptElement[] = []
-    const createScript = (scriptSrc: string): HTMLScriptElement => {
-      const script = document.createElement('script')
-      script.src = scriptSrc
-      script.async = true
-      script.onload = () => {
-        setHasHubButtonComponent(customElements.get('hub-button-app') !== undefined)
-      }
-      scripts.push(script)
-      return script
-    }
-
-    // Source: https://github.com/traefik/traefiklabs-hub-button-app
-    document.head.appendChild(createScript('traefiklabs-hub-button-app/main-v1.js'))
-
-    return () => {
-      // Remove the scripts on unmount.
-      scripts.forEach((script) => {
-        if (script.parentNode) {
-          script.parentNode.removeChild(script)
-        }
-      })
-    }
-  }, [showHubButton])
+  const displayUpgradeToHubButton = useMemo(
+    () => !noHubButton && signatureVerified && (!!scriptBlobUrl || isCustomElementDefined),
+    [isCustomElementDefined, noHubButton, scriptBlobUrl, signatureVerified],
+  )
 
   return (
-    <Flex as="nav" role="navigation" justify="end" align="center" css={{ gap: '$2', mb: '$6' }}>
-      {hasHubButtonComponent && (
-        <Box css={{ fontFamily: '$rubik', fontWeight: '500 !important' }}>
-          <hub-button-app
-            key={`dark-mode-${isDarkMode}`}
-            style={{ backgroundColor: isDarkMode ? DARK_PRIMARY_COLOR : LIGHT_PRIMARY_COLOR, fontWeight: 'inherit' }}
+    <>
+      {displayUpgradeToHubButton && (
+        <Helmet>
+          <meta
+            httpEquiv="Content-Security-Policy"
+            content="script-src 'self' blob: 'unsafe-inline'; object-src 'none'; base-uri 'self';"
           />
-        </Box>
+          <script src={scriptBlobUrl as string} type="module"></script>
+        </Helmet>
       )}
-      <ThemeSwitcher />
+      <Flex as="nav" role="navigation" justify="end" align="center" css={{ gap: '$2', mb: '$6', ...css }}>
+        {displayUpgradeToHubButton && (
+          <Box css={{ fontFamily: '$rubik', fontWeight: '500 !important' }}>
+            <hub-button-app
+              key={`dark-mode-${isDarkMode}`}
+              style={{ backgroundColor: isDarkMode ? DARK_PRIMARY_COLOR : LIGHT_PRIMARY_COLOR, fontWeight: 'inherit' }}
+            />
+          </Box>
+        )}
+        <ThemeSwitcher />
 
-      <DropdownMenu>
-        <DropdownMenuTrigger asChild>
-          <Button ghost variant="secondary" css={{ px: '$2', boxShadow: 'none' }} data-testid="help-menu">
-            <FiHelpCircle size={20} />
-          </Button>
-        </DropdownMenuTrigger>
-        <DropdownMenuPortal>
-          <DropdownMenuContent align="end" css={{ zIndex: 9999 }}>
-            <DropdownMenuGroup>
-              <DropdownMenuItem css={{ height: '$6', cursor: 'pointer' }}>
-                <Link
-                  href={`https://doc.traefik.io/traefik/${parsedVersion}`}
-                  target="_blank"
-                  css={{ textDecoration: 'none', '&:hover': { textDecoration: 'none' } }}
-                >
-                  <Flex align="center" gap={2}>
-                    <FiBookOpen size={20} />
-                    <Text>Documentation</Text>
-                  </Flex>
-                </Link>
-              </DropdownMenuItem>
-              <DropdownMenuItem css={{ height: '$6', cursor: 'pointer' }}>
-                <Link
-                  href="https://github.com/traefik/traefik/"
-                  target="_blank"
-                  css={{ textDecoration: 'none', '&:hover': { textDecoration: 'none' } }}
-                >
-                  <Flex align="center" gap={2}>
-                    <FiGithub size={20} />
-                    <Text>Github Repository</Text>
-                  </Flex>
-                </Link>
-              </DropdownMenuItem>
-            </DropdownMenuGroup>
-          </DropdownMenuContent>
-        </DropdownMenuPortal>
-      </DropdownMenu>
-    </Flex>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <Button ghost variant="secondary" css={{ px: '$2', boxShadow: 'none' }} data-testid="help-menu">
+              <FiHelpCircle size={20} />
+            </Button>
+          </DropdownMenuTrigger>
+          <DropdownMenuPortal>
+            <DropdownMenuContent align="end" css={{ zIndex: 9999 }}>
+              <DropdownMenuGroup>
+                <DropdownMenuItem css={{ height: '$6', cursor: 'pointer' }}>
+                  <Link
+                    href={`https://doc.traefik.io/traefik/${parsedVersion}`}
+                    target="_blank"
+                    css={{ textDecoration: 'none', '&:hover': { textDecoration: 'none' } }}
+                  >
+                    <Flex align="center" gap={2}>
+                      <FiBookOpen size={20} />
+                      <Text>Documentation</Text>
+                    </Flex>
+                  </Link>
+                </DropdownMenuItem>
+                <DropdownMenuItem css={{ height: '$6', cursor: 'pointer' }}>
+                  <Link
+                    href="https://github.com/traefik/traefik/"
+                    target="_blank"
+                    css={{ textDecoration: 'none', '&:hover': { textDecoration: 'none' } }}
+                  >
+                    <Flex align="center" gap={2}>
+                      <FiGithub size={20} />
+                      <Text>Github Repository</Text>
+                    </Flex>
+                  </Link>
+                </DropdownMenuItem>
+              </DropdownMenuGroup>
+            </DropdownMenuContent>
+          </DropdownMenuPortal>
+        </DropdownMenu>
+      </Flex>
+    </>
   )
 }
diff --git a/webui/src/layout/Page.spec.tsx b/webui/src/layout/Page.spec.tsx
index 2334cdc31..b091ac30e 100644
--- a/webui/src/layout/Page.spec.tsx
+++ b/webui/src/layout/Page.spec.tsx
@@ -4,7 +4,7 @@ import { renderWithProviders } from 'utils/test'
 
 describe('<Page />', () => {
   it('should render an empty page', () => {
-    const { getByTestId } = renderWithProviders(<Page title="Test" />)
-    expect(getByTestId('Test page')).toBeInTheDocument()
+    const { getByTestId } = renderWithProviders(<Page />, { route: '/test' })
+    expect(getByTestId('/test page')).toBeInTheDocument()
   })
 })
diff --git a/webui/src/layout/Page.tsx b/webui/src/layout/Page.tsx
index f11afa091..ec8b6ea81 100644
--- a/webui/src/layout/Page.tsx
+++ b/webui/src/layout/Page.tsx
@@ -1,6 +1,7 @@
 import { Flex, globalCss, styled } from '@traefiklabs/faency'
-import { ReactNode, useState } from 'react'
+import { ReactNode, useMemo, useState } from 'react'
 import { Helmet } from 'react-helmet-async'
+import { useLocation } from 'react-router-dom'
 
 import Container from './Container'
 import { LAPTOP_BP, SideBarPanel, SideNav, TopNav } from './Navigation'
@@ -40,14 +41,31 @@ export interface Props {
   children?: ReactNode
 }
 
-const Page = ({ children, title }: Props) => {
+const Page = ({ children }: Props) => {
+  const { pathname } = useLocation()
   const [isSideBarPanelOpen, setIsSideBarPanelOpen] = useState(false)
+  const location = useLocation()
+
+  const isDemoPage = useMemo(() => pathname.includes('hub-dashboard'), [pathname])
+
+  const renderedContent = useMemo(() => {
+    if (isDemoPage) {
+      return children
+    }
+
+    return (
+      <PageContainer data-testid={`${location.pathname} page`} direction="column">
+        <TopNav />
+        {children}
+      </PageContainer>
+    )
+  }, [children, isDemoPage, location.pathname])
 
   return (
     <ToastProvider>
       {globalStyles()}
       <Helmet>
-        <title>{title ? `${title} - ` : ''}Traefik Proxy</title>
+        <title>Traefik Proxy</title>
       </Helmet>
       <Flex>
         <SideBarPanel isOpen={isSideBarPanelOpen} onOpenChange={setIsSideBarPanelOpen} />
@@ -56,10 +74,7 @@ const Page = ({ children, title }: Props) => {
           justify="center"
           css={{ flex: 1, margin: 'auto', ml: 264, [`@media (max-width:${LAPTOP_BP}px)`]: { ml: 60 } }}
         >
-          <PageContainer data-testid={`${title} page`} direction="column">
-            <TopNav />
-            {children}
-          </PageContainer>
+          {renderedContent}
         </Flex>
       </Flex>
       <ToastPool />
diff --git a/webui/src/pages/NotFound.tsx b/webui/src/pages/NotFound.tsx
index 51a130c4c..486b0b217 100644
--- a/webui/src/pages/NotFound.tsx
+++ b/webui/src/pages/NotFound.tsx
@@ -1,24 +1,24 @@
 import { Box, Button, Flex, H1, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useNavigate } from 'react-router-dom'
 
-import Page from 'layout/Page'
-
 export const NotFound = () => {
   const navigate = useNavigate()
 
   return (
-    <Page title="Not found">
-      <Flex css={{ flexDirection: 'column', alignItems: 'center', p: '$6' }}>
-        <Box>
-          <H1 style={{ fontSize: '80px', lineHeight: '120px' }}>404</H1>
-        </Box>
-        <Box css={{ pb: '$3' }}>
-          <Text size={6}>I&apos;m sorry, nothing around here...</Text>
-        </Box>
-        <Button variant="primary" onClick={() => navigate(-1)}>
-          Go back
-        </Button>
-      </Flex>
-    </Page>
+    <Flex css={{ flexDirection: 'column', alignItems: 'center', p: '$6' }} data-testid="Not found page">
+      <Helmet>
+        <title>Not found - Traefik Proxy</title>
+      </Helmet>
+      <Box>
+        <H1 style={{ fontSize: '80px', lineHeight: '120px' }}>404</H1>
+      </Box>
+      <Box css={{ pb: '$3' }}>
+        <Text size={6}>I&apos;m sorry, nothing around here...</Text>
+      </Box>
+      <Button variant="primary" onClick={() => navigate(-1)}>
+        Go back
+      </Button>
+    </Flex>
   )
 }
diff --git a/webui/src/pages/dashboard/Dashboard.tsx b/webui/src/pages/dashboard/Dashboard.tsx
index 9100823eb..b26cf0a9c 100644
--- a/webui/src/pages/dashboard/Dashboard.tsx
+++ b/webui/src/pages/dashboard/Dashboard.tsx
@@ -1,12 +1,12 @@
 import { Card, CSS, Flex, Grid, H2, Text } from '@traefiklabs/faency'
 import { ReactNode, useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useSWR from 'swr'
 
 import ProviderIcon from 'components/icons/providers'
 import FeatureCard, { FeatureCardSkeleton } from 'components/resources/FeatureCard'
 import ResourceCard from 'components/resources/ResourceCard'
 import TraefikResourceStatsCard, { StatsCardSkeleton } from 'components/resources/TraefikResourceStatsCard'
-import Page from 'layout/Page'
 import { capitalizeFirstLetter } from 'utils/string'
 
 const RESOURCES = ['routers', 'services', 'middlewares']
@@ -76,159 +76,158 @@ export const Dashboard = () => {
   }
 
   return (
-    <Page title="Dashboard">
-      <Flex direction="column" gap={6}>
-        <SectionContainer title="Entrypoints" css={{ mt: 0 }}>
-          {entrypoints?.map((i, idx) => (
-            <ResourceCard
-              key={`entrypoint-${i.name}-${idx}`}
-              css={{
-                display: 'flex',
-                flexDirection: 'column',
-                justifyContent: 'center',
-                minHeight: '125px',
-              }}
-              title={i.name}
-              titleCSS={{ textAlign: 'center' }}
-            >
-              <Text css={{ fontSize: '$11', fontWeight: 500, wordBreak: 'break-word' }}>{i.address}</Text>
-            </ResourceCard>
-          ))}
-        </SectionContainer>
+    <Flex direction="column" gap={6}>
+      <Helmet>
+        <title>Dashboard - Traefik Proxy</title>
+      </Helmet>
+      <SectionContainer title="Entrypoints" css={{ mt: 0 }}>
+        {entrypoints?.map((i, idx) => (
+          <ResourceCard
+            key={`entrypoint-${i.name}-${idx}`}
+            css={{
+              display: 'flex',
+              flexDirection: 'column',
+              justifyContent: 'center',
+              minHeight: '125px',
+            }}
+            title={i.name}
+            titleCSS={{ textAlign: 'center' }}
+          >
+            <Text css={{ fontSize: '$11', fontWeight: 500, wordBreak: 'break-word' }}>{i.address}</Text>
+          </ResourceCard>
+        ))}
+      </SectionContainer>
 
-        <SectionContainer
-          title="HTTP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {overview?.http && hasResources.http ? (
-            RESOURCES.map((i) => (
-              <TraefikResourceStatsCard
-                key={`http-${i}`}
-                title={capitalizeFirstLetter(i)}
-                data-testid={`section-http-${i}`}
-                linkTo={`/http/${i}`}
-                {...overview.http[i]}
-              />
-            ))
-          ) : (
-            <Text size={4}>No related objects to show.</Text>
-          )}
-        </SectionContainer>
+      <SectionContainer
+        title="HTTP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {overview?.http && hasResources.http ? (
+          RESOURCES.map((i) => (
+            <TraefikResourceStatsCard
+              key={`http-${i}`}
+              title={capitalizeFirstLetter(i)}
+              data-testid={`section-http-${i}`}
+              linkTo={`/http/${i}`}
+              {...overview.http[i]}
+            />
+          ))
+        ) : (
+          <Text size={4}>No related objects to show.</Text>
+        )}
+      </SectionContainer>
 
-        <SectionContainer
-          title="TCP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {overview?.tcp && hasResources.tcp ? (
-            RESOURCES.map((i) => (
-              <TraefikResourceStatsCard
-                key={`tcp-${i}`}
-                title={capitalizeFirstLetter(i)}
-                data-testid={`section-tcp-${i}`}
-                linkTo={`/tcp/${i}`}
-                {...overview.tcp[i]}
-              />
-            ))
-          ) : (
-            <Text size={4}>No related objects to show.</Text>
-          )}
-        </SectionContainer>
+      <SectionContainer
+        title="TCP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {overview?.tcp && hasResources.tcp ? (
+          RESOURCES.map((i) => (
+            <TraefikResourceStatsCard
+              key={`tcp-${i}`}
+              title={capitalizeFirstLetter(i)}
+              data-testid={`section-tcp-${i}`}
+              linkTo={`/tcp/${i}`}
+              {...overview.tcp[i]}
+            />
+          ))
+        ) : (
+          <Text size={4}>No related objects to show.</Text>
+        )}
+      </SectionContainer>
 
-        <SectionContainer
-          title="UDP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {overview?.udp && hasResources.udp ? (
-            RESOURCES.map((i) => (
-              <TraefikResourceStatsCard
-                key={`udp-${i}`}
-                title={capitalizeFirstLetter(i)}
-                data-testid={`section-udp-${i}`}
-                linkTo={`/udp/${i}`}
-                {...overview.udp[i]}
-              />
-            ))
-          ) : (
-            <Text size={4}>No related objects to show.</Text>
-          )}
-        </SectionContainer>
+      <SectionContainer
+        title="UDP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {overview?.udp && hasResources.udp ? (
+          RESOURCES.map((i) => (
+            <TraefikResourceStatsCard
+              key={`udp-${i}`}
+              title={capitalizeFirstLetter(i)}
+              data-testid={`section-udp-${i}`}
+              linkTo={`/udp/${i}`}
+              {...overview.udp[i]}
+            />
+          ))
+        ) : (
+          <Text size={4}>No related objects to show.</Text>
+        )}
+      </SectionContainer>
 
-        <SectionContainer title="Features">
-          {features.length
-            ? features.map((i, idx) => {
-                return <FeatureCard key={`feature-${idx}`} feature={i} />
-              })
-            : null}
-        </SectionContainer>
+      <SectionContainer title="Features">
+        {features.length
+          ? features.map((i, idx) => {
+              return <FeatureCard key={`feature-${idx}`} feature={i} />
+            })
+          : null}
+      </SectionContainer>
 
-        <SectionContainer title="Providers">
-          {overview?.providers?.length ? (
-            overview.providers.map((p, idx) => (
-              <Card key={`provider-${idx}`} css={{ height: 125 }}>
-                <Flex direction="column" align="center" gap={3} justify="center" css={{ height: '100%' }}>
-                  <ProviderIcon name={p} size={52} />
-                  <Text css={{ fontSize: '$4', fontWeight: 500, textAlign: 'center' }}>{p}</Text>
-                </Flex>
-              </Card>
-            ))
-          ) : (
-            <Text size={4}>No related objects to show.</Text>
-          )}
-        </SectionContainer>
-      </Flex>
-    </Page>
+      <SectionContainer title="Providers">
+        {overview?.providers?.length ? (
+          overview.providers.map((p, idx) => (
+            <Card key={`provider-${idx}`} css={{ height: 125 }}>
+              <Flex direction="column" align="center" gap={3} justify="center" css={{ height: '100%' }}>
+                <ProviderIcon name={p} size={52} />
+                <Text css={{ fontSize: '$4', fontWeight: 500, textAlign: 'center' }}>{p}</Text>
+              </Flex>
+            </Card>
+          ))
+        ) : (
+          <Text size={4}>No related objects to show.</Text>
+        )}
+      </SectionContainer>
+    </Flex>
   )
 }
 
 export const DashboardSkeleton = () => {
   return (
-    <Page>
-      <Flex direction="column" gap={6}>
-        <SectionContainer title="Entrypoints" css={{ mt: 0 }}>
-          {[...Array(5)].map((_, i) => (
-            <FeatureCardSkeleton key={`entry-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
+    <Flex direction="column" gap={6}>
+      <SectionContainer title="Entrypoints" css={{ mt: 0 }}>
+        {[...Array(5)].map((_, i) => (
+          <FeatureCardSkeleton key={`entry-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
 
-        <SectionContainer
-          title="HTTP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {[...Array(3)].map((_, i) => (
-            <StatsCardSkeleton key={`http-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
+      <SectionContainer
+        title="HTTP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {[...Array(3)].map((_, i) => (
+          <StatsCardSkeleton key={`http-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
 
-        <SectionContainer
-          title="TCP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {[...Array(3)].map((_, i) => (
-            <StatsCardSkeleton key={`tcp-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
+      <SectionContainer
+        title="TCP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {[...Array(3)].map((_, i) => (
+          <StatsCardSkeleton key={`tcp-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
 
-        <SectionContainer
-          title="UDP"
-          childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
-        >
-          {[...Array(3)].map((_, i) => (
-            <StatsCardSkeleton key={`udp-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
+      <SectionContainer
+        title="UDP"
+        childrenContainerCss={{ gridTemplateColumns: 'repeat(auto-fill, minmax(350px, 1fr))' }}
+      >
+        {[...Array(3)].map((_, i) => (
+          <StatsCardSkeleton key={`udp-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
 
-        <SectionContainer title="Features">
-          {[...Array(3)].map((_, i) => (
-            <FeatureCardSkeleton key={`feature-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
+      <SectionContainer title="Features">
+        {[...Array(3)].map((_, i) => (
+          <FeatureCardSkeleton key={`feature-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
 
-        <SectionContainer title="Providers">
-          {[...Array(3)].map((_, i) => (
-            <FeatureCardSkeleton key={`provider-skeleton-${i}`} />
-          ))}
-        </SectionContainer>
-      </Flex>
-    </Page>
+      <SectionContainer title="Providers">
+        {[...Array(3)].map((_, i) => (
+          <FeatureCardSkeleton key={`provider-skeleton-${i}`} />
+        ))}
+      </SectionContainer>
+    </Flex>
   )
 }
diff --git a/webui/src/pages/http/HttpMiddleware.spec.tsx b/webui/src/pages/http/HttpMiddleware.spec.tsx
index d7a7c39bb..8bf003735 100644
--- a/webui/src/pages/http/HttpMiddleware.spec.tsx
+++ b/webui/src/pages/http/HttpMiddleware.spec.tsx
@@ -7,6 +7,7 @@ describe('<HttpMiddlewarePage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <HttpMiddlewareRender name="mock-middleware" data={undefined} error={new Error('Test error')} />,
+      { route: '/http/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<HttpMiddlewarePage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <HttpMiddlewareRender name="mock-middleware" data={undefined} error={undefined} />,
+      { route: '/http/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<HttpMiddlewarePage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <HttpMiddlewareRender name="mock-middleware" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/http/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -53,6 +56,7 @@ describe('<HttpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpMiddlewareRender name="mock-middleware" data={mockMiddleware as any} error={undefined} />,
+      { route: '/http/middlewares/middleware-simple', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -99,6 +103,7 @@ describe('<HttpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpMiddlewareRender name="mock-middleware" data={mockMiddleware as any} error={undefined} />,
+      { route: '/http/middlewares/middleware-plugin', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -338,6 +343,7 @@ describe('<HttpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpMiddlewareRender name="mock-middleware" data={mockMiddleware as any} error={undefined} />,
+      { route: '/http/middlewares/middleware-complex', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -459,6 +465,7 @@ describe('<HttpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpMiddlewareRender name="mock-middleware" data={mockMiddleware as any} error={undefined} />,
+      { route: '/http/middlewares/middleware-plugin-no-type', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
diff --git a/webui/src/pages/http/HttpMiddleware.tsx b/webui/src/pages/http/HttpMiddleware.tsx
index 4b2fe7e2a..d762e6975 100644
--- a/webui/src/pages/http/HttpMiddleware.tsx
+++ b/webui/src/pages/http/HttpMiddleware.tsx
@@ -1,11 +1,11 @@
 import { Box, Card, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useParams } from 'react-router-dom'
 
 import { DetailSectionSkeleton } from 'components/resources/DetailSections'
 import { RenderMiddleware } from 'components/resources/MiddlewarePanel'
 import { UsedByRoutersSection, UsedByRoutersSkeleton } from 'components/resources/UsedByRoutersSection'
 import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { NotFound } from 'pages/NotFound'
 import breakpoints from 'utils/breakpoints'
 
@@ -27,23 +27,29 @@ type HttpMiddlewareRenderProps = {
 export const HttpMiddlewareRender = ({ data, error, name }: HttpMiddlewareRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Middleware right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Skeleton css={{ height: '$7', width: '320px', mb: '$4' }} data-testid="skeleton" />
         <MiddlewareGrid data-testid="skeletons">
           <DetailSectionSkeleton />
         </MiddlewareGrid>
         <UsedByRoutersSkeleton />
-      </Page>
+      </>
     )
   }
 
@@ -52,7 +58,10 @@ export const HttpMiddlewareRender = ({ data, error, name }: HttpMiddlewareRender
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <H1 css={{ mb: '$7' }}>{data.name}</H1>
       <MiddlewareGrid>
         <Card css={{ p: '$3' }} data-testid="middleware-card">
@@ -60,7 +69,7 @@ export const HttpMiddlewareRender = ({ data, error, name }: HttpMiddlewareRender
         </Card>
       </MiddlewareGrid>
       <UsedByRoutersSection data-testid="routers-table" data={data} protocol="http" />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/http/HttpMiddlewares.spec.tsx b/webui/src/pages/http/HttpMiddlewares.spec.tsx
index 1f4ce2607..b49b42062 100644
--- a/webui/src/pages/http/HttpMiddlewares.spec.tsx
+++ b/webui/src/pages/http/HttpMiddlewares.spec.tsx
@@ -76,10 +76,13 @@ describe('<HttpMiddlewaresPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<HttpMiddlewaresPage />)
+    const { container, getByTestId } = renderWithProviders(<HttpMiddlewaresPage />, {
+      route: '/http/middlewares',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('HTTP Middlewares page')).toBeInTheDocument()
+    expect(getByTestId('/http/middlewares page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(5)
 
@@ -120,6 +123,7 @@ describe('<HttpMiddlewaresPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/http/middlewares', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/http/HttpMiddlewares.tsx b/webui/src/pages/http/HttpMiddlewares.tsx
index f61a4ed6b..4ec86d841 100644
--- a/webui/src/pages/http/HttpMiddlewares.tsx
+++ b/webui/src/pages/http/HttpMiddlewares.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -13,8 +14,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 import { parseMiddlewareType } from 'libs/parsers'
 
 export const makeRowRender = (): RenderRowType => {
@@ -79,9 +79,7 @@ export const HttpMiddlewaresRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -109,7 +107,10 @@ export const HttpMiddlewares = () => {
   )
 
   return (
-    <Page title="HTTP Middlewares">
+    <>
+      <Helmet>
+        <title>HTTP Middlewares - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <HttpMiddlewaresRender
         error={error}
@@ -120,6 +121,6 @@ export const HttpMiddlewares = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/http/HttpRouter.spec.tsx b/webui/src/pages/http/HttpRouter.spec.tsx
index a7f1e3ad7..ca90455d9 100644
--- a/webui/src/pages/http/HttpRouter.spec.tsx
+++ b/webui/src/pages/http/HttpRouter.spec.tsx
@@ -10,6 +10,7 @@ describe('<HttpRouterPage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <HttpRouterRender name="mock-router" data={undefined} error={new Error('Test error')} />,
+      { route: '/http/routers/mock-router', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -17,6 +18,7 @@ describe('<HttpRouterPage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <HttpRouterRender name="mock-router" data={undefined} error={undefined} />,
+      { route: '/http/routers/mock-router', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -24,6 +26,7 @@ describe('<HttpRouterPage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <HttpRouterRender name="mock-router" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/http/routers/mock-router', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -40,6 +43,7 @@ describe('<HttpRouterPage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpRouterRender name="mock-router" data={mockData as any} error={undefined} />,
+      { route: '/http/routers/orphan-router@file', withPage: true },
     )
 
     const routerStructure = getByTestId('router-structure')
diff --git a/webui/src/pages/http/HttpRouter.tsx b/webui/src/pages/http/HttpRouter.tsx
index dbb493e4d..62801083a 100644
--- a/webui/src/pages/http/HttpRouter.tsx
+++ b/webui/src/pages/http/HttpRouter.tsx
@@ -1,5 +1,6 @@
 import { Flex, styled, Text } from '@traefiklabs/faency'
 import { useContext, useEffect, useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import { FiGlobe, FiLayers, FiLogIn, FiZap } from 'react-icons/fi'
 import { useParams } from 'react-router-dom'
 
@@ -9,7 +10,6 @@ import RouterPanel from 'components/resources/RouterPanel'
 import TlsPanel from 'components/resources/TlsPanel'
 import { ToastContext } from 'contexts/toasts'
 import { EntryPoint, ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { getErrorData, getValidData } from 'libs/objectHandlers'
 import { parseMiddlewareType } from 'libs/parsers'
 import { NotFound } from 'pages/NotFound'
@@ -105,17 +105,23 @@ type HttpRouterRenderProps = {
 export const HttpRouterRender = ({ data, error, name }: HttpRouterRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Router right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Flex css={{ flexDirection: 'row', mb: '70px' }} data-testid="skeleton">
           <CardListSection bigDescription />
           <CardListSection />
@@ -127,7 +133,7 @@ export const HttpRouterRender = ({ data, error, name }: HttpRouterRenderProps) =
           <DetailSectionSkeleton />
           <DetailSectionSkeleton />
         </SpacedColumns>
-      </Page>
+      </>
     )
   }
 
@@ -136,10 +142,13 @@ export const HttpRouterRender = ({ data, error, name }: HttpRouterRenderProps) =
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <RouterStructure data={data} protocol="http" />
       <RouterDetail data={data} />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/http/HttpRouters.spec.tsx b/webui/src/pages/http/HttpRouters.spec.tsx
index bdddd21b4..a4df44257 100644
--- a/webui/src/pages/http/HttpRouters.spec.tsx
+++ b/webui/src/pages/http/HttpRouters.spec.tsx
@@ -49,10 +49,13 @@ describe('<HttpRoutersPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<HttpRoutersPage />)
+    const { container, getByTestId } = renderWithProviders(<HttpRoutersPage />, {
+      route: '/http/routers',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('HTTP Routers page')).toBeInTheDocument()
+    expect(getByTestId('/http/routers page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(4)
 
@@ -100,6 +103,7 @@ describe('<HttpRoutersPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/http/routers', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/http/HttpRouters.tsx b/webui/src/pages/http/HttpRouters.tsx
index d646b8f42..7896ca38a 100644
--- a/webui/src/pages/http/HttpRouters.tsx
+++ b/webui/src/pages/http/HttpRouters.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import { FiShield } from 'react-icons/fi'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
@@ -15,8 +16,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (protocol = 'http'): RenderRowType => {
   const HttpRoutersRenderRow = (row) => (
@@ -100,9 +100,7 @@ export const HttpRoutersRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -130,7 +128,10 @@ export const HttpRouters = () => {
   )
 
   return (
-    <Page title="HTTP Routers">
+    <>
+      <Helmet>
+        <title>HTTP Routers - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <HttpRoutersRender
         error={error}
@@ -141,6 +142,6 @@ export const HttpRouters = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/http/HttpService.spec.tsx b/webui/src/pages/http/HttpService.spec.tsx
index 781d43099..76059e21d 100644
--- a/webui/src/pages/http/HttpService.spec.tsx
+++ b/webui/src/pages/http/HttpService.spec.tsx
@@ -7,6 +7,7 @@ describe('<HttpServicePage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <HttpServiceRender name="mock-service" data={undefined} error={new Error('Test error')} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<HttpServicePage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <HttpServiceRender name="mock-service" data={undefined} error={undefined} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<HttpServicePage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <HttpServiceRender name="mock-service" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -71,6 +74,7 @@ describe('<HttpServicePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -142,6 +146,7 @@ describe('<HttpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
 
     const healthCheck = getByTestId('health-check')
@@ -196,6 +201,7 @@ describe('<HttpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <HttpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/http/services/mock-service', withPage: true },
     )
 
     const mirrorServices = getByTestId('mirror-services')
diff --git a/webui/src/pages/http/HttpService.tsx b/webui/src/pages/http/HttpService.tsx
index 4e74c552f..1761cbf05 100644
--- a/webui/src/pages/http/HttpService.tsx
+++ b/webui/src/pages/http/HttpService.tsx
@@ -1,5 +1,6 @@
 import { Badge, Box, Flex, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import { FiGlobe, FiInfo, FiShield } from 'react-icons/fi'
 import { useParams } from 'react-router-dom'
 
@@ -18,7 +19,6 @@ import { ResourceStatus } from 'components/resources/ResourceStatus'
 import { UsedByRoutersSection, UsedByRoutersSkeleton } from 'components/resources/UsedByRoutersSection'
 import Tooltip from 'components/Tooltip'
 import { ResourceDetailDataType, ServiceDetailType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { NotFound } from 'pages/NotFound'
 
 type DetailProps = {
@@ -270,17 +270,23 @@ type HttpServiceRenderProps = {
 export const HttpServiceRender = ({ data, error, name }: HttpServiceRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Service right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Skeleton css={{ height: '$7', width: '320px', mb: '$8' }} data-testid="skeleton" />
         <SpacedColumns>
           <DetailSectionSkeleton narrow />
@@ -288,7 +294,7 @@ export const HttpServiceRender = ({ data, error, name }: HttpServiceRenderProps)
           <DetailSectionSkeleton narrow />
         </SpacedColumns>
         <UsedByRoutersSkeleton />
-      </Page>
+      </>
     )
   }
 
@@ -297,11 +303,14 @@ export const HttpServiceRender = ({ data, error, name }: HttpServiceRenderProps)
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <H1 css={{ mb: '$7' }}>{data.name}</H1>
       <ServicePanels data={data} protocol="http" />
       <UsedByRoutersSection data={data} protocol="http" />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/http/HttpServices.spec.tsx b/webui/src/pages/http/HttpServices.spec.tsx
index 720fc2549..31a749c8c 100644
--- a/webui/src/pages/http/HttpServices.spec.tsx
+++ b/webui/src/pages/http/HttpServices.spec.tsx
@@ -49,10 +49,13 @@ describe('<HttpServicesPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<HttpServicesPage />)
+    const { container, getByTestId } = renderWithProviders(<HttpServicesPage />, {
+      route: '/http/services',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('HTTP Services page')).toBeInTheDocument()
+    expect(getByTestId('/http/services page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(4)
 
@@ -92,6 +95,7 @@ describe('<HttpServicesPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/http/services', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/http/HttpServices.tsx b/webui/src/pages/http/HttpServices.tsx
index 6febd6b1f..e49bc82b6 100644
--- a/webui/src/pages/http/HttpServices.tsx
+++ b/webui/src/pages/http/HttpServices.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex, Text } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -13,8 +14,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (): RenderRowType => {
   const HttpServicesRenderRow = (row) => (
@@ -78,9 +78,7 @@ export const HttpServicesRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -108,7 +106,10 @@ export const HttpServices = () => {
   )
 
   return (
-    <Page title="HTTP Services">
+    <>
+      <Helmet>
+        <title>HTTP Services - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <HttpServicesRender
         error={error}
@@ -119,6 +120,6 @@ export const HttpServices = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/hub-demo/HubDashboard.spec.tsx b/webui/src/pages/hub-demo/HubDashboard.spec.tsx
new file mode 100644
index 000000000..f5b479586
--- /dev/null
+++ b/webui/src/pages/hub-demo/HubDashboard.spec.tsx
@@ -0,0 +1,204 @@
+import { waitFor } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+import { PUBLIC_KEY } from './constants'
+import HubDashboard, { resetCache } from './HubDashboard'
+
+import { renderWithProviders } from 'utils/test'
+import verifySignature from 'utils/workers/scriptVerification'
+
+vi.mock('utils/workers/scriptVerification', () => ({
+  default: vi.fn(),
+}))
+
+vi.mock('react-router-dom', async () => {
+  const actual = await vi.importActual('react-router-dom')
+  return {
+    ...actual,
+    useParams: vi.fn(() => ({ id: 'test-id' })),
+  }
+})
+
+vi.mock('hooks/use-theme', () => ({
+  useIsDarkMode: vi.fn(() => false),
+  useTheme: vi.fn(() => ({
+    selectedTheme: 'light',
+    appliedTheme: 'light',
+    setTheme: vi.fn(),
+  })),
+}))
+
+describe('HubDashboard demo', () => {
+  const mockVerifyScriptSignature = vi.mocked(verifySignature)
+  let mockCreateObjectURL: ReturnType<typeof vi.fn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    mockCreateObjectURL = vi.fn(() => 'blob:mock-url')
+    globalThis.URL.createObjectURL = mockCreateObjectURL
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  describe('without cache', () => {
+    beforeEach(() => {
+      resetCache()
+    })
+
+    it('should render loading state during script verification', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockImplementation(
+        () =>
+          new Promise((resolve) =>
+            setTimeout(() => resolve({ verified: true, scriptContent: mockScriptContent }), 100),
+          ),
+      )
+
+      const { getByTestId } = renderWithProviders(<HubDashboard path="dashboard" />, {
+        route: '/hub-dashboard',
+      })
+
+      expect(getByTestId('loading')).toBeInTheDocument()
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+    })
+
+    it('should render the custom web component when signature is verified', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockResolvedValue({ verified: true, scriptContent: mockScriptContent })
+
+      const { container } = renderWithProviders(<HubDashboard path="dashboard" />, {
+        route: '/hub-dashboard',
+      })
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+
+      const hubComponent = container.querySelector('hub-ui-demo-app')
+      expect(hubComponent).toBeInTheDocument()
+      expect(hubComponent?.getAttribute('path')).toBe('dashboard')
+      expect(hubComponent?.getAttribute('baseurl')).toBe('#/hub-dashboard')
+      expect(hubComponent?.getAttribute('theme')).toBe('light')
+    })
+
+    it('should render error state when signature verification fails', async () => {
+      mockVerifyScriptSignature.mockResolvedValue({ verified: false })
+
+      const { container } = renderWithProviders(<HubDashboard path="dashboard" />)
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+
+      expect(container.textContent).toContain("Oops! We couldn't load the demo content")
+
+      const errorImage = container.querySelector('img[src="/img/gopher-something-went-wrong.png"]')
+      expect(errorImage).toBeInTheDocument()
+
+      const links = container.querySelectorAll('a')
+      const websiteLink = Array.from(links).find((link) => link.href.includes('traefik.io/traefik-hub'))
+      const docLink = Array.from(links).find((link) => link.href.includes('doc.traefik.io/traefik-hub'))
+
+      expect(websiteLink).toBeInTheDocument()
+      expect(docLink).toBeInTheDocument()
+    })
+
+    it('should render error state when verification throws an error', async () => {
+      mockVerifyScriptSignature.mockRejectedValue(new Error('Network error'))
+
+      const { container } = renderWithProviders(<HubDashboard path="dashboard" />)
+
+      await waitFor(() => {
+        expect(container.textContent).toContain("Oops! We couldn't load the demo content")
+      })
+    })
+
+    it('should call verifyScriptSignature with correct parameters', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockResolvedValue({ verified: true, scriptContent: mockScriptContent })
+
+      renderWithProviders(<HubDashboard path="dashboard" />)
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledWith(
+          'https://assets.traefik.io/hub-ui-demo.js',
+          'https://assets.traefik.io/hub-ui-demo.js.sig',
+          PUBLIC_KEY,
+        )
+      })
+    })
+
+    it('should set theme attribute based on dark mode', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockResolvedValue({ verified: true, scriptContent: mockScriptContent })
+
+      const { container } = renderWithProviders(<HubDashboard path="dashboard" />)
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+
+      const hubComponent = container.querySelector('hub-ui-demo-app')
+
+      expect(hubComponent?.getAttribute('theme')).toMatch(/light|dark/)
+    })
+
+    it('should handle path with :id parameter correctly', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockResolvedValue({ verified: true, scriptContent: mockScriptContent })
+
+      const { container } = renderWithProviders(<HubDashboard path="gateways:id" />)
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+
+      const hubComponent = container.querySelector('hub-ui-demo-app')
+      expect(hubComponent).toBeInTheDocument()
+      expect(hubComponent?.getAttribute('path')).toBe('gateways/test-id')
+    })
+  })
+
+  describe('with cache', () => {
+    beforeEach(() => {
+      resetCache()
+    })
+
+    it('should use cached blob URL without calling verifySignature again', async () => {
+      const mockScriptContent = new ArrayBuffer(100)
+      mockVerifyScriptSignature.mockResolvedValue({ verified: true, scriptContent: mockScriptContent })
+
+      // First render
+      const { container: firstContainer, unmount: firstUnmount } = renderWithProviders(
+        <HubDashboard path="dashboard" />,
+      )
+
+      await waitFor(() => {
+        expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(1)
+      })
+
+      const firstHubComponent = firstContainer.querySelector('hub-ui-demo-app')
+      expect(firstHubComponent).toBeInTheDocument()
+
+      firstUnmount()
+
+      mockVerifyScriptSignature.mockClear()
+
+      // Second render - should use cache
+      const { container: secondContainer } = renderWithProviders(<HubDashboard path="dashboard" />)
+
+      await waitFor(() => {
+        const secondHubComponent = secondContainer.querySelector('hub-ui-demo-app')
+        expect(secondHubComponent).toBeInTheDocument()
+      })
+
+      expect(mockVerifyScriptSignature).toHaveBeenCalledTimes(0)
+    })
+  })
+})
diff --git a/webui/src/pages/hub-demo/HubDashboard.tsx b/webui/src/pages/hub-demo/HubDashboard.tsx
new file mode 100644
index 000000000..9dd14c9c8
--- /dev/null
+++ b/webui/src/pages/hub-demo/HubDashboard.tsx
@@ -0,0 +1,149 @@
+import { Box, Flex, Image, Link, Text } from '@traefiklabs/faency'
+import { useMemo, useEffect, useState } from 'react'
+import { Helmet } from 'react-helmet-async'
+import { useParams } from 'react-router-dom'
+
+import verifySignature from '../../utils/workers/scriptVerification'
+
+import { PUBLIC_KEY } from './constants'
+
+import { SpinnerLoader } from 'components/SpinnerLoader'
+import { useIsDarkMode } from 'hooks/use-theme'
+import { TopNav } from 'layout/Navigation'
+
+const SCRIPT_URL = 'https://assets.traefik.io/hub-ui-demo.js'
+
+// Module-level cache to persist across component mount/unmount
+let cachedBlobUrl: string | null = null
+
+// Export a function to reset the cache (for testing)
+export const resetCache = () => {
+  cachedBlobUrl = null
+}
+
+const HubDashboard = ({ path }: { path: string }) => {
+  const isDarkMode = useIsDarkMode()
+  const [scriptError, setScriptError] = useState<boolean | undefined>(undefined)
+  const [signatureVerified, setSignatureVerified] = useState(false)
+  const [verificationInProgress, setVerificationInProgress] = useState(false)
+  const [scriptBlobUrl, setScriptBlobUrl] = useState<string | null>(null)
+
+  const { id } = useParams()
+
+  const usedPath = useMemo(() => {
+    if (path?.includes(':id')) {
+      const splitted = path.split(':')
+      return `${splitted[0]}/${id}`
+    }
+
+    return path
+  }, [id, path])
+
+  useEffect(() => {
+    const verifyAndLoadScript = async () => {
+      setVerificationInProgress(true)
+
+      try {
+        const { verified, scriptContent: content } = await verifySignature(SCRIPT_URL, `${SCRIPT_URL}.sig`, PUBLIC_KEY)
+
+        if (!verified || !content) {
+          setScriptError(true)
+          setVerificationInProgress(false)
+        } else {
+          setScriptError(false)
+
+          const blob = new Blob([content], { type: 'application/javascript' })
+          cachedBlobUrl = URL.createObjectURL(blob)
+
+          setScriptBlobUrl(cachedBlobUrl)
+          setSignatureVerified(true)
+          setVerificationInProgress(false)
+        }
+      } catch {
+        setScriptError(true)
+        setVerificationInProgress(false)
+      }
+    }
+
+    if (!cachedBlobUrl) {
+      verifyAndLoadScript()
+    } else {
+      setScriptBlobUrl(cachedBlobUrl)
+      setSignatureVerified(true)
+    }
+  }, [])
+
+  if (scriptError && !verificationInProgress) {
+    return (
+      <Flex gap={4} align="center" justify="center" direction="column" css={{ width: '100%', mt: '$8', maxWidth: 690 }}>
+        <Image src="/img/gopher-something-went-wrong.png" width={400} />
+        <Text css={{ fontSize: 24, fontWeight: '$semiBold' }}>Oops! We couldn't load the demo content.</Text>
+        <Text size={6} css={{ textAlign: 'center', lineHeight: 1.4 }}>
+          Don't worry — you can still learn more about{' '}
+          <Text size={6} css={{ fontWeight: '$semiBold' }}>
+            Traefik Hub API Management
+          </Text>{' '}
+          on our{' '}
+          <Link
+            href="https://traefik.io/traefik-hub?utm_campaign=hub-demo&utm_source=proxy-button&utm_medium=in-product"
+            target="_blank"
+          >
+            website
+          </Link>{' '}
+          or in our{' '}
+          <Link href="https://doc.traefik.io/traefik-hub/" target="_blank">
+            documentation
+          </Link>
+          .
+        </Text>
+      </Flex>
+    )
+  }
+
+  return (
+    <Box css={{ width: '100%' }}>
+      <Helmet>
+        <title>Hub Demo - Traefik Proxy</title>
+        <meta
+          httpEquiv="Content-Security-Policy"
+          content="script-src 'self' blob: 'unsafe-inline'; object-src 'none'; base-uri 'self';"
+        />
+        {signatureVerified && scriptBlobUrl && <script src={scriptBlobUrl} type="module"></script>}
+      </Helmet>
+      <Box
+        css={{
+          margin: 'auto',
+          position: 'relative',
+          maxWidth: '1334px',
+          '@media (max-width:1440px)': {
+            maxWidth: '100%',
+          },
+        }}
+      >
+        <TopNav noHubButton css={{ position: 'absolute', top: 125, right: '$5' }} />
+      </Box>
+      {verificationInProgress ? (
+        <Box css={{ width: '100%', justifyItems: 'center', mt: '$8' }}>
+          <SpinnerLoader size={48} />
+        </Box>
+      ) : (
+        <hub-ui-demo-app
+          key={usedPath}
+          path={usedPath}
+          theme={isDarkMode ? 'dark' : 'light'}
+          baseurl="#/hub-dashboard"
+          containercss={JSON.stringify({
+            maxWidth: '1334px',
+            '@media (max-width:1440px)': {
+              maxWidth: '100%',
+            },
+            margin: 'auto',
+            marginTop: '90px',
+          })}
+        ></hub-ui-demo-app>
+      )}
+    </Box>
+  )
+}
+
+export default HubDashboard
diff --git a/webui/src/pages/hub-demo/HubDemoNav.tsx b/webui/src/pages/hub-demo/HubDemoNav.tsx
new file mode 100644
index 000000000..eba41dc07
--- /dev/null
+++ b/webui/src/pages/hub-demo/HubDemoNav.tsx
@@ -0,0 +1,84 @@
+import { Badge, Box, Flex, Text } from '@traefiklabs/faency'
+import { useContext, useState } from 'react'
+import { BsChevronRight } from 'react-icons/bs'
+
+import { HubDemoContext } from './demoNavContext'
+import { HubIcon } from './icons'
+
+import Tooltip from 'components/Tooltip'
+import { BasicNavigationItem, LAPTOP_BP } from 'layout/Navigation'
+
+const ApimDemoNavMenu = ({
+  isResponsive,
+  isSmallScreen,
+  isExpanded,
+}: {
+  isResponsive: boolean
+  isSmallScreen: boolean
+  isExpanded: boolean
+}) => {
+  const [isCollapsed, setIsCollapsed] = useState(false)
+  const { navigationItems: hubDemoNavItems } = useContext(HubDemoContext)
+
+  if (!hubDemoNavItems) {
+    return null
+  }
+
+  return (
+    <Flex direction="column" css={{ borderTop: '1px solid $colors$tableRowBorder', borderRadius: 0, pt: '$3' }}>
+      <Flex
+        align="center"
+        css={{ color: '$grayBlue9', my: '$2', cursor: 'pointer' }}
+        onClick={() => setIsCollapsed(!isCollapsed)}
+      >
+        <BsChevronRight
+          size={12}
+          style={{
+            transform: isCollapsed ? 'rotate(90deg)' : 'unset',
+            transition: 'transform 0.3s ease-in-out',
+          }}
+        />
+        {isSmallScreen ? (
+          <Tooltip label="Hub demo">
+            <Box css={{ ml: 4, color: '$navButtonText' }}>
+              <HubIcon width={20} />
+            </Box>
+          </Tooltip>
+        ) : (
+          <>
+            <Text
+              css={{
+                fontWeight: 600,
+                textTransform: 'uppercase',
+                letterSpacing: 0.2,
+                color: '$grayBlue9',
+                ml: 8,
+                [`@media (max-width:${LAPTOP_BP}px)`]: isResponsive ? { display: 'none' } : undefined,
+              }}
+            >
+              API management
+            </Text>
+            <Badge variant="green" css={{ ml: '$2' }}>
+              Demo
+            </Badge>
+          </>
+        )}
+      </Flex>
+
+      <Box
+        css={{ mt: '$1', transition: 'max-height 0.3s ease-out', maxHeight: isCollapsed ? 500 : 0, overflow: 'hidden' }}
+      >
+        {hubDemoNavItems.map((route, idx) => (
+          <BasicNavigationItem
+            key={`apim-${idx}`}
+            route={route}
+            isSmallScreen={isSmallScreen}
+            isExpanded={isExpanded}
+          />
+        ))}
+      </Box>
+    </Flex>
+  )
+}
+
+export default ApimDemoNavMenu
diff --git a/webui/src/pages/hub-demo/constants.ts b/webui/src/pages/hub-demo/constants.ts
new file mode 100644
index 000000000..7cd4ec038
--- /dev/null
+++ b/webui/src/pages/hub-demo/constants.ts
@@ -0,0 +1 @@
+export const PUBLIC_KEY = 'MCowBQYDK2VwAyEAWMBZ0pMBaL/s8gNXxpAPCIQ8bxjnuz6bQFwGYvjXDfg='
diff --git a/webui/src/pages/hub-demo/demoNavContext.tsx b/webui/src/pages/hub-demo/demoNavContext.tsx
new file mode 100644
index 000000000..3f28afc78
--- /dev/null
+++ b/webui/src/pages/hub-demo/demoNavContext.tsx
@@ -0,0 +1,15 @@
+import { createContext } from 'react'
+import { RouteObject } from 'react-router-dom'
+
+import { useHubDemo } from './use-hub-demo'
+
+export const HubDemoContext = createContext<{
+  routes: RouteObject[] | null
+  navigationItems: HubDemo.NavItem[] | null
+}>({ routes: null, navigationItems: null })
+
+export const HubDemoProvider = ({ basePath, children }) => {
+  const { routes, navigationItems } = useHubDemo(basePath)
+
+  return <HubDemoContext.Provider value={{ routes, navigationItems }}>{children}</HubDemoContext.Provider>
+}
diff --git a/webui/src/pages/hub-demo/hub-demo.d.ts b/webui/src/pages/hub-demo/hub-demo.d.ts
new file mode 100644
index 000000000..31c6cfde7
--- /dev/null
+++ b/webui/src/pages/hub-demo/hub-demo.d.ts
@@ -0,0 +1,21 @@
+namespace HubDemo {
+  interface Route {
+    path: string
+    label: string
+    icon: string
+    contentPath: string
+    dynamicSegments?: string[]
+    activeMatches?: string[]
+  }
+
+  interface Manifest {
+    routes: Route[]
+  }
+
+  interface NavItem {
+    path: string
+    label: string
+    icon: ReactNode
+    activeMatches?: string[]
+  }
+}
diff --git a/webui/src/pages/hub-demo/icons/api.tsx b/webui/src/pages/hub-demo/icons/api.tsx
new file mode 100644
index 000000000..04b51da6f
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/api.tsx
@@ -0,0 +1,68 @@
+import { Flex } from '@traefiklabs/faency'
+import { useId } from 'react'
+
+import { CustomIconProps } from 'components/icons'
+
+const ApiIcon = ({ color = 'currentColor', css = {}, ...props }: CustomIconProps) => {
+  const linearGradient1Id = useId()
+  const linearGradient2Id = useId()
+  const linearGradient3Id = useId()
+  const titleId = useId()
+
+  return (
+    <Flex css={css}>
+      <svg
+        xmlns="http://www.w3.org/2000/svg"
+        aria-labelledby={titleId}
+        width="24"
+        height="24"
+        viewBox="0 0 24 24"
+        role="img"
+        {...props}
+      >
+        <title id={titleId}>apis</title>
+        <defs>
+          <linearGradient x1="71.828%" y1="92.873%" x2="35.088%" y2="3.988%" id={linearGradient1Id}>
+            <stop stopColor={color} offset="0%" />
+            <stop stopColor={color} stopOpacity="0" offset="100%" />
+          </linearGradient>
+          <linearGradient x1="64.659%" y1="7.289%" x2="29.649%" y2="91.224%" id={linearGradient2Id}>
+            <stop stopColor={color} offset="0%" />
+            <stop stopColor={color} stopOpacity="0" offset="100%" />
+          </linearGradient>
+          <linearGradient x1="10.523%" y1="76.967%" x2="87.277%" y2="76.967%" id={linearGradient3Id}>
+            <stop stopColor={color} offset="0%" />
+            <stop stopColor={color} stopOpacity="0" offset="100%" />
+          </linearGradient>
+        </defs>
+        <g fill="none" fillRule="evenodd">
+          <path
+            d="M12.425 19.85a7.425 7.425 0 1 0 0-14.85 7.425 7.425 0 0 0 0 14.85z"
+            stroke={color}
+            strokeWidth="1.35"
+            opacity=".7"
+            strokeLinejoin="round"
+          />
+          <path
+            d="M3.375 7.425c0-.411.061-.809.175-1.183l-1.22-.61a5.401 5.401 0 0 0 4.42 7.151V11.42a4.051 4.051 0 0 1-3.375-3.994z"
+            fill={`url(#${linearGradient1Id})`}
+            transform="translate(5 5)"
+          />
+          <path
+            d="M8.1 11.419v1.364a5.401 5.401 0 0 0 4.42-7.15l-1.22.61a4.051 4.051 0 0 1-3.2 5.177z"
+            fill={`url(#${linearGradient2Id})`}
+            transform="translate(5 5)"
+          />
+          <path
+            d="M7.425 3.375a4.044 4.044 0 0 0-3.27 1.66l-1.22-.61a5.395 5.395 0 0 1 4.49-2.4c1.872 0 3.522.953 4.49 2.4l-1.22.61a4.044 4.044 0 0 0-3.27-1.66z"
+            fill={`url(#${linearGradient3Id})`}
+            transform="translate(5 5)"
+          />
+          <path d="M12.425 14.45a2.025 2.025 0 1 0 0-4.05 2.025 2.025 0 0 0 0 4.05z" fill={color} fillRule="nonzero" />
+        </g>
+      </svg>
+    </Flex>
+  )
+}
+
+export default ApiIcon
diff --git a/webui/src/pages/hub-demo/icons/dashboard.tsx b/webui/src/pages/hub-demo/icons/dashboard.tsx
new file mode 100644
index 000000000..44ab47aa6
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/dashboard.tsx
@@ -0,0 +1,28 @@
+import { Flex } from '@traefiklabs/faency'
+
+import { CustomIconProps } from 'components/icons'
+
+const DashboardIcon = ({ color = 'currentColor', css = {}, ...props }: CustomIconProps) => {
+  return (
+    <Flex css={css}>
+      <svg
+        width="24"
+        height="24"
+        viewBox="0 0 24 24"
+        xmlns="http://www.w3.org/2000/svg"
+        role="img"
+        aria-labelledby="dashboard-icon"
+        {...props}
+      >
+        <title id="dashboard-icon">dashboard</title>
+        <g stroke={color} strokeWidth="1.35" fill="none" fillRule="evenodd" strokeLinejoin="round">
+          <path opacity=".7" d="M11.075 5H5v6.075h6.075z" />
+          <path d="M19.85 5h-6.075v6.075h6.075zM11.075 13.775H5v6.075h6.075z" />
+          <path opacity=".7" d="M19.85 13.775h-6.075v6.075h6.075z" />
+        </g>
+      </svg>
+    </Flex>
+  )
+}
+
+export default DashboardIcon
diff --git a/webui/src/pages/hub-demo/icons/gateway.tsx b/webui/src/pages/hub-demo/icons/gateway.tsx
new file mode 100644
index 000000000..d1f682bf4
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/gateway.tsx
@@ -0,0 +1,69 @@
+import { Flex } from '@traefiklabs/faency'
+import { useId } from 'react'
+
+import { CustomIconProps } from 'components/icons'
+
+const GatewayIcon = ({ color = 'currentColor', css = {}, ...props }: CustomIconProps) => {
+  const titleId = useId()
+
+  return (
+    <Flex css={css}>
+      <svg
+        width="48px"
+        height="48px"
+        viewBox="0 0 48 48"
+        version="1.1"
+        xmlns="http://www.w3.org/2000/svg"
+        xmlnsXlink="http://www.w3.org/1999/xlink"
+        {...props}
+      >
+        <title id={titleId}>gateways_icon</title>
+        <defs>
+          <linearGradient x1="50%" y1="100%" x2="50%" y2="-30.9671875%" id="linearGradient-1">
+            <stop stopColor={color} stopOpacity="0.322497815" offset="0%"></stop>
+            <stop stopColor={color} stopOpacity="0" offset="100%"></stop>
+          </linearGradient>
+          <linearGradient x1="50%" y1="100%" x2="50%" y2="-30.9671875%" id="linearGradient-2">
+            <stop stopColor={color} stopOpacity="0.322497815" offset="0%"></stop>
+            <stop stopColor={color} stopOpacity="0" offset="100%"></stop>
+          </linearGradient>
+          <linearGradient x1="100%" y1="50%" x2="-5.3329563e-11%" y2="50%" id={`linearGradient-3-${titleId}`}>
+            <stop stopColor={color} offset="0%"></stop>
+            <stop stopColor={color} stopOpacity="0.2" offset="100%"></stop>
+          </linearGradient>
+        </defs>
+        <g id={titleId} stroke="none" strokeWidth="1" fill="none" fillRule="evenodd">
+          <g id="Dashboard-Component-States" transform="translate(-819, -59)">
+            <g id="Icon" transform="translate(823, 67)">
+              <path
+                d="M11.8810613,8.00728271 L11.8810613,21.2735224 L20.1151876,25.72 L28.3494968,21.2735224 L28.3494968,8.00728271 C28.3494968,8.00728271 25.6047575,5.72 20.115279,5.72 C14.6258005,5.72 11.8810613,8.00728271 11.8810613,8.00728271 Z"
+                id="Rectangle-37"
+                fill="url(#linearGradient-2)"
+              ></path>
+              <path
+                d="M15.1747484,11.0923696 L15.1747484,19.0521134 L20.1152242,21.72 L25.0558097,19.0521134 L25.0558097,11.0923696 C25.0558097,11.0923696 23.4089661,9.72 20.115279,9.72 C16.8215919,9.72 15.1747484,11.0923696 15.1747484,11.0923696 Z"
+                id="Rectangle-37"
+                fill={color}
+              ></path>
+              <path
+                d="M10.65,2.32629257 L10.65,29.6737074 L1.35,24.3594217 L1.35,7.64057828 L10.65,2.32629257 Z"
+                id="Rectangle"
+                stroke={`url(#linearGradient-3-${titleId})`}
+                strokeWidth="2.7"
+              ></path>
+              <path
+                d="M38.65,2.32629257 L38.65,29.6737074 L29.35,24.3594217 L29.35,7.64057828 L38.65,2.32629257 Z"
+                id="Rectangle"
+                stroke={`url(#linearGradient-3-${titleId})`}
+                strokeWidth="2.7"
+                transform="translate(34, 16) scale(-1, 1) translate(-34, -16)"
+              ></path>
+            </g>
+          </g>
+        </g>
+      </svg>
+    </Flex>
+  )
+}
+
+export default GatewayIcon
diff --git a/webui/src/pages/hub-demo/icons/hub.tsx b/webui/src/pages/hub-demo/icons/hub.tsx
new file mode 100644
index 000000000..64050576f
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/hub.tsx
@@ -0,0 +1,18 @@
+import { CustomIconProps } from 'components/icons'
+
+const Hub = (props: CustomIconProps) => {
+  const { color = 'currentColor', ...restProps } = props
+
+  return (
+    <svg xmlns="http://www.w3.org/2000/svg" {...restProps} viewBox="0 0 128 116">
+      <g>
+        <path
+          fill={color}
+          d="M66.315.61l29.558 16.035a5.084 5.084 0 012.653 4.476l-.025 25.835 26.846 14.565A5.084 5.084 0 01128 65.997l-.029 28.824a5.084 5.084 0 01-2.643 4.46l-29.53 16.104a5.029 5.029 0 01-4.857-.021l-26.737-14.896-27.353 14.917a5.029 5.029 0 01-4.857-.021L2.604 98.99A5.085 5.085 0 010 94.547V66.06c0-1.86 1.01-3.571 2.635-4.461l26.839-14.706v-25.71c0-1.859 1.01-3.57 2.635-4.46L61.499.619a5.028 5.028 0 014.816-.01zm25.49 56.008L70.81 68.115a3.39 3.39 0 00-1.757 2.975v18.47a3.39 3.39 0 001.736 2.962l21.01 11.705a3.352 3.352 0 003.239.014l21.07-11.49a3.39 3.39 0 001.763-2.974l.018-18.731a3.39 3.39 0 00-1.768-2.984l-21.106-11.45a3.352 3.352 0 00-3.21.006zm-58.959-.001L11.862 68.115a3.39 3.39 0 00-1.757 2.974v18.47a3.39 3.39 0 001.736 2.963l21.011 11.705a3.352 3.352 0 003.239.014l21.07-11.49a3.39 3.39 0 001.763-2.974l.018-18.676a3.39 3.39 0 00-1.763-2.981L36.063 56.613a3.352 3.352 0 00-3.217.004zm29.478-44.878l-20.988 11.5a3.39 3.39 0 00-1.757 2.974V44.68a3.39 3.39 0 001.742 2.966l21.065 11.679a3.352 3.352 0 003.233.01l21.017-11.467a3.39 3.39 0 001.762-2.974l.018-18.723a3.39 3.39 0 00-1.77-2.984l-21.11-11.454a3.352 3.352 0 00-3.212.007z"
+        ></path>
+      </g>
+    </svg>
+  )
+}
+
+export default Hub
diff --git a/webui/src/pages/hub-demo/icons/index.ts b/webui/src/pages/hub-demo/icons/index.ts
new file mode 100644
index 000000000..5118c0fe4
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/index.ts
@@ -0,0 +1,5 @@
+export { default as ApiIcon } from './api'
+export { default as DashboardIcon } from './dashboard'
+export { default as GatewayIcon } from './gateway'
+export { default as HubIcon } from './hub'
+export { default as PortalIcon } from './portal'
diff --git a/webui/src/pages/hub-demo/icons/portal.tsx b/webui/src/pages/hub-demo/icons/portal.tsx
new file mode 100644
index 000000000..a21413ce8
--- /dev/null
+++ b/webui/src/pages/hub-demo/icons/portal.tsx
@@ -0,0 +1,48 @@
+import { Flex } from '@traefiklabs/faency'
+import { useId } from 'react'
+
+import { CustomIconProps } from 'components/icons'
+
+const PortalIcon = ({ color = 'currentColor', css = {}, ...props }: CustomIconProps) => {
+  const linearGradientId = useId()
+  const titleId = useId()
+
+  return (
+    <Flex css={css}>
+      <svg
+        xmlns="http://www.w3.org/2000/svg"
+        aria-labelledby={titleId}
+        width="24"
+        height="24"
+        viewBox="0 0 24 24"
+        role="img"
+        {...props}
+      >
+        <title id={titleId}>portals</title>
+        <defs>
+          <linearGradient x1="50%" y1="17.22%" x2="50%" y2="100%" id={linearGradientId}>
+            <stop stopColor={color} offset="0%" />
+            <stop stopColor={color} stopOpacity=".468" offset="100%" />
+          </linearGradient>
+        </defs>
+        <g fill="none" fillRule="evenodd">
+          <path
+            stroke={`url(#${linearGradientId})`}
+            strokeWidth="1.35"
+            strokeLinejoin="round"
+            d="M14.85 0H0v13.5h14.85z"
+            transform="translate(5 5)"
+          />
+          <path
+            d="M7.7 7.7a.675.675 0 1 0 0-1.35.675.675 0 0 0 0 1.35zM10.4 7.7a.675.675 0 1 0 0-1.35.675.675 0 0 0 0 1.35z"
+            fill={color}
+            fillRule="nonzero"
+          />
+          <path stroke={color} strokeWidth="1.35" strokeLinejoin="round" d="M5 9.05h14.85" />
+        </g>
+      </svg>
+    </Flex>
+  )
+}
+
+export default PortalIcon
diff --git a/webui/src/pages/hub-demo/use-hub-demo.spec.tsx b/webui/src/pages/hub-demo/use-hub-demo.spec.tsx
new file mode 100644
index 000000000..6d77c1d39
--- /dev/null
+++ b/webui/src/pages/hub-demo/use-hub-demo.spec.tsx
@@ -0,0 +1,302 @@
+import { renderHook, waitFor } from '@testing-library/react'
+import { ReactNode } from 'react'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+import { useHubDemo } from './use-hub-demo'
+
+import verifySignature from 'utils/workers/scriptVerification'
+
+vi.mock('utils/workers/scriptVerification', () => ({
+  default: vi.fn(),
+}))
+
+const MOCK_ROUTES_MANIFEST = {
+  routes: [
+    {
+      path: '/dashboard',
+      label: 'Dashboard',
+      icon: 'dashboard',
+      contentPath: 'dashboard',
+    },
+    {
+      path: '/gateway',
+      label: 'Gateway',
+      icon: 'gateway',
+      contentPath: 'gateway',
+      dynamicSegments: [':id'],
+      activeMatches: ['/gateway/:id'],
+    },
+  ],
+}
+
+describe('useHubDemo', () => {
+  const mockVerifySignature = vi.mocked(verifySignature)
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  const setupMockVerification = (manifest: HubDemo.Manifest) => {
+    const encoder = new TextEncoder()
+    const mockScriptContent = encoder.encode(JSON.stringify(manifest))
+
+    mockVerifySignature.mockResolvedValue({
+      verified: true,
+      scriptContent: mockScriptContent.buffer,
+    })
+  }
+
+  describe('basic functions', () => {
+    const mockVerifySignature = vi.mocked(verifySignature)
+
+    beforeEach(() => {
+      vi.clearAllMocks()
+    })
+
+    afterEach(() => {
+      vi.restoreAllMocks()
+    })
+
+    it('should return null when signature verification fails', async () => {
+      mockVerifySignature.mockResolvedValue({
+        verified: false,
+      })
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(mockVerifySignature).toHaveBeenCalled()
+      })
+
+      await new Promise((resolve) => setTimeout(resolve, 10))
+
+      expect(result.current.routes).toBeNull()
+      expect(result.current.navigationItems).toBeNull()
+    })
+
+    it('should return null when scriptContent is missing', async () => {
+      mockVerifySignature.mockResolvedValue({
+        verified: true,
+        scriptContent: undefined,
+      })
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(mockVerifySignature).toHaveBeenCalled()
+      })
+
+      await new Promise((resolve) => setTimeout(resolve, 10))
+
+      expect(result.current.routes).toBeNull()
+      expect(result.current.navigationItems).toBeNull()
+    })
+
+    it('should handle errors during manifest fetch', async () => {
+      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+      mockVerifySignature.mockRejectedValue(new Error('Network error'))
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(consoleErrorSpy).toHaveBeenCalledWith('Failed to load hub demo manifest:', expect.any(Error))
+      })
+
+      expect(result.current.routes).toBeNull()
+      expect(result.current.navigationItems).toBeNull()
+
+      consoleErrorSpy.mockRestore()
+    })
+
+    it('should handle invalid JSON in manifest', async () => {
+      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+      const encoder = new TextEncoder()
+      const invalidJson = encoder.encode('{ invalid json }')
+
+      mockVerifySignature.mockResolvedValue({
+        verified: true,
+        scriptContent: invalidJson.buffer,
+      })
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(consoleErrorSpy).toHaveBeenCalledWith('Failed to load hub demo manifest:', expect.any(Error))
+      })
+
+      expect(result.current.routes).toBeNull()
+      expect(result.current.navigationItems).toBeNull()
+
+      consoleErrorSpy.mockRestore()
+    })
+  })
+
+  describe('routes generation', () => {
+    it('should generate routes with correct base path', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.routes).not.toBeNull()
+      })
+
+      expect(result.current.routes).toHaveLength(3)
+      expect(result.current.routes![0].path).toBe('/hub/dashboard')
+      expect(result.current.routes![1].path).toBe('/hub/gateway')
+      expect(result.current.routes![2].path).toBe('/hub/gateway/:id')
+    })
+
+    it('should generate routes for dynamic segments', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.routes).not.toBeNull()
+      })
+
+      expect(result.current.routes).toHaveLength(3)
+      expect(result.current.routes![0].path).toBe('/hub/dashboard')
+      expect(result.current.routes![1].path).toBe('/hub/gateway')
+      expect(result.current.routes![2].path).toBe('/hub/gateway/:id')
+    })
+
+    it('should render HubDashboard with correct contentPath for dynamic segments', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.routes).not.toBeNull()
+      })
+
+      const baseRoute = result.current.routes![1]
+      const dynamicRoute = result.current.routes![2]
+
+      expect(baseRoute.element).toBeDefined()
+      expect(dynamicRoute.element).toBeDefined()
+
+      const baseElement = baseRoute.element as ReactNode & { props?: { path: string } }
+      const dynamicElement = dynamicRoute.element as ReactNode & { props?: { path: string } }
+
+      expect((baseElement as { props: { path: string } }).props.path).toBe('gateway')
+      expect((dynamicElement as { props: { path: string } }).props.path).toBe('gateway:id')
+    })
+
+    it('should update routes when basePath changes', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result, rerender } = renderHook(({ basePath }) => useHubDemo(basePath), {
+        initialProps: { basePath: '/hub' },
+      })
+
+      await waitFor(() => {
+        expect(result.current.routes).not.toBeNull()
+      })
+
+      expect(result.current.routes![0].path).toBe('/hub/dashboard')
+
+      rerender({ basePath: '/demo' })
+
+      expect(result.current.routes![0].path).toBe('/demo/dashboard')
+    })
+  })
+
+  describe('navigation items generation', () => {
+    it('should generate navigation items with correct icons', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.navigationItems).not.toBeNull()
+      })
+
+      expect(result.current.navigationItems).toHaveLength(2)
+      expect(result.current.navigationItems![0].label).toBe('Dashboard')
+      expect(result.current.navigationItems![0].path).toBe('/hub/dashboard')
+      expect(result.current.navigationItems![0].icon).toBeDefined()
+      expect(result.current.navigationItems![1].label).toBe('Gateway')
+    })
+
+    it('should include activeMatches in navigation items', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.navigationItems).not.toBeNull()
+      })
+
+      expect(result.current.navigationItems![1].activeMatches).toEqual(['/hub/gateway/:id'])
+    })
+
+    it('should update navigation items when basePath changes', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result, rerender } = renderHook(({ basePath }) => useHubDemo(basePath), {
+        initialProps: { basePath: '/hub' },
+      })
+
+      await waitFor(() => {
+        expect(result.current.navigationItems).not.toBeNull()
+      })
+
+      expect(result.current.navigationItems![0].path).toBe('/hub/dashboard')
+
+      rerender({ basePath: '/demo' })
+
+      expect(result.current.navigationItems![0].path).toBe('/demo/dashboard')
+    })
+
+    it('should handle unknown icon types gracefully', async () => {
+      const manifestWithUnknownIcon: HubDemo.Manifest = {
+        routes: [
+          {
+            path: '/unknown',
+            label: 'Unknown',
+            icon: 'unknown-icon-type',
+            contentPath: 'unknown',
+          },
+        ],
+      }
+
+      setupMockVerification(manifestWithUnknownIcon)
+
+      const { result } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.navigationItems).not.toBeNull()
+      })
+
+      expect(result.current.navigationItems![0].icon).toBeUndefined()
+    })
+  })
+
+  describe('memoization', () => {
+    it('should not regenerate routes when manifest and basePath are unchanged', async () => {
+      setupMockVerification(MOCK_ROUTES_MANIFEST)
+
+      const { result, rerender } = renderHook(() => useHubDemo('/hub'))
+
+      await waitFor(() => {
+        expect(result.current.routes).not.toBeNull()
+      })
+
+      const firstRoutes = result.current.routes
+      const firstNavItems = result.current.navigationItems
+
+      rerender()
+
+      expect(result.current.routes).toBe(firstRoutes)
+      expect(result.current.navigationItems).toBe(firstNavItems)
+    })
+  })
+})
diff --git a/webui/src/pages/hub-demo/use-hub-demo.tsx b/webui/src/pages/hub-demo/use-hub-demo.tsx
new file mode 100644
index 000000000..b23109c17
--- /dev/null
+++ b/webui/src/pages/hub-demo/use-hub-demo.tsx
@@ -0,0 +1,95 @@
+import { ReactNode, useEffect, useMemo, useState } from 'react'
+import { RouteObject } from 'react-router-dom'
+
+import { PUBLIC_KEY } from './constants'
+
+import HubDashboard from 'pages/hub-demo/HubDashboard'
+import { ApiIcon, DashboardIcon, GatewayIcon, PortalIcon } from 'pages/hub-demo/icons'
+import verifySignature from 'utils/workers/scriptVerification'
+
+const ROUTES_MANIFEST_URL = 'https://traefik.github.io/hub-ui-demo-app/config/routes.json'
+
+const HUB_DEMO_NAV_ICONS: Record<string, ReactNode> = {
+  dashboard: <DashboardIcon color="currentColor" width={22} height={22} />,
+  gateway: <GatewayIcon color="currentColor" width={22} height={22} />,
+  api: <ApiIcon color="currentColor" width={22} height={22} />,
+  portal: <PortalIcon color="currentColor" width={22} height={22} />,
+}
+
+const useHubDemoRoutesManifest = (): HubDemo.Manifest | null => {
+  const [manifest, setManifest] = useState<HubDemo.Manifest | null>(null)
+
+  useEffect(() => {
+    const fetchManifest = async () => {
+      try {
+        const { verified, scriptContent } = await verifySignature(
+          ROUTES_MANIFEST_URL,
+          `${ROUTES_MANIFEST_URL}.sig`,
+          PUBLIC_KEY,
+        )
+
+        if (!verified || !scriptContent) {
+          setManifest(null)
+          return
+        }
+
+        const textDecoder = new TextDecoder()
+        const jsonString = textDecoder.decode(scriptContent)
+        const data: HubDemo.Manifest = JSON.parse(jsonString)
+        setManifest(data)
+      } catch (error) {
+        console.error('Failed to load hub demo manifest:', error)
+        setManifest(null)
+      }
+    }
+
+    fetchManifest()
+  }, [])
+
+  return manifest
+}
+
+export const useHubDemo = (basePath: string) => {
+  const manifest = useHubDemoRoutesManifest()
+
+  const routes = useMemo(() => {
+    if (!manifest) {
+      return null
+    }
+
+    const routeObjects: RouteObject[] = []
+
+    manifest.routes.forEach((route: HubDemo.Route) => {
+      routeObjects.push({
+        path: `${basePath}${route.path}`,
+        element: <HubDashboard path={route.contentPath} />,
+      })
+
+      if (route.dynamicSegments) {
+        route.dynamicSegments.forEach((segment) => {
+          routeObjects.push({
+            path: `${basePath}${route.path}/${segment}`,
+            element: <HubDashboard path={`${route.contentPath}${segment}`} />,
+          })
+        })
+      }
+    })
+
+    return routeObjects
+  }, [basePath, manifest])
+
+  const navigationItems = useMemo(() => {
+    if (!manifest) {
+      return null
+    }
+
+    return manifest.routes.map((route) => ({
+      path: `${basePath}${route.path}`,
+      label: route.label,
+      icon: HUB_DEMO_NAV_ICONS[route.icon],
+      activeMatches: route.activeMatches?.map((r) => `${basePath}${r}`),
+    }))
+  }, [basePath, manifest])
+
+  return { routes, navigationItems }
+}
diff --git a/webui/src/pages/tcp/TcpMiddleware.spec.tsx b/webui/src/pages/tcp/TcpMiddleware.spec.tsx
index b783e0958..73e69e01c 100644
--- a/webui/src/pages/tcp/TcpMiddleware.spec.tsx
+++ b/webui/src/pages/tcp/TcpMiddleware.spec.tsx
@@ -7,6 +7,7 @@ describe('<TcpMiddlewarePage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <TcpMiddlewareRender name="mock-middleware" data={undefined} error={new Error('Test error')} />,
+      { route: '/tcp/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<TcpMiddlewarePage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <TcpMiddlewareRender name="mock-middleware" data={undefined} error={undefined} />,
+      { route: '/tcp/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<TcpMiddlewarePage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <TcpMiddlewareRender name="mock-middleware" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/tcp/middlewares/mock-middleware', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -53,6 +56,7 @@ describe('<TcpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpMiddlewareRender name="mock-middleware" data={mockData as any} error={undefined} />,
+      { route: '/tcp/middlewares/middleware-simple', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -103,6 +107,7 @@ describe('<TcpMiddlewarePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpMiddlewareRender name="mock-middleware" data={mockData as any} error={undefined} />,
+      { route: '/tcp/middlewares/middleware-complex', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
diff --git a/webui/src/pages/tcp/TcpMiddleware.tsx b/webui/src/pages/tcp/TcpMiddleware.tsx
index f3637a46d..d85cf22ec 100644
--- a/webui/src/pages/tcp/TcpMiddleware.tsx
+++ b/webui/src/pages/tcp/TcpMiddleware.tsx
@@ -1,11 +1,11 @@
 import { Card, Box, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useParams } from 'react-router-dom'
 
 import { DetailSectionSkeleton } from 'components/resources/DetailSections'
 import { RenderMiddleware } from 'components/resources/MiddlewarePanel'
 import { UsedByRoutersSection, UsedByRoutersSkeleton } from 'components/resources/UsedByRoutersSection'
 import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { NotFound } from 'pages/NotFound'
 import breakpoints from 'utils/breakpoints'
 
@@ -27,23 +27,29 @@ type TcpMiddlewareRenderProps = {
 export const TcpMiddlewareRender = ({ data, error, name }: TcpMiddlewareRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Middleware right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Skeleton css={{ height: '$7', width: '320px', mb: '$4' }} data-testid="skeleton" />
         <MiddlewareGrid>
           <DetailSectionSkeleton />
         </MiddlewareGrid>
         <UsedByRoutersSkeleton />
-      </Page>
+      </>
     )
   }
 
@@ -52,7 +58,10 @@ export const TcpMiddlewareRender = ({ data, error, name }: TcpMiddlewareRenderPr
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <H1 css={{ mb: '$7' }}>{data.name}</H1>
       <MiddlewareGrid>
         <Card css={{ padding: '$5' }} data-testid="middleware-card">
@@ -60,7 +69,7 @@ export const TcpMiddlewareRender = ({ data, error, name }: TcpMiddlewareRenderPr
         </Card>
       </MiddlewareGrid>
       <UsedByRoutersSection data-testid="routers-table" data={data} protocol="tcp" />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/tcp/TcpMiddlewares.spec.tsx b/webui/src/pages/tcp/TcpMiddlewares.spec.tsx
index 3da9cfc5b..12e95f92f 100644
--- a/webui/src/pages/tcp/TcpMiddlewares.spec.tsx
+++ b/webui/src/pages/tcp/TcpMiddlewares.spec.tsx
@@ -29,10 +29,13 @@ describe('<TcpMiddlewaresPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<TcpMiddlewaresPage />)
+    const { container, getByTestId } = renderWithProviders(<TcpMiddlewaresPage />, {
+      route: '/tcp/middlewares',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('TCP Middlewares page')).toBeInTheDocument()
+    expect(getByTestId('/tcp/middlewares page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(2)
 
@@ -58,6 +61,7 @@ describe('<TcpMiddlewaresPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/tcp/middlewares', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/tcp/TcpMiddlewares.tsx b/webui/src/pages/tcp/TcpMiddlewares.tsx
index c736d4c47..25bca597b 100644
--- a/webui/src/pages/tcp/TcpMiddlewares.tsx
+++ b/webui/src/pages/tcp/TcpMiddlewares.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -13,8 +14,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 import { parseMiddlewareType } from 'libs/parsers'
 
 export const makeRowRender = (): RenderRowType => {
@@ -79,9 +79,7 @@ export const TcpMiddlewaresRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -109,7 +107,10 @@ export const TcpMiddlewares = () => {
   )
 
   return (
-    <Page title="TCP Middlewares">
+    <>
+      <Helmet>
+        <title>TCP Middlewares - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <TcpMiddlewaresRender
         error={error}
@@ -120,6 +121,6 @@ export const TcpMiddlewares = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/tcp/TcpRouter.spec.tsx b/webui/src/pages/tcp/TcpRouter.spec.tsx
index bd5fe7059..c1f5bb6a4 100644
--- a/webui/src/pages/tcp/TcpRouter.spec.tsx
+++ b/webui/src/pages/tcp/TcpRouter.spec.tsx
@@ -7,6 +7,7 @@ describe('<TcpRouterPage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <TcpRouterRender name="mock-router" data={undefined} error={new Error('Test error')} />,
+      { route: '/tcp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<TcpRouterPage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <TcpRouterRender name="mock-router" data={undefined} error={undefined} />,
+      { route: '/tcp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<TcpRouterPage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <TcpRouterRender name="mock-router" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/tcp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -66,6 +69,7 @@ describe('<TcpRouterPage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpRouterRender name="mock-router" data={mockData as any} error={undefined} />,
+      { route: '/tcp/routers/tcp-all@docker', withPage: true },
     )
 
     const routerStructure = getByTestId('router-structure')
diff --git a/webui/src/pages/tcp/TcpRouter.tsx b/webui/src/pages/tcp/TcpRouter.tsx
index 1bdac707c..92f9b47b2 100644
--- a/webui/src/pages/tcp/TcpRouter.tsx
+++ b/webui/src/pages/tcp/TcpRouter.tsx
@@ -1,4 +1,5 @@
 import { Flex, styled, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useParams } from 'react-router-dom'
 
 import { CardListSection, DetailSectionSkeleton } from 'components/resources/DetailSections'
@@ -6,7 +7,6 @@ import MiddlewarePanel from 'components/resources/MiddlewarePanel'
 import RouterPanel from 'components/resources/RouterPanel'
 import TlsPanel from 'components/resources/TlsPanel'
 import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { RouterStructure } from 'pages/http/HttpRouter'
 import { NotFound } from 'pages/NotFound'
 
@@ -37,17 +37,23 @@ type TcpRouterRenderProps = {
 export const TcpRouterRender = ({ data, error, name }: TcpRouterRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Router right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Flex css={{ flexDirection: 'row', mb: '70px' }} data-testid="skeleton">
           <CardListSection bigDescription />
           <CardListSection />
@@ -57,7 +63,7 @@ export const TcpRouterRender = ({ data, error, name }: TcpRouterRenderProps) =>
           <DetailSectionSkeleton />
           <DetailSectionSkeleton />
         </SpacedColumns>
-      </Page>
+      </>
     )
   }
 
@@ -66,10 +72,13 @@ export const TcpRouterRender = ({ data, error, name }: TcpRouterRenderProps) =>
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <RouterStructure data={data} protocol="tcp" />
       <RouterDetail data={data} />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/tcp/TcpRouters.spec.tsx b/webui/src/pages/tcp/TcpRouters.spec.tsx
index 60acab68e..fac801fb6 100644
--- a/webui/src/pages/tcp/TcpRouters.spec.tsx
+++ b/webui/src/pages/tcp/TcpRouters.spec.tsx
@@ -39,10 +39,13 @@ describe('<TcpRoutersPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<TcpRoutersPage />)
+    const { container, getByTestId } = renderWithProviders(<TcpRoutersPage />, {
+      route: '/tcp/routers',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('TCP Routers page')).toBeInTheDocument()
+    expect(getByTestId('/tcp/routers page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(3)
 
@@ -76,6 +79,7 @@ describe('<TcpRoutersPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/tcp/routers', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/tcp/TcpRouters.tsx b/webui/src/pages/tcp/TcpRouters.tsx
index de8319e79..8a8f638ac 100644
--- a/webui/src/pages/tcp/TcpRouters.tsx
+++ b/webui/src/pages/tcp/TcpRouters.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import { FiShield } from 'react-icons/fi'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
@@ -15,8 +16,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (): RenderRowType => {
   const TcpRoutersRenderRow = (row) => (
@@ -96,9 +96,7 @@ export const TcpRoutersRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -126,7 +124,10 @@ export const TcpRouters = () => {
   )
 
   return (
-    <Page title="TCP Routers">
+    <>
+      <Helmet>
+        <title>TCP Routers - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <TcpRoutersRender
         error={error}
@@ -137,6 +138,6 @@ export const TcpRouters = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/tcp/TcpService.spec.tsx b/webui/src/pages/tcp/TcpService.spec.tsx
index 4860bd9e8..faa8ac0f5 100644
--- a/webui/src/pages/tcp/TcpService.spec.tsx
+++ b/webui/src/pages/tcp/TcpService.spec.tsx
@@ -7,6 +7,7 @@ describe('<TcpServicePage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <TcpServiceRender name="mock-service" data={undefined} error={new Error('Test error')} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<TcpServicePage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <TcpServiceRender name="mock-service" data={undefined} error={undefined} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<TcpServicePage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <TcpServiceRender name="mock-service" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -33,8 +36,18 @@ describe('<TcpServicePage />', () => {
             address: 'http://10.0.1.12:80',
           },
         ],
-        passHostHeader: true,
         terminationDelay: 10,
+        healthCheck: {
+          interval: '30s',
+          timeout: '10s',
+          port: 8080,
+          unhealthyInterval: '1m',
+          send: 'PING',
+          expect: 'PONG',
+        },
+      },
+      serverStatus: {
+        'http://10.0.1.12:80': 'UP',
       },
       status: 'enabled',
       usedBy: ['router-test1@docker'],
@@ -59,25 +72,38 @@ describe('<TcpServicePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
     const titleTags = headings.filter((h1) => h1.innerHTML === 'service-test1')
     expect(titleTags.length).toBe(1)
 
-    const serviceDetails = getByTestId('service-details')
+    const serviceDetails = getByTestId('tcp-service-details')
     expect(serviceDetails.innerHTML).toContain('Type')
     expect(serviceDetails.innerHTML).toContain('loadbalancer')
     expect(serviceDetails.innerHTML).toContain('Provider')
     expect(serviceDetails.querySelector('svg[data-testid="docker"]')).toBeTruthy()
     expect(serviceDetails.innerHTML).toContain('Status')
     expect(serviceDetails.innerHTML).toContain('Success')
-    expect(serviceDetails.innerHTML).toContain('Pass Host Header')
-    expect(serviceDetails.innerHTML).toContain('True')
     expect(serviceDetails.innerHTML).toContain('Termination Delay')
     expect(serviceDetails.innerHTML).toContain('10 ms')
 
-    const serversList = getByTestId('servers-list')
+    const healthCheck = getByTestId('tcp-health-check')
+    expect(healthCheck.innerHTML).toContain('Interval')
+    expect(healthCheck.innerHTML).toContain('30s')
+    expect(healthCheck.innerHTML).toContain('Timeout')
+    expect(healthCheck.innerHTML).toContain('10s')
+    expect(healthCheck.innerHTML).toContain('Port')
+    expect(healthCheck.innerHTML).toContain('8080')
+    expect(healthCheck.innerHTML).toContain('Unhealthy Interval')
+    expect(healthCheck.innerHTML).toContain('1m')
+    expect(healthCheck.innerHTML).toContain('Send')
+    expect(healthCheck.innerHTML).toContain('PING')
+    expect(healthCheck.innerHTML).toContain('Expect')
+    expect(healthCheck.innerHTML).toContain('PONG')
+
+    const serversList = getByTestId('tcp-servers-list')
     expect(serversList.childNodes.length).toBe(1)
     expect(serversList.innerHTML).toContain('http://10.0.1.12:80')
 
@@ -128,9 +154,10 @@ describe('<TcpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
 
-    const serversList = getByTestId('servers-list')
+    const serversList = getByTestId('tcp-servers-list')
     expect(serversList.childNodes.length).toBe(1)
     expect(serversList.innerHTML).toContain('http://10.0.1.12:81')
 
@@ -154,10 +181,69 @@ describe('<TcpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <TcpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/tcp/services/mock-service', withPage: true },
     )
 
     expect(() => {
       getByTestId('routers-table')
     }).toThrow('Unable to find an element by: [data-testid="routers-table"]')
   })
+
+  it('should render weighted services', async () => {
+    const mockData = {
+      weighted: {
+        services: [
+          {
+            name: 'service1@docker',
+            weight: 80,
+          },
+          {
+            name: 'service2@kubernetes',
+            weight: 20,
+          },
+        ],
+      },
+      status: 'enabled',
+      usedBy: ['router-test1@docker'],
+      name: 'weighted-service-test',
+      provider: 'docker',
+      type: 'weighted',
+      routers: [
+        {
+          entryPoints: ['tcp'],
+          service: 'weighted-service-test',
+          rule: 'HostSNI(`*`)',
+          status: 'enabled',
+          using: ['tcp'],
+          name: 'router-test1@docker',
+          provider: 'docker',
+        },
+      ],
+    }
+
+    const { container, getByTestId } = renderWithProviders(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      <TcpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+    )
+
+    const headings = Array.from(container.getElementsByTagName('h1'))
+    const titleTags = headings.filter((h1) => h1.innerHTML === 'weighted-service-test')
+    expect(titleTags.length).toBe(1)
+
+    const serviceDetails = getByTestId('tcp-service-details')
+    expect(serviceDetails.innerHTML).toContain('Type')
+    expect(serviceDetails.innerHTML).toContain('weighted')
+    expect(serviceDetails.innerHTML).toContain('Provider')
+    expect(serviceDetails.querySelector('svg[data-testid="docker"]')).toBeTruthy()
+    expect(serviceDetails.innerHTML).toContain('Status')
+    expect(serviceDetails.innerHTML).toContain('Success')
+
+    const weightedServices = getByTestId('tcp-weighted-services')
+    expect(weightedServices.childNodes.length).toBe(2)
+    expect(weightedServices.innerHTML).toContain('service1@docker')
+    expect(weightedServices.innerHTML).toContain('80')
+    expect(weightedServices.innerHTML).toContain('service2@kubernetes')
+    expect(weightedServices.innerHTML).toContain('20')
+    expect(weightedServices.querySelector('svg[data-testid="docker"]')).toBeTruthy()
+  })
 })
diff --git a/webui/src/pages/tcp/TcpService.tsx b/webui/src/pages/tcp/TcpService.tsx
index 6c1d262b5..c36106156 100644
--- a/webui/src/pages/tcp/TcpService.tsx
+++ b/webui/src/pages/tcp/TcpService.tsx
@@ -1,19 +1,234 @@
-import { Flex, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
+import { Box, Flex, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
+import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
+import { FiGlobe, FiInfo, FiShield } from 'react-icons/fi'
 import { useParams } from 'react-router-dom'
 
-import { DetailSectionSkeleton } from 'components/resources/DetailSections'
+import ProviderIcon from 'components/icons/providers'
+import {
+  DetailSection,
+  DetailSectionSkeleton,
+  ItemBlock,
+  ItemTitle,
+  LayoutTwoCols,
+  ProviderName,
+} from 'components/resources/DetailSections'
+import { ResourceStatus } from 'components/resources/ResourceStatus'
 import { UsedByRoutersSection, UsedByRoutersSkeleton } from 'components/resources/UsedByRoutersSection'
-import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
-import { ServicePanels } from 'pages/http/HttpService'
+import Tooltip from 'components/Tooltip'
+import { ResourceDetailDataType, ServiceDetailType, useResourceDetail } from 'hooks/use-resource-detail'
 import { NotFound } from 'pages/NotFound'
 
+type TcpDetailProps = {
+  data: ServiceDetailType
+}
+
 const SpacedColumns = styled(Flex, {
   display: 'grid',
   gridTemplateColumns: 'repeat(auto-fill, minmax(360px, 1fr))',
   gridGap: '16px',
 })
 
+const ServicesGrid = styled(Box, {
+  display: 'grid',
+  gridTemplateColumns: '2fr 1fr 1fr',
+  alignItems: 'center',
+  padding: '$3 $5',
+  borderBottom: '1px solid $tableRowBorder',
+})
+
+const ServersGrid = styled(Box, {
+  display: 'grid',
+  alignItems: 'center',
+  padding: '$3 $5',
+  borderBottom: '1px solid $tableRowBorder',
+})
+
+const GridTitle = styled(Text, {
+  fontSize: '14px',
+  fontWeight: 700,
+  color: 'hsl(0, 0%, 56%)',
+})
+
+type TcpServer = {
+  address: string
+}
+
+type ServerStatus = {
+  [server: string]: string
+}
+
+type TcpHealthCheck = {
+  port?: number
+  send?: string
+  expect?: string
+  interval?: string
+  unhealthyInterval?: string
+  timeout?: string
+}
+
+function getTcpServerStatusList(data: ServiceDetailType): ServerStatus {
+  const serversList: ServerStatus = {}
+
+  data.loadBalancer?.servers?.forEach((server: any) => {
+    // TCP servers should have address, but handle both url and address for compatibility
+    const serverKey = (server as TcpServer).address || (server as any).url
+    if (serverKey) {
+      serversList[serverKey] = 'DOWN'
+    }
+  })
+
+  if (data.serverStatus) {
+    Object.entries(data.serverStatus).forEach(([server, status]) => {
+      serversList[server] = status
+    })
+  }
+
+  return serversList
+}
+
+export const TcpServicePanels = ({ data }: TcpDetailProps) => {
+  const serversList = getTcpServerStatusList(data)
+  const getProviderFromName = (serviceName: string): string => {
+    const [, provider] = serviceName.split('@')
+    return provider || data.provider
+  }
+  const providerName = useMemo(() => {
+    return data.provider
+  }, [data.provider])
+
+  return (
+    <SpacedColumns css={{ mb: '$5', pb: '$5' }} data-testid="tcp-service-details">
+      <DetailSection narrow icon={<FiInfo size={20} />} title="Service Details">
+        <LayoutTwoCols>
+          {data.type && (
+            <ItemBlock title="Type">
+              <Text css={{ lineHeight: '32px' }}>{data.type}</Text>
+            </ItemBlock>
+          )}
+          {data.provider && (
+            <ItemBlock title="Provider">
+              <ProviderIcon name={data.provider} />
+              <ProviderName css={{ ml: '$2' }}>{providerName}</ProviderName>
+            </ItemBlock>
+          )}
+        </LayoutTwoCols>
+        {data.status && (
+          <ItemBlock title="Status">
+            <ResourceStatus status={data.status} withLabel />
+          </ItemBlock>
+        )}
+        {data.loadBalancer && (
+          <>
+            {data.loadBalancer.terminationDelay && (
+              <ItemBlock title="Termination Delay">
+                <Text>{`${data.loadBalancer.terminationDelay} ms`}</Text>
+              </ItemBlock>
+            )}
+          </>
+        )}
+      </DetailSection>
+      {data.loadBalancer?.healthCheck && (
+        <DetailSection narrow icon={<FiShield size={20} />} title="Health Check">
+          <Box data-testid="tcp-health-check">
+            {(() => {
+              const tcpHealthCheck = data.loadBalancer.healthCheck as unknown as TcpHealthCheck
+              return (
+                <>
+                  <LayoutTwoCols>
+                    {tcpHealthCheck.interval && (
+                      <ItemBlock title="Interval">
+                        <Text>{tcpHealthCheck.interval}</Text>
+                      </ItemBlock>
+                    )}
+                    {tcpHealthCheck.timeout && (
+                      <ItemBlock title="Timeout">
+                        <Text>{tcpHealthCheck.timeout}</Text>
+                      </ItemBlock>
+                    )}
+                  </LayoutTwoCols>
+                  <LayoutTwoCols>
+                    {tcpHealthCheck.port && (
+                      <ItemBlock title="Port">
+                        <Text>{tcpHealthCheck.port}</Text>
+                      </ItemBlock>
+                    )}
+                    {tcpHealthCheck.unhealthyInterval && (
+                      <ItemBlock title="Unhealthy Interval">
+                        <Text>{tcpHealthCheck.unhealthyInterval}</Text>
+                      </ItemBlock>
+                    )}
+                  </LayoutTwoCols>
+                  <LayoutTwoCols>
+                    {tcpHealthCheck.send && (
+                      <ItemBlock title="Send">
+                        <Tooltip label={tcpHealthCheck.send} action="copy">
+                          <Text>{tcpHealthCheck.send}</Text>
+                        </Tooltip>
+                      </ItemBlock>
+                    )}
+                    {tcpHealthCheck.expect && (
+                      <ItemBlock title="Expect">
+                        <Tooltip label={tcpHealthCheck.expect} action="copy">
+                          <Text>{tcpHealthCheck.expect}</Text>
+                        </Tooltip>
+                      </ItemBlock>
+                    )}
+                  </LayoutTwoCols>
+                </>
+              )
+            })()}
+          </Box>
+        </DetailSection>
+      )}
+      {!!data?.weighted?.services?.length && (
+        <DetailSection narrow icon={<FiGlobe size={20} />} title="Services" noPadding>
+          <>
+            <ServicesGrid css={{ mt: '$2' }}>
+              <GridTitle>Name</GridTitle>
+              <GridTitle css={{ textAlign: 'center' }}>Weight</GridTitle>
+              <GridTitle css={{ textAlign: 'center' }}>Provider</GridTitle>
+            </ServicesGrid>
+            <Box data-testid="tcp-weighted-services">
+              {data.weighted.services.map((service) => (
+                <ServicesGrid key={service.name}>
+                  <Text>{service.name}</Text>
+                  <Text css={{ textAlign: 'center' }}>{service.weight}</Text>
+                  <Flex css={{ justifyContent: 'center' }}>
+                    <ProviderIcon name={getProviderFromName(service.name)} />
+                  </Flex>
+                </ServicesGrid>
+              ))}
+            </Box>
+          </>
+        </DetailSection>
+      )}
+      {Object.keys(serversList).length > 0 && (
+        <DetailSection narrow icon={<FiGlobe size={20} />} title="Servers" noPadding>
+          <>
+            <ServersGrid css={{ gridTemplateColumns: '25% auto', mt: '$2' }}>
+              <ItemTitle css={{ mb: 0 }}>Status</ItemTitle>
+              <ItemTitle css={{ mb: 0 }}>Address</ItemTitle>
+            </ServersGrid>
+            <Box data-testid="tcp-servers-list">
+              {Object.entries(serversList).map(([server, status]) => (
+                <ServersGrid key={server} css={{ gridTemplateColumns: '25% auto' }}>
+                  <ResourceStatus status={status === 'UP' ? 'enabled' : 'disabled'} />
+                  <Box>
+                    <Tooltip label={server} action="copy">
+                      <Text>{server}</Text>
+                    </Tooltip>
+                  </Box>
+                </ServersGrid>
+              ))}
+            </Box>
+          </>
+        </DetailSection>
+      )}
+    </SpacedColumns>
+  )
+}
+
 type TcpServiceRenderProps = {
   data?: ResourceDetailDataType
   error?: Error
@@ -23,24 +238,31 @@ type TcpServiceRenderProps = {
 export const TcpServiceRender = ({ data, error, name }: TcpServiceRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Service right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Skeleton css={{ height: '$7', width: '320px', mb: '$8' }} data-testid="skeleton" />
         <SpacedColumns>
           <DetailSectionSkeleton narrow />
           <DetailSectionSkeleton narrow />
+          <DetailSectionSkeleton narrow />
         </SpacedColumns>
         <UsedByRoutersSkeleton />
-      </Page>
+      </>
     )
   }
 
@@ -49,11 +271,14 @@ export const TcpServiceRender = ({ data, error, name }: TcpServiceRenderProps) =
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <H1 css={{ mb: '$7' }}>{data.name}</H1>
-      <ServicePanels data={data} />
+      <TcpServicePanels data={data} />
       <UsedByRoutersSection data={data} protocol="tcp" />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/tcp/TcpServices.spec.tsx b/webui/src/pages/tcp/TcpServices.spec.tsx
index cd838bee4..336a26a54 100644
--- a/webui/src/pages/tcp/TcpServices.spec.tsx
+++ b/webui/src/pages/tcp/TcpServices.spec.tsx
@@ -36,10 +36,13 @@ describe('<TcpServicesPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<TcpServicesPage />)
+    const { container, getByTestId } = renderWithProviders(<TcpServicesPage />, {
+      route: '/tcp/services',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('TCP Services page')).toBeInTheDocument()
+    expect(getByTestId('/tcp/services page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(3)
 
@@ -73,6 +76,7 @@ describe('<TcpServicesPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/tcp/services', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/tcp/TcpServices.tsx b/webui/src/pages/tcp/TcpServices.tsx
index a56027b61..13df8792b 100644
--- a/webui/src/pages/tcp/TcpServices.tsx
+++ b/webui/src/pages/tcp/TcpServices.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex, Text } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -13,8 +14,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (): RenderRowType => {
   const TcpServicesRenderRow = (row) => (
@@ -78,9 +78,7 @@ export const TcpServicesRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -108,7 +106,10 @@ export const TcpServices = () => {
   )
 
   return (
-    <Page title="TCP Services">
+    <>
+      <Helmet>
+        <title>TCP Services - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <TcpServicesRender
         error={error}
@@ -119,6 +120,6 @@ export const TcpServices = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/udp/UdpRouter.spec.tsx b/webui/src/pages/udp/UdpRouter.spec.tsx
index 65aa5567d..2404b70a3 100644
--- a/webui/src/pages/udp/UdpRouter.spec.tsx
+++ b/webui/src/pages/udp/UdpRouter.spec.tsx
@@ -7,6 +7,7 @@ describe('<UdpRouterPage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <UdpRouterRender name="mock-router" data={undefined} error={new Error('Test error')} />,
+      { route: '/udp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<UdpRouterPage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <UdpRouterRender name="mock-router" data={undefined} error={undefined} />,
+      { route: '/udp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<UdpRouterPage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <UdpRouterRender name="mock-router" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/udp/routers/mock-router', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -51,6 +54,7 @@ describe('<UdpRouterPage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <UdpRouterRender name="mock-router" data={mockData as any} error={undefined} />,
+      { route: '/udp/routers/udp-all@docker', withPage: true },
     )
 
     const routerStructure = getByTestId('router-structure')
diff --git a/webui/src/pages/udp/UdpRouter.tsx b/webui/src/pages/udp/UdpRouter.tsx
index d1aebf1e8..a41bdb0df 100644
--- a/webui/src/pages/udp/UdpRouter.tsx
+++ b/webui/src/pages/udp/UdpRouter.tsx
@@ -1,10 +1,10 @@
 import { Flex, styled, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useParams } from 'react-router-dom'
 
 import { CardListSection, DetailSectionSkeleton } from 'components/resources/DetailSections'
 import RouterPanel from 'components/resources/RouterPanel'
 import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { RouterStructure } from 'pages/http/HttpRouter'
 import { NotFound } from 'pages/NotFound'
 
@@ -33,17 +33,23 @@ type UdpRouterRenderProps = {
 export const UdpRouterRender = ({ data, error, name }: UdpRouterRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Router right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Flex css={{ flexDirection: 'row', mb: '70px' }} data-testid="skeleton">
           <CardListSection bigDescription />
           <CardListSection />
@@ -53,7 +59,7 @@ export const UdpRouterRender = ({ data, error, name }: UdpRouterRenderProps) =>
           <DetailSectionSkeleton />
           <DetailSectionSkeleton />
         </SpacedColumns>
-      </Page>
+      </>
     )
   }
 
@@ -62,10 +68,13 @@ export const UdpRouterRender = ({ data, error, name }: UdpRouterRenderProps) =>
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <RouterStructure data={data} protocol="udp" />
       <RouterDetail data={data} />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/udp/UdpRouters.spec.tsx b/webui/src/pages/udp/UdpRouters.spec.tsx
index 8045cf8b7..658b8843b 100644
--- a/webui/src/pages/udp/UdpRouters.spec.tsx
+++ b/webui/src/pages/udp/UdpRouters.spec.tsx
@@ -39,10 +39,13 @@ describe('<UdpRoutersPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<UdpRoutersPage />)
+    const { container, getByTestId } = renderWithProviders(<UdpRoutersPage />, {
+      route: '/udp/routers',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('UDP Routers page')).toBeInTheDocument()
+    expect(getByTestId('/udp/routers page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(3)
 
@@ -76,6 +79,7 @@ describe('<UdpRoutersPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/udp/routers', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/udp/UdpRouters.tsx b/webui/src/pages/udp/UdpRouters.tsx
index 56c6d8414..b468630ce 100644
--- a/webui/src/pages/udp/UdpRouters.tsx
+++ b/webui/src/pages/udp/UdpRouters.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -14,8 +15,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (): RenderRowType => {
   const UdpRoutersRenderRow = (row) => (
@@ -81,9 +81,7 @@ export const UdpRoutersRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -111,7 +109,10 @@ export const UdpRouters = () => {
   )
 
   return (
-    <Page title="UDP Routers">
+    <>
+      <Helmet>
+        <title>UDP Routers - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <UdpRoutersRender
         error={error}
@@ -122,6 +123,6 @@ export const UdpRouters = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/pages/udp/UdpService.spec.tsx b/webui/src/pages/udp/UdpService.spec.tsx
index 71114f560..b6150c8ee 100644
--- a/webui/src/pages/udp/UdpService.spec.tsx
+++ b/webui/src/pages/udp/UdpService.spec.tsx
@@ -7,6 +7,7 @@ describe('<UdpServicePage />', () => {
   it('should render the error message', () => {
     const { getByTestId } = renderWithProviders(
       <UdpServiceRender name="mock-service" data={undefined} error={new Error('Test error')} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
     expect(getByTestId('error-text')).toBeInTheDocument()
   })
@@ -14,6 +15,7 @@ describe('<UdpServicePage />', () => {
   it('should render the skeleton', () => {
     const { getByTestId } = renderWithProviders(
       <UdpServiceRender name="mock-service" data={undefined} error={undefined} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
     expect(getByTestId('skeleton')).toBeInTheDocument()
   })
@@ -21,6 +23,7 @@ describe('<UdpServicePage />', () => {
   it('should render the not found page', () => {
     const { getByTestId } = renderWithProviders(
       <UdpServiceRender name="mock-service" data={{} as ResourceDetailDataType} error={undefined} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
     expect(getByTestId('Not found page')).toBeInTheDocument()
   })
@@ -59,6 +62,7 @@ describe('<UdpServicePage />', () => {
     const { container, getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <UdpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
 
     const headings = Array.from(container.getElementsByTagName('h1'))
@@ -128,6 +132,7 @@ describe('<UdpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <UdpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
 
     const serversList = getByTestId('servers-list')
@@ -154,6 +159,7 @@ describe('<UdpServicePage />', () => {
     const { getByTestId } = renderWithProviders(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       <UdpServiceRender name="mock-service" data={mockData as any} error={undefined} />,
+      { route: '/udp/services/mock-service', withPage: true },
     )
 
     expect(() => {
diff --git a/webui/src/pages/udp/UdpService.tsx b/webui/src/pages/udp/UdpService.tsx
index 9727a1663..132e63197 100644
--- a/webui/src/pages/udp/UdpService.tsx
+++ b/webui/src/pages/udp/UdpService.tsx
@@ -1,10 +1,10 @@
 import { Flex, H1, Skeleton, styled, Text } from '@traefiklabs/faency'
+import { Helmet } from 'react-helmet-async'
 import { useParams } from 'react-router-dom'
 
 import { DetailSectionSkeleton } from 'components/resources/DetailSections'
 import { UsedByRoutersSection, UsedByRoutersSkeleton } from 'components/resources/UsedByRoutersSection'
 import { ResourceDetailDataType, useResourceDetail } from 'hooks/use-resource-detail'
-import Page from 'layout/Page'
 import { ServicePanels } from 'pages/http/HttpService'
 import { NotFound } from 'pages/NotFound'
 
@@ -23,24 +23,30 @@ type UdpServiceRenderProps = {
 export const UdpServiceRender = ({ data, error, name }: UdpServiceRenderProps) => {
   if (error) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Text data-testid="error-text">
           Sorry, we could not fetch detail information for this Service right now. Please, try again later.
         </Text>
-      </Page>
+      </>
     )
   }
 
   if (!data) {
     return (
-      <Page title={name}>
+      <>
+        <Helmet>
+          <title>{name} - Traefik Proxy</title>
+        </Helmet>
         <Skeleton css={{ height: '$7', width: '320px', mb: '$8' }} data-testid="skeleton" />
         <SpacedColumns>
           <DetailSectionSkeleton narrow />
           <DetailSectionSkeleton narrow />
         </SpacedColumns>
         <UsedByRoutersSkeleton />
-      </Page>
+      </>
     )
   }
 
@@ -49,11 +55,14 @@ export const UdpServiceRender = ({ data, error, name }: UdpServiceRenderProps) =
   }
 
   return (
-    <Page title={name}>
+    <>
+      <Helmet>
+        <title>{data.name} - Traefik Proxy</title>
+      </Helmet>
       <H1 css={{ mb: '$7' }}>{data.name}</H1>
       <ServicePanels data={data} />
       <UsedByRoutersSection data={data} protocol="udp" />
-    </Page>
+    </>
   )
 }
 
diff --git a/webui/src/pages/udp/UdpServices.spec.tsx b/webui/src/pages/udp/UdpServices.spec.tsx
index 8bb51ef0d..e28d1dba3 100644
--- a/webui/src/pages/udp/UdpServices.spec.tsx
+++ b/webui/src/pages/udp/UdpServices.spec.tsx
@@ -36,10 +36,13 @@ describe('<UdpServicesPage />', () => {
       .spyOn(useFetchWithPagination, 'default')
       .mockImplementation(() => useFetchWithPaginationMock({ pages }))
 
-    const { container, getByTestId } = renderWithProviders(<UdpServicesPage />)
+    const { container, getByTestId } = renderWithProviders(<UdpServicesPage />, {
+      route: '/udp/services',
+      withPage: true,
+    })
 
     expect(mock).toHaveBeenCalled()
-    expect(getByTestId('UDP Services page')).toBeInTheDocument()
+    expect(getByTestId('/udp/services page')).toBeInTheDocument()
     const tbody = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[1]
     expect(tbody.querySelectorAll('a[role="row"]')).toHaveLength(3)
 
@@ -73,6 +76,7 @@ describe('<UdpServicesPage />', () => {
         pageCount={1}
         pages={[]}
       />,
+      { route: '/udp/services', withPage: true },
     )
     expect(() => getByTestId('loading')).toThrow('Unable to find an element by: [data-testid="loading"]')
     const tfoot = container.querySelectorAll('div[role="table"] > div[role="rowgroup"]')[2]
diff --git a/webui/src/pages/udp/UdpServices.tsx b/webui/src/pages/udp/UdpServices.tsx
index b02c2fdcf..76abc3d02 100644
--- a/webui/src/pages/udp/UdpServices.tsx
+++ b/webui/src/pages/udp/UdpServices.tsx
@@ -1,5 +1,6 @@
 import { AriaTable, AriaTbody, AriaTd, AriaTfoot, AriaThead, AriaTr, Box, Flex, Text } from '@traefiklabs/faency'
 import { useMemo } from 'react'
+import { Helmet } from 'react-helmet-async'
 import useInfiniteScroll from 'react-infinite-scroll-hook'
 import { useSearchParams } from 'react-router-dom'
 
@@ -13,8 +14,7 @@ import SortableTh from 'components/tables/SortableTh'
 import Tooltip from 'components/Tooltip'
 import TooltipText from 'components/TooltipText'
 import useFetchWithPagination, { pagesResponseInterface, RenderRowType } from 'hooks/use-fetch-with-pagination'
-import { EmptyPlaceholder } from 'layout/EmptyPlaceholder'
-import Page from 'layout/Page'
+import { EmptyPlaceholderTd } from 'layout/EmptyPlaceholder'
 
 export const makeRowRender = (): RenderRowType => {
   const UdpServicesRenderRow = (row) => (
@@ -78,9 +78,7 @@ export const UdpServicesRender = ({
         {(isEmpty || !!error) && (
           <AriaTfoot>
             <AriaTr>
-              <AriaTd fullColSpan>
-                <EmptyPlaceholder message={error ? 'Failed to fetch data' : 'No data available'} />
-              </AriaTd>
+              <EmptyPlaceholderTd message={error ? 'Failed to fetch data' : 'No data available'} />
             </AriaTr>
           </AriaTfoot>
         )}
@@ -108,7 +106,10 @@ export const UdpServices = () => {
   )
 
   return (
-    <Page title="UDP Services">
+    <>
+      <Helmet>
+        <title>UDP Services - Traefik Proxy</title>
+      </Helmet>
       <TableFilter />
       <UdpServicesRender
         error={error}
@@ -119,6 +120,6 @@ export const UdpServices = () => {
         pageCount={pageCount}
         pages={pages}
       />
-    </Page>
+    </>
   )
 }
diff --git a/webui/src/types/global.d.ts b/webui/src/types/global.d.ts
index e1503ed42..4b024488c 100644
--- a/webui/src/types/global.d.ts
+++ b/webui/src/types/global.d.ts
@@ -5,5 +5,6 @@ interface Window {
 declare namespace JSX {
   interface IntrinsicElements {
     'hub-button-app': React.DetailedHTMLProps<React.HTMLAttributes<HTMLElement>, HTMLElement>
+    'hub-ui-demo-app': { key: string; path: string; theme: 'dark' | 'light'; baseurl: string; containercss: string }
   }
 }
diff --git a/webui/src/utils/test.tsx b/webui/src/utils/test.tsx
index 2c79760cf..995908e9f 100644
--- a/webui/src/utils/test.tsx
+++ b/webui/src/utils/test.tsx
@@ -1,10 +1,11 @@
 import { cleanup, render } from '@testing-library/react'
 import { FaencyProvider } from '@traefiklabs/faency'
 import { HelmetProvider } from 'react-helmet-async'
-import { BrowserRouter } from 'react-router-dom'
+import { MemoryRouter } from 'react-router-dom'
 import { SWRConfig } from 'swr'
 import { afterEach } from 'vitest'
 
+import Page from '../layout/Page'
 import fetch from '../libs/fetch'
 
 afterEach(() => {
@@ -25,7 +26,7 @@ export { default as userEvent } from '@testing-library/user-event'
 // override render export
 export { customRender as render } // eslint-disable-line import/export
 
-export function renderWithProviders(ui: React.ReactElement) {
+export function renderWithProviders(ui: React.ReactElement, { route = '/', withPage = false } = {}) {
   return customRender(ui, {
     wrapper: ({ children }) => (
       <FaencyProvider>
@@ -36,7 +37,7 @@ export function renderWithProviders(ui: React.ReactElement) {
               fetcher: fetch,
             }}
           >
-            <BrowserRouter>{children}</BrowserRouter>
+            <MemoryRouter initialEntries={[route]}>{withPage ? <Page>{children}</Page> : children}</MemoryRouter>
           </SWRConfig>
         </HelmetProvider>
       </FaencyProvider>
diff --git a/webui/src/utils/workers/scriptVerification.integration.spec.ts b/webui/src/utils/workers/scriptVerification.integration.spec.ts
new file mode 100644
index 000000000..189632c64
--- /dev/null
+++ b/webui/src/utils/workers/scriptVerification.integration.spec.ts
@@ -0,0 +1,156 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+import verifySignature from './scriptVerification'
+
+describe('Script Signature Verification - Integration Tests', () => {
+  let fetchMock: ReturnType<typeof vi.fn>
+
+  const SCRIPT_URL = 'https://example.com/script.js'
+  const SIGNATURE_URL = 'https://example.com/script.js.sig'
+  const TEST_PUBLIC_KEY = 'MCowBQYDK2VwAyEAWH71OHphISjNK3mizCR/BawiDxc6IXT1vFHpBcxSIA0='
+  const VALID_SCRIPT = "console.log('Hello from verified script!');"
+  const VALID_SIGNATURE_HEX =
+    '04c90fcd35caaf3cf4582a2767345f8cd9f6519e1ce79ebaeedbe0d5f671d762d1aa8ec258831557e2de0e47f224883f84eb5a0f22ec18eb7b8c48de3096d000'
+  const CORRUPTED_SCRIPT = "console.log('Malicious code injected!');"
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    fetchMock = vi.fn()
+    globalThis.fetch = fetchMock
+  })
+
+  it('should verify a valid script with correct signature through real worker', async () => {
+    fetchMock.mockImplementation((url: string) => {
+      if (url === SCRIPT_URL) {
+        return Promise.resolve(
+          new Response(VALID_SCRIPT, {
+            status: 200,
+            headers: { 'Content-Type': 'application/javascript' },
+          }),
+        )
+      }
+      if (url === SIGNATURE_URL) {
+        return Promise.resolve(
+          new Response(VALID_SIGNATURE_HEX, {
+            status: 200,
+            headers: { 'Content-Type': 'text/plain' },
+          }),
+        )
+      }
+      return Promise.reject(new Error('Unexpected URL'))
+    })
+
+    const result = await verifySignature(SCRIPT_URL, SIGNATURE_URL, TEST_PUBLIC_KEY)
+
+    expect(fetchMock).toHaveBeenCalledWith(SCRIPT_URL)
+    expect(fetchMock).toHaveBeenCalledWith(SIGNATURE_URL)
+    expect(result.verified).toBe(true)
+    expect(result.scriptContent).toBeDefined()
+  }, 15000)
+
+  it('should reject a corrupted script with mismatched signature', async () => {
+    fetchMock.mockImplementation((url: string) => {
+      if (url === SCRIPT_URL) {
+        return Promise.resolve(
+          new Response(CORRUPTED_SCRIPT, {
+            status: 200,
+            headers: { 'Content-Type': 'application/javascript' },
+          }),
+        )
+      }
+      if (url === SIGNATURE_URL) {
+        return Promise.resolve(
+          new Response(VALID_SIGNATURE_HEX, {
+            status: 200,
+            headers: { 'Content-Type': 'text/plain' },
+          }),
+        )
+      }
+      return Promise.reject(new Error('Unexpected URL'))
+    })
+
+    const result = await verifySignature(SCRIPT_URL, SIGNATURE_URL, TEST_PUBLIC_KEY)
+
+    expect(fetchMock).toHaveBeenCalledWith(SCRIPT_URL)
+    expect(fetchMock).toHaveBeenCalledWith(SIGNATURE_URL)
+    expect(result.verified).toBe(false)
+    expect(result.scriptContent).toBeUndefined()
+  }, 15000)
+
+  it('should reject script with invalid signature format', async () => {
+    fetchMock.mockImplementation((url: string) => {
+      if (url === SCRIPT_URL) {
+        return Promise.resolve(
+          new Response(VALID_SCRIPT, {
+            status: 200,
+            headers: { 'Content-Type': 'application/javascript' },
+          }),
+        )
+      }
+      if (url === SIGNATURE_URL) {
+        return Promise.resolve(
+          new Response('not-a-valid-signature', {
+            status: 200,
+            headers: { 'Content-Type': 'text/plain' },
+          }),
+        )
+      }
+      return Promise.reject(new Error('Unexpected URL'))
+    })
+
+    const result = await verifySignature(SCRIPT_URL, SIGNATURE_URL, TEST_PUBLIC_KEY)
+
+    expect(result.verified).toBe(false)
+    expect(result.scriptContent).toBeUndefined()
+  }, 15000)
+
+  it('should reject script with wrong public key', async () => {
+    const WRONG_PUBLIC_KEY = 'MCowBQYDK2VwAyEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
+
+    fetchMock.mockImplementation((url: string) => {
+      if (url === SCRIPT_URL) {
+        return Promise.resolve(
+          new Response(VALID_SCRIPT, {
+            status: 200,
+            headers: { 'Content-Type': 'application/javascript' },
+          }),
+        )
+      }
+      if (url === SIGNATURE_URL) {
+        return Promise.resolve(
+          new Response(VALID_SIGNATURE_HEX, {
+            status: 200,
+            headers: { 'Content-Type': 'text/plain' },
+          }),
+        )
+      }
+      return Promise.reject(new Error('Unexpected URL'))
+    })
+
+    const result = await verifySignature(SCRIPT_URL, SIGNATURE_URL, WRONG_PUBLIC_KEY)
+
+    expect(result.verified).toBe(false)
+    expect(result.scriptContent).toBeUndefined()
+  }, 15000)
+
+  it('should handle network failures when fetching script', async () => {
+    fetchMock.mockImplementation(() =>
+      Promise.resolve(
+        new Response(null, {
+          status: 404,
+          statusText: 'Not Found',
+        }),
+      ),
+    )
+
+    const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    const result = await verifySignature(SCRIPT_URL, SIGNATURE_URL, TEST_PUBLIC_KEY)
+
+    expect(result.verified).toBe(false)
+    expect(result.scriptContent).toBeUndefined()
+    expect(consoleErrorSpy).toHaveBeenCalled()
+
+    consoleErrorSpy.mockRestore()
+  }, 15000)
+})
diff --git a/webui/src/utils/workers/scriptVerification.spec.ts b/webui/src/utils/workers/scriptVerification.spec.ts
new file mode 100644
index 000000000..0d6c0108e
--- /dev/null
+++ b/webui/src/utils/workers/scriptVerification.spec.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+import verifySignature from './scriptVerification'
+
+const SCRIPT_PATH = 'https://example.com/script.js'
+const MOCK_PUBLIC_KEY = 'MCowBQYDK2VwAyEAWH71OHphISjNK3mizCR/BawiDxc6IXT1vFHpBcxSIA0='
+class MockWorker {
+  onmessage: ((event: MessageEvent) => void) | null = null
+  onerror: ((error: ErrorEvent) => void) | null = null
+  postMessage = vi.fn()
+  terminate = vi.fn()
+
+  simulateMessage(data: unknown) {
+    if (this.onmessage) {
+      this.onmessage(new MessageEvent('message', { data }))
+    }
+  }
+
+  simulateError(error: Error) {
+    if (this.onerror) {
+      this.onerror(new ErrorEvent('error', { error, message: error.message }))
+    }
+  }
+}
+
+describe('verifySignature', () => {
+  let mockWorkerInstance: MockWorker
+  let originalWorker: typeof Worker
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    originalWorker = globalThis.Worker
+
+    mockWorkerInstance = new MockWorker()
+
+    globalThis.Worker = class extends EventTarget {
+      constructor() {
+        super()
+        return mockWorkerInstance as any
+      }
+    } as any
+  })
+
+  afterEach(() => {
+    globalThis.Worker = originalWorker
+    vi.restoreAllMocks()
+  })
+
+  it('should return true when verification succeeds', async () => {
+    const promise = verifySignature(SCRIPT_PATH, `${SCRIPT_PATH}.sig`, MOCK_PUBLIC_KEY)
+
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(mockWorkerInstance.postMessage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scriptUrl: SCRIPT_PATH,
+        signatureUrl: `${SCRIPT_PATH}.sig`,
+        requestId: expect.any(String),
+      }),
+    )
+
+    const mockScriptContent = new ArrayBuffer(100)
+    mockWorkerInstance.simulateMessage({
+      success: true,
+      verified: true,
+      error: null,
+      scriptContent: mockScriptContent,
+    })
+
+    const result = await promise
+
+    expect(result).toEqual({ verified: true, scriptContent: mockScriptContent })
+    expect(mockWorkerInstance.terminate).toHaveBeenCalled()
+  })
+
+  it('should return false when verification fails', async () => {
+    const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    const promise = verifySignature(SCRIPT_PATH, `${SCRIPT_PATH}.sig`, MOCK_PUBLIC_KEY)
+
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    mockWorkerInstance.simulateMessage({
+      success: false,
+      verified: false,
+      error: 'Signature verification failed',
+    })
+
+    const result = await promise
+
+    expect(result).toEqual({ verified: false })
+    expect(mockWorkerInstance.terminate).toHaveBeenCalled()
+    expect(consoleErrorSpy).toHaveBeenCalledWith('Worker verification failed:', 'Signature verification failed')
+
+    consoleErrorSpy.mockRestore()
+  })
+
+  it('should return false when worker throws an error', async () => {
+    const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    const promise = verifySignature(SCRIPT_PATH, `${SCRIPT_PATH}.sig`, MOCK_PUBLIC_KEY)
+
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    const error = new Error('Worker crashed')
+    mockWorkerInstance.simulateError(error)
+
+    const result = await promise
+
+    expect(result).toEqual({ verified: false })
+    expect(mockWorkerInstance.terminate).toHaveBeenCalled()
+    expect(consoleErrorSpy).toHaveBeenCalledWith('Worker error:', expect.any(ErrorEvent))
+
+    consoleErrorSpy.mockRestore()
+  })
+})
diff --git a/webui/src/utils/workers/scriptVerification.ts b/webui/src/utils/workers/scriptVerification.ts
new file mode 100644
index 000000000..fb3ecedd5
--- /dev/null
+++ b/webui/src/utils/workers/scriptVerification.ts
@@ -0,0 +1,55 @@
+export interface VerificationResult {
+  verified: boolean
+  scriptContent?: ArrayBuffer
+}
+
+async function verifySignature(
+  contentPath: string,
+  signaturePath: string,
+  publicKey: string,
+): Promise<VerificationResult> {
+  return new Promise((resolve) => {
+    const requestId = Math.random().toString(36).substring(2)
+    const worker = new Worker(new URL('./scriptVerificationWorker.ts', import.meta.url), { type: 'module' })
+
+    const timeout = setTimeout(() => {
+      worker.terminate()
+      console.error('Script verification timeout')
+      resolve({ verified: false })
+    }, 30000)
+
+    worker.onmessage = (event) => {
+      clearTimeout(timeout)
+      worker.terminate()
+
+      const { success, verified, error, scriptContent } = event.data
+
+      if (!success) {
+        console.error('Worker verification failed:', error)
+        resolve({ verified: false })
+        return
+      }
+
+      resolve({
+        verified: verified === true,
+        scriptContent: verified ? scriptContent : undefined,
+      })
+    }
+
+    worker.onerror = (error) => {
+      clearTimeout(timeout)
+      worker.terminate()
+      console.error('Worker error:', error)
+      resolve({ verified: false })
+    }
+
+    worker.postMessage({
+      requestId,
+      scriptUrl: contentPath,
+      signatureUrl: signaturePath,
+      publicKey,
+    })
+  })
+}
+
+export default verifySignature
diff --git a/webui/src/utils/workers/scriptVerificationWorker.ts b/webui/src/utils/workers/scriptVerificationWorker.ts
new file mode 100644
index 000000000..902dce094
--- /dev/null
+++ b/webui/src/utils/workers/scriptVerificationWorker.ts
@@ -0,0 +1,189 @@
+// Script verification worker
+// Runs in isolated context for secure verification
+
+import { verify } from '@noble/ed25519'
+import * as ed25519 from '@noble/ed25519'
+import { sha512 } from '@noble/hashes/sha2.js'
+
+// Set up SHA-512 for @noble/ed25519 v3.x
+ed25519.hashes.sha512 = sha512
+ed25519.hashes.sha512Async = (m) => Promise.resolve(sha512(m))
+
+function base64ToArrayBuffer(base64: string): ArrayBuffer {
+  try {
+    // @ts-expect-error - fromBase64 is not yet in all TypeScript lib definitions
+    const bytes = Uint8Array.fromBase64(base64)
+    return bytes.buffer
+  } catch {
+    // Fallback for browsers without Uint8Array.fromBase64()
+    const binaryString = atob(base64)
+    const bytes = new Uint8Array(binaryString.length)
+    for (let i = 0; i < binaryString.length; i++) {
+      bytes[i] = binaryString.charCodeAt(i)
+    }
+    return bytes.buffer
+  }
+}
+
+function extractEd25519PublicKey(spkiBytes: Uint8Array): Uint8Array {
+  if (spkiBytes.length !== 44) {
+    throw new Error('Invalid SPKI length for Ed25519')
+  }
+  return spkiBytes.slice(-32)
+}
+
+async function importPublicKeyWebCrypto(publicKey: string): Promise<CryptoKey> {
+  const publicKeyBuffer = base64ToArrayBuffer(publicKey)
+
+  return await crypto.subtle.importKey(
+    'spki',
+    publicKeyBuffer,
+    {
+      name: 'Ed25519',
+    },
+    false,
+    ['verify'],
+  )
+}
+
+async function verifyWithWebCrypto(
+  publicKey: string,
+  scriptBuffer: ArrayBuffer,
+  signatureBuffer: ArrayBuffer,
+): Promise<boolean> {
+  try {
+    const cryptoPublicKey = await importPublicKeyWebCrypto(publicKey)
+
+    return await crypto.subtle.verify('Ed25519', cryptoPublicKey, signatureBuffer, scriptBuffer)
+  } catch (error) {
+    console.log('Web Crypto verification failed:', error instanceof Error ? error.message : 'Unknown error')
+    return false
+  }
+}
+
+function parseSignature(signatureBuffer: ArrayBuffer): Uint8Array {
+  const signatureBytes = new Uint8Array(signatureBuffer)
+
+  // If already 64 bytes, assume it's raw binary
+  if (signatureBytes.length === 64) {
+    return signatureBytes
+  }
+
+  // Try to parse as text (base64 or hex)
+  const signatureText = new TextDecoder().decode(signatureBytes).trim()
+
+  // base64 decoding
+  try {
+    const base64Decoded = new Uint8Array(base64ToArrayBuffer(signatureText))
+    if (base64Decoded.length === 64) {
+      return base64Decoded
+    }
+  } catch (e) {
+    console.error(e)
+  }
+
+  // hex decoding
+  if (signatureText.length === 128 && /^[0-9a-fA-F]+$/.test(signatureText)) {
+    try {
+      // @ts-expect-error - fromHex is not yet in all TypeScript lib definitions
+      return Uint8Array.fromHex(signatureText)
+    } catch {
+      // Fallback for browsers without Uint8Array.fromHex()
+      const hexDecoded = new Uint8Array(64)
+      for (let i = 0; i < 64; i++) {
+        hexDecoded[i] = parseInt(signatureText.slice(i * 2, i * 2 + 2), 16)
+      }
+      return hexDecoded
+    }
+  }
+
+  throw new Error(`Unable to parse signature format.`)
+}
+
+async function verifyWithNoble(
+  publicKey: string,
+  scriptBuffer: ArrayBuffer,
+  signatureBuffer: ArrayBuffer,
+): Promise<boolean> {
+  try {
+    const publicKeySpki = new Uint8Array(base64ToArrayBuffer(publicKey))
+    const publicKeyRaw = extractEd25519PublicKey(publicKeySpki)
+
+    const scriptBytes = new Uint8Array(scriptBuffer)
+    const signatureBytes = parseSignature(signatureBuffer)
+
+    return verify(signatureBytes, scriptBytes, publicKeyRaw)
+  } catch (error) {
+    console.log('Noble verification failed:', error instanceof Error ? error.message : 'Unknown error')
+    return false
+  }
+}
+
+self.onmessage = async function (event) {
+  const { requestId, scriptUrl, signatureUrl, publicKey } = event.data
+
+  try {
+    const [scriptResponse, signatureResponse] = await Promise.all([fetch(scriptUrl), fetch(signatureUrl)])
+
+    if (!scriptResponse.ok || !signatureResponse.ok) {
+      self.postMessage({
+        requestId,
+        success: false,
+        verified: false,
+        error: `Failed to fetch files. Script: ${scriptResponse.status} ${scriptResponse.statusText}, Signature: ${signatureResponse.status} ${signatureResponse.statusText}`,
+      })
+      return
+    }
+
+    const [scriptBuffer, signatureBuffer] = await Promise.all([
+      scriptResponse.arrayBuffer(),
+      signatureResponse.arrayBuffer(),
+    ])
+
+    // Try Web Crypto API first, fallback to Noble if it fails
+    let verified = await verifyWithWebCrypto(publicKey, scriptBuffer, signatureBuffer)
+
+    if (!verified) {
+      verified = await verifyWithNoble(publicKey, scriptBuffer, signatureBuffer)
+    }
+
+    // If verified, include script content to avoid re-downloading
+    let scriptContent: ArrayBuffer | undefined
+    if (verified) {
+      scriptContent = scriptBuffer
+    }
+
+    // Send message with transferable ArrayBuffer for efficiency
+    const message = {
+      requestId,
+      success: true,
+      verified,
+      scriptSize: scriptBuffer.byteLength,
+      signatureSize: signatureBuffer.byteLength,
+      scriptContent,
+    }
+
+    if (scriptContent) {
+      self.postMessage(message, { transfer: [scriptContent] })
+    } else {
+      self.postMessage(message)
+    }
+  } catch (error) {
+    console.error('[Worker] Verification error:', error)
+    self.postMessage({
+      requestId,
+      success: false,
+      verified: false,
+      error: error instanceof Error ? error.message : 'Unknown error',
+    })
+  }
+}
+
+self.onerror = function (error) {
+  console.error('[Worker] Worker error:', error)
+  self.postMessage({
+    success: false,
+    verified: false,
+    error,
+  })
+}
diff --git a/webui/test/setup.ts b/webui/test/setup.ts
index 7c53d16b8..fe734b9b7 100644
--- a/webui/test/setup.ts
+++ b/webui/test/setup.ts
@@ -1,5 +1,6 @@
 import '@testing-library/jest-dom'
 import 'vitest-canvas-mock'
+import '@vitest/web-worker'
 
 import * as matchers from 'jest-extended'
 import { expect } from 'vitest'
@@ -12,6 +13,7 @@ export class IntersectionObserver {
   root = null
   rootMargin = ''
   thresholds = []
+  scrollMargin = ''
 
   disconnect() {
     return null
@@ -43,10 +45,10 @@ class ResizeObserver {
 }
 
 beforeAll(() => {
-  global.IntersectionObserver = IntersectionObserver
+  globalThis.IntersectionObserver = IntersectionObserver
   window.IntersectionObserver = IntersectionObserver
 
-  global.ResizeObserver = ResizeObserver
+  globalThis.ResizeObserver = ResizeObserver
   window.ResizeObserver = ResizeObserver
 
   Object.defineProperty(window, 'matchMedia', {
diff --git a/webui/yarn.lock b/webui/yarn.lock
index 3934fc003..efb7038fd 100644
--- a/webui/yarn.lock
+++ b/webui/yarn.lock
@@ -94,6 +94,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/core@npm:^7.23.9":
+  version: 7.28.5
+  resolution: "@babel/core@npm:7.28.5"
+  dependencies:
+    "@babel/code-frame": "npm:^7.27.1"
+    "@babel/generator": "npm:^7.28.5"
+    "@babel/helper-compilation-targets": "npm:^7.27.2"
+    "@babel/helper-module-transforms": "npm:^7.28.3"
+    "@babel/helpers": "npm:^7.28.4"
+    "@babel/parser": "npm:^7.28.5"
+    "@babel/template": "npm:^7.27.2"
+    "@babel/traverse": "npm:^7.28.5"
+    "@babel/types": "npm:^7.28.5"
+    "@jridgewell/remapping": "npm:^2.3.5"
+    convert-source-map: "npm:^2.0.0"
+    debug: "npm:^4.1.0"
+    gensync: "npm:^1.0.0-beta.2"
+    json5: "npm:^2.2.3"
+    semver: "npm:^6.3.1"
+  checksum: 10c0/535f82238027621da6bdffbdbe896ebad3558b311d6f8abc680637a9859b96edbf929ab010757055381570b29cf66c4a295b5618318d27a4273c0e2033925e72
+  languageName: node
+  linkType: hard
+
 "@babel/core@npm:^7.28.0":
   version: 7.28.0
   resolution: "@babel/core@npm:7.28.0"
@@ -143,6 +166,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/generator@npm:^7.28.5":
+  version: 7.28.5
+  resolution: "@babel/generator@npm:7.28.5"
+  dependencies:
+    "@babel/parser": "npm:^7.28.5"
+    "@babel/types": "npm:^7.28.5"
+    "@jridgewell/gen-mapping": "npm:^0.3.12"
+    "@jridgewell/trace-mapping": "npm:^0.3.28"
+    jsesc: "npm:^3.0.2"
+  checksum: 10c0/9f219fe1d5431b6919f1a5c60db8d5d34fe546c0d8f5a8511b32f847569234ffc8032beb9e7404649a143f54e15224ecb53a3d11b6bb85c3203e573d91fca752
+  languageName: node
+  linkType: hard
+
 "@babel/helper-annotate-as-pure@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/helper-annotate-as-pure@npm:7.25.9"
@@ -240,7 +276,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.10.4, @babel/helper-module-imports@npm:^7.25.9":
+"@babel/helper-module-imports@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/helper-module-imports@npm:7.25.9"
   dependencies:
@@ -286,6 +322,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/helper-module-transforms@npm:^7.28.3":
+  version: 7.28.3
+  resolution: "@babel/helper-module-transforms@npm:7.28.3"
+  dependencies:
+    "@babel/helper-module-imports": "npm:^7.27.1"
+    "@babel/helper-validator-identifier": "npm:^7.27.1"
+    "@babel/traverse": "npm:^7.28.3"
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 10c0/549be62515a6d50cd4cfefcab1b005c47f89bd9135a22d602ee6a5e3a01f27571868ada10b75b033569f24dc4a2bb8d04bfa05ee75c16da7ade2d0db1437fcdb
+  languageName: node
+  linkType: hard
+
 "@babel/helper-optimise-call-expression@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/helper-optimise-call-expression@npm:7.25.9"
@@ -373,6 +422,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/helper-validator-identifier@npm:^7.28.5":
+  version: 7.28.5
+  resolution: "@babel/helper-validator-identifier@npm:7.28.5"
+  checksum: 10c0/42aaebed91f739a41f3d80b72752d1f95fd7c72394e8e4bd7cdd88817e0774d80a432451bcba17c2c642c257c483bf1d409dd4548883429ea9493a3bc4ab0847
+  languageName: node
+  linkType: hard
+
 "@babel/helper-validator-option@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/helper-validator-option@npm:7.25.9"
@@ -418,6 +474,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/helpers@npm:^7.28.4":
+  version: 7.28.4
+  resolution: "@babel/helpers@npm:7.28.4"
+  dependencies:
+    "@babel/template": "npm:^7.27.2"
+    "@babel/types": "npm:^7.28.4"
+  checksum: 10c0/aaa5fb8098926dfed5f223adf2c5e4c7fbba4b911b73dfec2d7d3083f8ba694d201a206db673da2d9b3ae8c01793e795767654558c450c8c14b4c2175b4fcb44
+  languageName: node
+  linkType: hard
+
 "@babel/parser@npm:^7.1.0, @babel/parser@npm:^7.20.7, @babel/parser@npm:^7.25.4, @babel/parser@npm:^7.26.10, @babel/parser@npm:^7.27.0":
   version: 7.27.0
   resolution: "@babel/parser@npm:7.27.0"
@@ -440,6 +506,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/parser@npm:^7.28.5":
+  version: 7.28.5
+  resolution: "@babel/parser@npm:7.28.5"
+  dependencies:
+    "@babel/types": "npm:^7.28.5"
+  bin:
+    parser: ./bin/babel-parser.js
+  checksum: 10c0/5bbe48bf2c79594ac02b490a41ffde7ef5aa22a9a88ad6bcc78432a6ba8a9d638d531d868bd1f104633f1f6bba9905746e15185b8276a3756c42b765d131b1ef
+  languageName: node
+  linkType: hard
+
 "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:7.25.9"
@@ -541,6 +618,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/plugin-syntax-typescript@npm:^7.23.3":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-typescript@npm:7.27.1"
+  dependencies:
+    "@babel/helper-plugin-utils": "npm:^7.27.1"
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 10c0/11589b4c89c66ef02d57bf56c6246267851ec0c361f58929327dc3e070b0dab644be625bbe7fb4c4df30c3634bfdfe31244e1f517be397d2def1487dbbe3c37d
+  languageName: node
+  linkType: hard
+
 "@babel/plugin-syntax-typescript@npm:^7.25.9":
   version: 7.25.9
   resolution: "@babel/plugin-syntax-typescript@npm:7.25.9"
@@ -1443,6 +1531,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/traverse@npm:^7.28.3, @babel/traverse@npm:^7.28.5":
+  version: 7.28.5
+  resolution: "@babel/traverse@npm:7.28.5"
+  dependencies:
+    "@babel/code-frame": "npm:^7.27.1"
+    "@babel/generator": "npm:^7.28.5"
+    "@babel/helper-globals": "npm:^7.28.0"
+    "@babel/parser": "npm:^7.28.5"
+    "@babel/template": "npm:^7.27.2"
+    "@babel/types": "npm:^7.28.5"
+    debug: "npm:^4.3.1"
+  checksum: 10c0/f6c4a595993ae2b73f2d4cd9c062f2e232174d293edd4abe1d715bd6281da8d99e47c65857e8d0917d9384c65972f4acdebc6749a7c40a8fcc38b3c7fb3e706f
+  languageName: node
+  linkType: hard
+
 "@babel/types@npm:^7.0.0, @babel/types@npm:^7.18.9, @babel/types@npm:^7.20.7, @babel/types@npm:^7.25.4, @babel/types@npm:^7.25.9, @babel/types@npm:^7.26.10, @babel/types@npm:^7.27.0, @babel/types@npm:^7.4.4":
   version: 7.27.0
   resolution: "@babel/types@npm:7.27.0"
@@ -1463,6 +1566,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/types@npm:^7.28.4, @babel/types@npm:^7.28.5":
+  version: 7.28.5
+  resolution: "@babel/types@npm:7.28.5"
+  dependencies:
+    "@babel/helper-string-parser": "npm:^7.27.1"
+    "@babel/helper-validator-identifier": "npm:^7.28.5"
+  checksum: 10c0/a5a483d2100befbf125793640dec26b90b95fd233a94c19573325898a5ce1e52cdfa96e495c7dcc31b5eca5b66ce3e6d4a0f5a4a62daec271455959f208ab08a
+  languageName: node
+  linkType: hard
+
 "@bcoe/v8-coverage@npm:^1.0.2":
   version: 1.0.2
   resolution: "@bcoe/v8-coverage@npm:1.0.2"
@@ -1590,6 +1703,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@emotion/hash@npm:^0.9.0":
+  version: 0.9.2
+  resolution: "@emotion/hash@npm:0.9.2"
+  checksum: 10c0/0dc254561a3cc0a06a10bbce7f6a997883fd240c8c1928b93713f803a2e9153a257a488537012efe89dbe1246f2abfe2add62cdb3471a13d67137fcb808e81c2
+  languageName: node
+  linkType: hard
+
 "@esbuild/aix-ppc64@npm:0.21.5":
   version: 0.21.5
   resolution: "@esbuild/aix-ppc64@npm:0.21.5"
@@ -1597,6 +1717,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/aix-ppc64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/aix-ppc64@npm:0.25.12"
+  conditions: os=aix & cpu=ppc64
+  languageName: node
+  linkType: hard
+
 "@esbuild/aix-ppc64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/aix-ppc64@npm:0.25.2"
@@ -1618,6 +1745,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/android-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/android-arm64@npm:0.25.12"
+  conditions: os=android & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/android-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/android-arm64@npm:0.25.2"
@@ -1639,6 +1773,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/android-arm@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/android-arm@npm:0.25.12"
+  conditions: os=android & cpu=arm
+  languageName: node
+  linkType: hard
+
 "@esbuild/android-arm@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/android-arm@npm:0.25.2"
@@ -1660,6 +1801,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/android-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/android-x64@npm:0.25.12"
+  conditions: os=android & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/android-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/android-x64@npm:0.25.2"
@@ -1681,6 +1829,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/darwin-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/darwin-arm64@npm:0.25.12"
+  conditions: os=darwin & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/darwin-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/darwin-arm64@npm:0.25.2"
@@ -1702,6 +1857,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/darwin-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/darwin-x64@npm:0.25.12"
+  conditions: os=darwin & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/darwin-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/darwin-x64@npm:0.25.2"
@@ -1723,6 +1885,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/freebsd-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/freebsd-arm64@npm:0.25.12"
+  conditions: os=freebsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/freebsd-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/freebsd-arm64@npm:0.25.2"
@@ -1744,6 +1913,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/freebsd-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/freebsd-x64@npm:0.25.12"
+  conditions: os=freebsd & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/freebsd-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/freebsd-x64@npm:0.25.2"
@@ -1765,6 +1941,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-arm64@npm:0.25.12"
+  conditions: os=linux & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-arm64@npm:0.25.2"
@@ -1786,6 +1969,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-arm@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-arm@npm:0.25.12"
+  conditions: os=linux & cpu=arm
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-arm@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-arm@npm:0.25.2"
@@ -1807,6 +1997,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-ia32@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-ia32@npm:0.25.12"
+  conditions: os=linux & cpu=ia32
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-ia32@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-ia32@npm:0.25.2"
@@ -1828,6 +2025,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-loong64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-loong64@npm:0.25.12"
+  conditions: os=linux & cpu=loong64
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-loong64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-loong64@npm:0.25.2"
@@ -1849,6 +2053,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-mips64el@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-mips64el@npm:0.25.12"
+  conditions: os=linux & cpu=mips64el
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-mips64el@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-mips64el@npm:0.25.2"
@@ -1870,6 +2081,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-ppc64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-ppc64@npm:0.25.12"
+  conditions: os=linux & cpu=ppc64
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-ppc64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-ppc64@npm:0.25.2"
@@ -1891,6 +2109,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-riscv64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-riscv64@npm:0.25.12"
+  conditions: os=linux & cpu=riscv64
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-riscv64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-riscv64@npm:0.25.2"
@@ -1912,6 +2137,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-s390x@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-s390x@npm:0.25.12"
+  conditions: os=linux & cpu=s390x
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-s390x@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-s390x@npm:0.25.2"
@@ -1933,6 +2165,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/linux-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/linux-x64@npm:0.25.12"
+  conditions: os=linux & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/linux-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/linux-x64@npm:0.25.2"
@@ -1947,6 +2186,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/netbsd-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/netbsd-arm64@npm:0.25.12"
+  conditions: os=netbsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/netbsd-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/netbsd-arm64@npm:0.25.2"
@@ -1968,6 +2214,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/netbsd-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/netbsd-x64@npm:0.25.12"
+  conditions: os=netbsd & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/netbsd-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/netbsd-x64@npm:0.25.2"
@@ -1982,6 +2235,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/openbsd-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/openbsd-arm64@npm:0.25.12"
+  conditions: os=openbsd & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/openbsd-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/openbsd-arm64@npm:0.25.2"
@@ -2003,6 +2263,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/openbsd-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/openbsd-x64@npm:0.25.12"
+  conditions: os=openbsd & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/openbsd-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/openbsd-x64@npm:0.25.2"
@@ -2017,6 +2284,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/openharmony-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/openharmony-arm64@npm:0.25.12"
+  conditions: os=openharmony & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/openharmony-arm64@npm:0.25.8":
   version: 0.25.8
   resolution: "@esbuild/openharmony-arm64@npm:0.25.8"
@@ -2031,6 +2305,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/sunos-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/sunos-x64@npm:0.25.12"
+  conditions: os=sunos & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/sunos-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/sunos-x64@npm:0.25.2"
@@ -2052,6 +2333,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/win32-arm64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/win32-arm64@npm:0.25.12"
+  conditions: os=win32 & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@esbuild/win32-arm64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/win32-arm64@npm:0.25.2"
@@ -2073,6 +2361,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/win32-ia32@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/win32-ia32@npm:0.25.12"
+  conditions: os=win32 & cpu=ia32
+  languageName: node
+  linkType: hard
+
 "@esbuild/win32-ia32@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/win32-ia32@npm:0.25.2"
@@ -2094,6 +2389,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@esbuild/win32-x64@npm:0.25.12":
+  version: 0.25.12
+  resolution: "@esbuild/win32-x64@npm:0.25.12"
+  conditions: os=win32 & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@esbuild/win32-x64@npm:0.25.2":
   version: 0.25.2
   resolution: "@esbuild/win32-x64@npm:0.25.2"
@@ -2357,6 +2659,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@isaacs/balanced-match@npm:^4.0.1":
+  version: 4.0.1
+  resolution: "@isaacs/balanced-match@npm:4.0.1"
+  checksum: 10c0/7da011805b259ec5c955f01cee903da72ad97c5e6f01ca96197267d3f33103d5b2f8a1af192140f3aa64526c593c8d098ae366c2b11f7f17645d12387c2fd420
+  languageName: node
+  linkType: hard
+
+"@isaacs/brace-expansion@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "@isaacs/brace-expansion@npm:5.0.0"
+  dependencies:
+    "@isaacs/balanced-match": "npm:^4.0.1"
+  checksum: 10c0/b4d4812f4be53afc2c5b6c545001ff7a4659af68d4484804e9d514e183d20269bb81def8682c01a22b17c4d6aed14292c8494f7d2ac664e547101c1a905aa977
+  languageName: node
+  linkType: hard
+
 "@isaacs/cliui@npm:^8.0.2":
   version: 8.0.2
   resolution: "@isaacs/cliui@npm:8.0.2"
@@ -2464,6 +2782,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@jridgewell/remapping@npm:^2.3.5":
+  version: 2.3.5
+  resolution: "@jridgewell/remapping@npm:2.3.5"
+  dependencies:
+    "@jridgewell/gen-mapping": "npm:^0.3.5"
+    "@jridgewell/trace-mapping": "npm:^0.3.24"
+  checksum: 10c0/3de494219ffeb2c5c38711d0d7bb128097edf91893090a2dbc8ee0b55d092bb7347b1fd0f478486c5eab010e855c73927b1666f2107516d472d24a73017d1194
+  languageName: node
+  linkType: hard
+
 "@jridgewell/resolve-uri@npm:^3.1.0":
   version: 3.1.2
   resolution: "@jridgewell/resolve-uri@npm:3.1.2"
@@ -2485,6 +2813,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@jridgewell/sourcemap-codec@npm:^1.5.5":
+  version: 1.5.5
+  resolution: "@jridgewell/sourcemap-codec@npm:1.5.5"
+  checksum: 10c0/f9e538f302b63c0ebc06eecb1dd9918dd4289ed36147a0ddce35d6ea4d7ebbda243cda7b2213b6a5e1d8087a298d5cf630fb2bd39329cdecb82017023f6081a0
+  languageName: node
+  linkType: hard
+
 "@jridgewell/trace-mapping@npm:^0.3.23, @jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
   version: 0.3.25
   resolution: "@jridgewell/trace-mapping@npm:0.3.25"
@@ -2536,6 +2871,60 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@microsoft/api-extractor-model@npm:7.32.0":
+  version: 7.32.0
+  resolution: "@microsoft/api-extractor-model@npm:7.32.0"
+  dependencies:
+    "@microsoft/tsdoc": "npm:~0.16.0"
+    "@microsoft/tsdoc-config": "npm:~0.18.0"
+    "@rushstack/node-core-library": "npm:5.18.0"
+  checksum: 10c0/e6d9c54a457c66dec53765522f411c8ca5d2bb8c51559b9f952fdd7bb88b10efe035a8dbdf8b672644c136d75a65f3446b3b18938fa50c0a766f83111cbda5eb
+  languageName: node
+  linkType: hard
+
+"@microsoft/api-extractor@npm:^7.50.1":
+  version: 7.55.0
+  resolution: "@microsoft/api-extractor@npm:7.55.0"
+  dependencies:
+    "@microsoft/api-extractor-model": "npm:7.32.0"
+    "@microsoft/tsdoc": "npm:~0.16.0"
+    "@microsoft/tsdoc-config": "npm:~0.18.0"
+    "@rushstack/node-core-library": "npm:5.18.0"
+    "@rushstack/rig-package": "npm:0.6.0"
+    "@rushstack/terminal": "npm:0.19.3"
+    "@rushstack/ts-command-line": "npm:5.1.3"
+    diff: "npm:~8.0.2"
+    lodash: "npm:~4.17.15"
+    minimatch: "npm:10.0.3"
+    resolve: "npm:~1.22.1"
+    semver: "npm:~7.5.4"
+    source-map: "npm:~0.6.1"
+    typescript: "npm:5.8.2"
+  bin:
+    api-extractor: bin/api-extractor
+  checksum: 10c0/3211981b7aaf6ca7a36fe33dc9cab5014dc753c0c75d09ace46bef07db947a433ca9daecc843ea13b29fe7527ea3d357c7bd5051fedf10ae3b3db31d2a5de71f
+  languageName: node
+  linkType: hard
+
+"@microsoft/tsdoc-config@npm:~0.18.0":
+  version: 0.18.0
+  resolution: "@microsoft/tsdoc-config@npm:0.18.0"
+  dependencies:
+    "@microsoft/tsdoc": "npm:0.16.0"
+    ajv: "npm:~8.12.0"
+    jju: "npm:~1.4.0"
+    resolve: "npm:~1.22.2"
+  checksum: 10c0/6e2c3bfde3e5fa4c0360127c86fe016dcf1b09d0091d767c06ce916284d3f6aeea3617a33b855c5bb2615ab0f2840eeebd4c7f4a1f879f951828d213bf306cfd
+  languageName: node
+  linkType: hard
+
+"@microsoft/tsdoc@npm:0.16.0, @microsoft/tsdoc@npm:~0.16.0":
+  version: 0.16.0
+  resolution: "@microsoft/tsdoc@npm:0.16.0"
+  checksum: 10c0/8883bb0ed22753af7360e9222687fda4eb448f0a574ea34b4596c11e320148b3ae0d24e00f8923df8ba7bc62a46a6f53b9343243a348640d923dfd55d52cd6bb
+  languageName: node
+  linkType: hard
+
 "@mswjs/interceptors@npm:^0.37.0":
   version: 0.37.6
   resolution: "@mswjs/interceptors@npm:0.37.6"
@@ -2561,6 +2950,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@noble/ed25519@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "@noble/ed25519@npm:3.0.0"
+  checksum: 10c0/6355aed04523d063d3e9a9952926af4a0eaa722e08133f558d44963a3048bf6dae02cae9032d42238d1fcb2a93ef27658f2baf4cf07939457717a4337a89dc26
+  languageName: node
+  linkType: hard
+
+"@noble/hashes@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "@noble/hashes@npm:2.0.1"
+  checksum: 10c0/e81769ce21c3b1c80141a3b99bd001f17edea09879aa936692ae39525477386d696101cd573928a304806efb2b9fa751e1dd83241c67d0c84d30091e85c79bdb
+  languageName: node
+  linkType: hard
+
 "@nodelib/fs.scandir@npm:2.1.5":
   version: 2.1.5
   resolution: "@nodelib/fs.scandir@npm:2.1.5"
@@ -3406,7 +3809,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@radix-ui/react-icons@npm:^1.1.1":
+"@radix-ui/react-icons@npm:^1.3.2":
   version: 1.3.2
   resolution: "@radix-ui/react-icons@npm:1.3.2"
   peerDependencies:
@@ -4050,46 +4453,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/plugin-babel@npm:^5.3.1":
-  version: 5.3.1
-  resolution: "@rollup/plugin-babel@npm:5.3.1"
-  dependencies:
-    "@babel/helper-module-imports": "npm:^7.10.4"
-    "@rollup/pluginutils": "npm:^3.1.0"
-  peerDependencies:
-    "@babel/core": ^7.0.0
-    "@types/babel__core": ^7.1.9
-    rollup: ^1.20.0||^2.0.0
-  peerDependenciesMeta:
-    "@types/babel__core":
-      optional: true
-  checksum: 10c0/2766134dd5567c0d4fd6909d1f511ce9bf3bd9d727e1bc5ffdd6097a3606faca324107ae8e0961839ee4dbb45e5e579ae601efe472fc0a271259aea79920cafa
-  languageName: node
-  linkType: hard
-
-"@rollup/pluginutils@npm:^3.1.0":
-  version: 3.1.0
-  resolution: "@rollup/pluginutils@npm:3.1.0"
-  dependencies:
-    "@types/estree": "npm:0.0.39"
-    estree-walker: "npm:^1.0.1"
-    picomatch: "npm:^2.2.2"
-  peerDependencies:
-    rollup: ^1.20.0||^2.0.0
-  checksum: 10c0/7151753160d15ba2b259461a6c25b3932150994ea52dba8fd3144f634c7647c2e56733d986e2c15de67c4d96a9ee7d6278efa6d2e626a7169898fd64adc0f90c
-  languageName: node
-  linkType: hard
-
-"@rollup/pluginutils@npm:^4.1.2":
-  version: 4.2.1
-  resolution: "@rollup/pluginutils@npm:4.2.1"
-  dependencies:
-    estree-walker: "npm:^2.0.1"
-    picomatch: "npm:^2.2.2"
-  checksum: 10c0/3ee56b2c8f1ed8dfd0a92631da1af3a2dfdd0321948f089b3752b4de1b54dc5076701eadd0e5fc18bd191b77af594ac1db6279e83951238ba16bf8a414c64c48
-  languageName: node
-  linkType: hard
-
 "@rollup/pluginutils@npm:^5.0.2":
   version: 5.1.4
   resolution: "@rollup/pluginutils@npm:5.1.4"
@@ -4106,6 +4469,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@rollup/pluginutils@npm:^5.1.4":
+  version: 5.3.0
+  resolution: "@rollup/pluginutils@npm:5.3.0"
+  dependencies:
+    "@types/estree": "npm:^1.0.0"
+    estree-walker: "npm:^2.0.2"
+    picomatch: "npm:^4.0.2"
+  peerDependencies:
+    rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
+  peerDependenciesMeta:
+    rollup:
+      optional: true
+  checksum: 10c0/001834bf62d7cf5bac424d2617c113f7f7d3b2bf3c1778cbcccb72cdc957b68989f8e7747c782c2b911f1dde8257f56f8ac1e779e29e74e638e3f1e2cac2bcd0
+  languageName: node
+  linkType: hard
+
 "@rollup/rollup-android-arm-eabi@npm:4.39.0":
   version: 4.39.0
   resolution: "@rollup/rollup-android-arm-eabi@npm:4.39.0"
@@ -4113,9 +4492,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-android-arm-eabi@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-android-arm-eabi@npm:4.46.1"
+"@rollup/rollup-android-arm-eabi@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-android-arm-eabi@npm:4.52.5"
   conditions: os=android & cpu=arm
   languageName: node
   linkType: hard
@@ -4127,9 +4506,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-android-arm64@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-android-arm64@npm:4.46.1"
+"@rollup/rollup-android-arm64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-android-arm64@npm:4.52.5"
   conditions: os=android & cpu=arm64
   languageName: node
   linkType: hard
@@ -4141,9 +4520,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-darwin-arm64@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-darwin-arm64@npm:4.46.1"
+"@rollup/rollup-darwin-arm64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-darwin-arm64@npm:4.52.5"
   conditions: os=darwin & cpu=arm64
   languageName: node
   linkType: hard
@@ -4155,9 +4534,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-darwin-x64@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-darwin-x64@npm:4.46.1"
+"@rollup/rollup-darwin-x64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-darwin-x64@npm:4.52.5"
   conditions: os=darwin & cpu=x64
   languageName: node
   linkType: hard
@@ -4169,9 +4548,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-freebsd-arm64@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-freebsd-arm64@npm:4.46.1"
+"@rollup/rollup-freebsd-arm64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-freebsd-arm64@npm:4.52.5"
   conditions: os=freebsd & cpu=arm64
   languageName: node
   linkType: hard
@@ -4183,9 +4562,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-freebsd-x64@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-freebsd-x64@npm:4.46.1"
+"@rollup/rollup-freebsd-x64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-freebsd-x64@npm:4.52.5"
   conditions: os=freebsd & cpu=x64
   languageName: node
   linkType: hard
@@ -4197,9 +4576,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-arm-gnueabihf@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-arm-gnueabihf@npm:4.46.1"
+"@rollup/rollup-linux-arm-gnueabihf@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-arm-gnueabihf@npm:4.52.5"
   conditions: os=linux & cpu=arm & libc=glibc
   languageName: node
   linkType: hard
@@ -4211,9 +4590,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-arm-musleabihf@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-arm-musleabihf@npm:4.46.1"
+"@rollup/rollup-linux-arm-musleabihf@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-arm-musleabihf@npm:4.52.5"
   conditions: os=linux & cpu=arm & libc=musl
   languageName: node
   linkType: hard
@@ -4225,9 +4604,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-arm64-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-arm64-gnu@npm:4.46.1"
+"@rollup/rollup-linux-arm64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-arm64-gnu@npm:4.52.5"
   conditions: os=linux & cpu=arm64 & libc=glibc
   languageName: node
   linkType: hard
@@ -4239,13 +4618,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-arm64-musl@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-arm64-musl@npm:4.46.1"
+"@rollup/rollup-linux-arm64-musl@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-arm64-musl@npm:4.52.5"
   conditions: os=linux & cpu=arm64 & libc=musl
   languageName: node
   linkType: hard
 
+"@rollup/rollup-linux-loong64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-loong64-gnu@npm:4.52.5"
+  conditions: os=linux & cpu=loong64 & libc=glibc
+  languageName: node
+  linkType: hard
+
 "@rollup/rollup-linux-loongarch64-gnu@npm:4.39.0":
   version: 4.39.0
   resolution: "@rollup/rollup-linux-loongarch64-gnu@npm:4.39.0"
@@ -4253,13 +4639,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-loongarch64-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-loongarch64-gnu@npm:4.46.1"
-  conditions: os=linux & cpu=loong64 & libc=glibc
-  languageName: node
-  linkType: hard
-
 "@rollup/rollup-linux-powerpc64le-gnu@npm:4.39.0":
   version: 4.39.0
   resolution: "@rollup/rollup-linux-powerpc64le-gnu@npm:4.39.0"
@@ -4267,9 +4646,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-ppc64-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-ppc64-gnu@npm:4.46.1"
+"@rollup/rollup-linux-ppc64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-ppc64-gnu@npm:4.52.5"
   conditions: os=linux & cpu=ppc64 & libc=glibc
   languageName: node
   linkType: hard
@@ -4281,9 +4660,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-riscv64-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-riscv64-gnu@npm:4.46.1"
+"@rollup/rollup-linux-riscv64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-riscv64-gnu@npm:4.52.5"
   conditions: os=linux & cpu=riscv64 & libc=glibc
   languageName: node
   linkType: hard
@@ -4295,9 +4674,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-riscv64-musl@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-riscv64-musl@npm:4.46.1"
+"@rollup/rollup-linux-riscv64-musl@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-riscv64-musl@npm:4.52.5"
   conditions: os=linux & cpu=riscv64 & libc=musl
   languageName: node
   linkType: hard
@@ -4309,9 +4688,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-s390x-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-s390x-gnu@npm:4.46.1"
+"@rollup/rollup-linux-s390x-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-s390x-gnu@npm:4.52.5"
   conditions: os=linux & cpu=s390x & libc=glibc
   languageName: node
   linkType: hard
@@ -4323,9 +4702,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-x64-gnu@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-x64-gnu@npm:4.46.1"
+"@rollup/rollup-linux-x64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-x64-gnu@npm:4.52.5"
   conditions: os=linux & cpu=x64 & libc=glibc
   languageName: node
   linkType: hard
@@ -4337,13 +4716,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-linux-x64-musl@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-linux-x64-musl@npm:4.46.1"
+"@rollup/rollup-linux-x64-musl@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-linux-x64-musl@npm:4.52.5"
   conditions: os=linux & cpu=x64 & libc=musl
   languageName: node
   linkType: hard
 
+"@rollup/rollup-openharmony-arm64@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-openharmony-arm64@npm:4.52.5"
+  conditions: os=openharmony & cpu=arm64
+  languageName: node
+  linkType: hard
+
 "@rollup/rollup-win32-arm64-msvc@npm:4.39.0":
   version: 4.39.0
   resolution: "@rollup/rollup-win32-arm64-msvc@npm:4.39.0"
@@ -4351,9 +4737,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-win32-arm64-msvc@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-win32-arm64-msvc@npm:4.46.1"
+"@rollup/rollup-win32-arm64-msvc@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-win32-arm64-msvc@npm:4.52.5"
   conditions: os=win32 & cpu=arm64
   languageName: node
   linkType: hard
@@ -4365,13 +4751,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-win32-ia32-msvc@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-win32-ia32-msvc@npm:4.46.1"
+"@rollup/rollup-win32-ia32-msvc@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-win32-ia32-msvc@npm:4.52.5"
   conditions: os=win32 & cpu=ia32
   languageName: node
   linkType: hard
 
+"@rollup/rollup-win32-x64-gnu@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-win32-x64-gnu@npm:4.52.5"
+  conditions: os=win32 & cpu=x64
+  languageName: node
+  linkType: hard
+
 "@rollup/rollup-win32-x64-msvc@npm:4.39.0":
   version: 4.39.0
   resolution: "@rollup/rollup-win32-x64-msvc@npm:4.39.0"
@@ -4379,9 +4772,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@rollup/rollup-win32-x64-msvc@npm:4.46.1":
-  version: 4.46.1
-  resolution: "@rollup/rollup-win32-x64-msvc@npm:4.46.1"
+"@rollup/rollup-win32-x64-msvc@npm:4.52.5":
+  version: 4.52.5
+  resolution: "@rollup/rollup-win32-x64-msvc@npm:4.52.5"
   conditions: os=win32 & cpu=x64
   languageName: node
   linkType: hard
@@ -4393,6 +4786,77 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@rushstack/node-core-library@npm:5.18.0":
+  version: 5.18.0
+  resolution: "@rushstack/node-core-library@npm:5.18.0"
+  dependencies:
+    ajv: "npm:~8.13.0"
+    ajv-draft-04: "npm:~1.0.0"
+    ajv-formats: "npm:~3.0.1"
+    fs-extra: "npm:~11.3.0"
+    import-lazy: "npm:~4.0.0"
+    jju: "npm:~1.4.0"
+    resolve: "npm:~1.22.1"
+    semver: "npm:~7.5.4"
+  peerDependencies:
+    "@types/node": "*"
+  peerDependenciesMeta:
+    "@types/node":
+      optional: true
+  checksum: 10c0/dc9744f5359178b9772508f1f7229c7586bf7e74942e6e28e3bcd48d1af97d5a9d4866fe243e3b0003309896b134780837033115291c37c1b8da363bb3e551bf
+  languageName: node
+  linkType: hard
+
+"@rushstack/problem-matcher@npm:0.1.1":
+  version: 0.1.1
+  resolution: "@rushstack/problem-matcher@npm:0.1.1"
+  peerDependencies:
+    "@types/node": "*"
+  peerDependenciesMeta:
+    "@types/node":
+      optional: true
+  checksum: 10c0/c847e721d3536ebb316fdd90b3e4033a7d24ff8c70e38e3eaeaadf167c4d14a7f16377ae4af8097532386bcfa81c15cfec7d2da517542c07882d273d56861d78
+  languageName: node
+  linkType: hard
+
+"@rushstack/rig-package@npm:0.6.0":
+  version: 0.6.0
+  resolution: "@rushstack/rig-package@npm:0.6.0"
+  dependencies:
+    resolve: "npm:~1.22.1"
+    strip-json-comments: "npm:~3.1.1"
+  checksum: 10c0/303c5c010a698343124036414dbeed44b24e67585307ffa6effd052624b0384cc08a12aeb153e8466b7abd6f516900ecf8629600230f0f2c33cd5c0c3dace65e
+  languageName: node
+  linkType: hard
+
+"@rushstack/terminal@npm:0.19.3":
+  version: 0.19.3
+  resolution: "@rushstack/terminal@npm:0.19.3"
+  dependencies:
+    "@rushstack/node-core-library": "npm:5.18.0"
+    "@rushstack/problem-matcher": "npm:0.1.1"
+    supports-color: "npm:~8.1.1"
+  peerDependencies:
+    "@types/node": "*"
+  peerDependenciesMeta:
+    "@types/node":
+      optional: true
+  checksum: 10c0/aae29b9f7968192af2750ec0a0d31dd9d320494838a8f8a312a0773c2dc1420b087a2a6f98c9915d0215da0c9f7a11f58a4954758b62fce569c62f4daa32368d
+  languageName: node
+  linkType: hard
+
+"@rushstack/ts-command-line@npm:5.1.3":
+  version: 5.1.3
+  resolution: "@rushstack/ts-command-line@npm:5.1.3"
+  dependencies:
+    "@rushstack/terminal": "npm:0.19.3"
+    "@types/argparse": "npm:1.0.38"
+    argparse: "npm:~1.0.9"
+    string-argv: "npm:~0.3.1"
+  checksum: 10c0/03263347660eb2fd9e4c88e704f7611f9d16f3f31ce43726165ab3421dff3cfdb51c9e25170f96dd8c0c3681595d6a1665bfec16224718ea20173507ef531240
+  languageName: node
+  linkType: hard
+
 "@samverschueren/stream-to-observable@npm:^0.3.0":
   version: 0.3.1
   resolution: "@samverschueren/stream-to-observable@npm:0.3.1"
@@ -4522,16 +4986,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@stitches/react@npm:1.2.7":
-  version: 1.2.7
-  resolution: "@stitches/react@npm:1.2.7"
-  peerDependencies:
-    react: ">= 16.3.0"
-  checksum: 10c0/c5da5e4b862306d2dd0545765c497bf5b972315a801ee7120374c13950db49587fe3f3ef5282be1ce189f9de2acbe3a4d0f8ba40283fe058b8d056674a336e60
+"@standard-schema/spec@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "@standard-schema/spec@npm:1.0.0"
+  checksum: 10c0/a1ab9a8bdc09b5b47aa8365d0e0ec40cc2df6437be02853696a0e377321653b0d3ac6f079a8c67d5ddbe9821025584b1fb71d9cc041a6666a96f1fadf2ece15f
   languageName: node
   linkType: hard
 
-"@storybook/addon-actions@npm:8.6.12, @storybook/addon-actions@npm:^8.2.2":
+"@stitches/react@npm:1.2.8":
+  version: 1.2.8
+  resolution: "@stitches/react@npm:1.2.8"
+  peerDependencies:
+    react: ">= 16.3.0"
+  checksum: 10c0/d9c03cd88ac25edc493b23a1359f36aa9a497d13bb7a833204d8228b09b6227c1a8ea22e946312ca605f7819fbdd3c49d5f8a5f14b2801c9a31d36172d7f60ac
+  languageName: node
+  linkType: hard
+
+"@storybook/addon-actions@npm:8.6.12":
   version: 8.6.12
   resolution: "@storybook/addon-actions@npm:8.6.12"
   dependencies:
@@ -4967,9 +5438,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@traefiklabs/faency@npm:11.1.4":
-  version: 11.1.4
-  resolution: "@traefiklabs/faency@npm:11.1.4"
+"@traefiklabs/faency@npm:12.0.4":
+  version: 12.0.4
+  resolution: "@traefiklabs/faency@npm:12.0.4"
   dependencies:
     "@babel/core": "npm:^7.15.4"
     "@babel/plugin-transform-react-pure-annotations": "npm:^7.16.7"
@@ -4988,7 +5459,7 @@ __metadata:
     "@radix-ui/react-context-menu": "npm:^2.0.1"
     "@radix-ui/react-dialog": "npm:^1.0.2"
     "@radix-ui/react-dropdown-menu": "npm:^2.0.1"
-    "@radix-ui/react-icons": "npm:^1.1.1"
+    "@radix-ui/react-icons": "npm:^1.3.2"
     "@radix-ui/react-id": "npm:^1.0.0"
     "@radix-ui/react-label": "npm:^2.0.0"
     "@radix-ui/react-navigation-menu": "npm:^1.2.0"
@@ -5007,13 +5478,11 @@ __metadata:
     "@radix-ui/react-use-layout-effect": "npm:^1.0.0"
     "@radix-ui/react-visually-hidden": "npm:^1.0.1"
     "@rehookify/datepicker": "npm:^6.6.7"
-    "@rollup/plugin-babel": "npm:^5.3.1"
     "@semantic-release/commit-analyzer": "npm:^9.0.2"
     "@semantic-release/github": "npm:^8.0.2"
     "@semantic-release/npm": "npm:^9.0.0"
     "@semantic-release/release-notes-generator": "npm:^10.0.3"
-    "@stitches/react": "npm:1.2.7"
-    "@storybook/addon-actions": "npm:^8.2.2"
+    "@stitches/react": "npm:1.2.8"
     "@storybook/addon-docs": "npm:^8.2.5"
     "@storybook/addon-essentials": "npm:^8.2.5"
     "@storybook/addon-links": "npm:^8.2.2"
@@ -5029,6 +5498,10 @@ __metadata:
     "@types/react": "npm:18.2.0"
     "@types/react-dom": "npm:18.2.0"
     "@types/tinycolor2": "npm:^1.4.3"
+    "@vanilla-extract/css": "npm:^1.17.4"
+    "@vanilla-extract/dynamic": "npm:^2.1.5"
+    "@vanilla-extract/recipes": "npm:^0.5.7"
+    "@vanilla-extract/vite-plugin": "npm:^5.1.1"
     "@vitejs/plugin-react": "npm:^4.3.1"
     babel-loader: "npm:^8.2.2"
     conventional-changelog-conventionalcommits: "npm:^4.6.3"
@@ -5039,22 +5512,21 @@ __metadata:
     lodash.merge: "npm:^4.6.2"
     np: "npm:^8.0.4"
     patch-package: "npm:^8.0.0"
-    prettier: "npm:^3.3.3"
+    prettier: "npm:^3.6.2"
     react: "npm:18.2.0"
     react-dom: "npm:18.2.0"
-    rollup: "npm:^2.70.1"
-    rollup-plugin-typescript2: "npm:^0.36.0"
     semantic-release: "npm:^19.0.2"
     storybook: "npm:^8.2.5"
     storybook-dark-mode: "npm:^4.0.2"
     tinycolor2: "npm:^1.4.2"
-    typescript: "npm:5.4.5"
+    typescript: "npm:^5.8.3"
     use-debounce: "npm:9.0.2"
-    vite: "npm:^5.1.5"
+    vite: "npm:^5.4.19"
+    vite-plugin-dts: "npm:^4.5.4"
   peerDependencies:
     react: ">=18"
     react-dom: ">=18"
-  checksum: 10c0/3ef3f665b402a247cda758df9d485b6d573c69e1ebb595e69139a087c88bbd25ad0999b016cd28fa8ed174ec90b347bb5a94661a383f357fd07b6bfd9ce4c287
+  checksum: 10c0/3ad37330aebe01ff674acc8d37799dbce6ac9b9971b6dcdb015be10699ce4386e181a53667bd6e2311dd0ffc5880afacd0b9140d308c63255d2338f1e2a7c08d
   languageName: node
   linkType: hard
 
@@ -5067,6 +5539,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/argparse@npm:1.0.38":
+  version: 1.0.38
+  resolution: "@types/argparse@npm:1.0.38"
+  checksum: 10c0/4fc892da5df16923f48180da2d1f4562fa8b0507cf636b24780444fa0a1d7321d4dc0c0ecbee6152968823f5a2ae0d321b4f8c705a489bf1ae1245bdeb0868fd
+  languageName: node
+  linkType: hard
+
 "@types/aria-query@npm:^5.0.1":
   version: 5.0.4
   resolution: "@types/aria-query@npm:5.0.4"
@@ -5157,13 +5636,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/estree@npm:0.0.39":
-  version: 0.0.39
-  resolution: "@types/estree@npm:0.0.39"
-  checksum: 10c0/f0af6c95ac1988c4827964bd9d3b51d24da442e2188943f6dfcb1e1559103d5d024d564b2e9d3f84c53714a02a0a7435c7441138eb63d9af5de4dfc66cdc0d92
-  languageName: node
-  linkType: hard
-
 "@types/estree@npm:1.0.7, @types/estree@npm:^1.0.0, @types/estree@npm:^1.0.6":
   version: 1.0.7
   resolution: "@types/estree@npm:1.0.7"
@@ -5780,6 +6252,102 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@vanilla-extract/babel-plugin-debug-ids@npm:^1.2.2":
+  version: 1.2.2
+  resolution: "@vanilla-extract/babel-plugin-debug-ids@npm:1.2.2"
+  dependencies:
+    "@babel/core": "npm:^7.23.9"
+  checksum: 10c0/ac9dc2fc01cf737a2d6c9e318e4417acf073eead736afd03fab3b1f1a41553b37a0ded291f88c2cbb09e233a60928f2a493405dd14e0353995de79216c44debf
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/compiler@npm:^0.3.1":
+  version: 0.3.1
+  resolution: "@vanilla-extract/compiler@npm:0.3.1"
+  dependencies:
+    "@vanilla-extract/css": "npm:^1.17.4"
+    "@vanilla-extract/integration": "npm:^8.0.4"
+    vite: "npm:^5.0.0 || ^6.0.0 || ^7.0.0"
+    vite-node: "npm:^3.2.2"
+  checksum: 10c0/2863ffb30a9be1c11f1f1e658fded42a558d55f9163c34a6465021671740dbefdc2491bc2434815bf5c6cd5771d529331b1e0cd0c39c162306341acbfb2be768
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/css@npm:^1.17.4":
+  version: 1.17.4
+  resolution: "@vanilla-extract/css@npm:1.17.4"
+  dependencies:
+    "@emotion/hash": "npm:^0.9.0"
+    "@vanilla-extract/private": "npm:^1.0.9"
+    css-what: "npm:^6.1.0"
+    cssesc: "npm:^3.0.0"
+    csstype: "npm:^3.0.7"
+    dedent: "npm:^1.5.3"
+    deep-object-diff: "npm:^1.1.9"
+    deepmerge: "npm:^4.2.2"
+    lru-cache: "npm:^10.4.3"
+    media-query-parser: "npm:^2.0.2"
+    modern-ahocorasick: "npm:^1.0.0"
+    picocolors: "npm:^1.0.0"
+  checksum: 10c0/f241aef803db870e2b503ca1b8ed81976e839ab884e4c20594a352de7fe8c693920e05b17b4b4892d86d8c65126bec3184f003afc406505cb419b2b5569c11e1
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/dynamic@npm:^2.1.5":
+  version: 2.1.5
+  resolution: "@vanilla-extract/dynamic@npm:2.1.5"
+  dependencies:
+    "@vanilla-extract/private": "npm:^1.0.9"
+  checksum: 10c0/6b7f445918972579d8f988ccca54f3c9c0fdaf5f2bdff641e5e87eae3952e523acb3ac7243162317941d7cf71ba2383a2a4eeaa32eb5a1b661e098b27e02961d
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/integration@npm:^8.0.4":
+  version: 8.0.4
+  resolution: "@vanilla-extract/integration@npm:8.0.4"
+  dependencies:
+    "@babel/core": "npm:^7.23.9"
+    "@babel/plugin-syntax-typescript": "npm:^7.23.3"
+    "@vanilla-extract/babel-plugin-debug-ids": "npm:^1.2.2"
+    "@vanilla-extract/css": "npm:^1.17.4"
+    dedent: "npm:^1.5.3"
+    esbuild: "npm:esbuild@>=0.17.6 <0.26.0"
+    eval: "npm:0.1.8"
+    find-up: "npm:^5.0.0"
+    javascript-stringify: "npm:^2.0.1"
+    mlly: "npm:^1.4.2"
+  checksum: 10c0/3f409bb52d44f8c3bc6cd133d89f72ec87e5985bf1c75534b59712c2260da3b3040ba0fd120c61dbc1d400884aa656a502981cf479ffe584379ede779c472617
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/private@npm:^1.0.9":
+  version: 1.0.9
+  resolution: "@vanilla-extract/private@npm:1.0.9"
+  checksum: 10c0/6ab0f1a63a8c93c655a161add6f4d413d897498411f013ba3179f56e350e17b2b3cf04fe4e7d2d69aa1dd8dac7aeaf07fb39192192aa7ae445c75451b78aa3c8
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/recipes@npm:^0.5.7":
+  version: 0.5.7
+  resolution: "@vanilla-extract/recipes@npm:0.5.7"
+  peerDependencies:
+    "@vanilla-extract/css": ^1.0.0
+  checksum: 10c0/18e7a7a12dedd16e43a1974c8ee273bee9080bd70042e91ce244e4be5679c4f626a257d37186bbd3562157d48fec26650a50f7a396439862da527e2223687ac8
+  languageName: node
+  linkType: hard
+
+"@vanilla-extract/vite-plugin@npm:^5.1.1":
+  version: 5.1.1
+  resolution: "@vanilla-extract/vite-plugin@npm:5.1.1"
+  dependencies:
+    "@vanilla-extract/compiler": "npm:^0.3.1"
+    "@vanilla-extract/integration": "npm:^8.0.4"
+  peerDependencies:
+    vite: ^5.0.0 || ^6.0.0 || ^7.0.0
+  checksum: 10c0/6cd9ae7505bda6f0789bf4538adef987a24ee41bcaa8356775bbf07aac3665d9d29a15ef1057add9895885e66cf661cfe0ba8340a9bcedba95ceccfcf9c16bf0
+  languageName: node
+  linkType: hard
+
 "@vitejs/plugin-react@npm:^4.3.1":
   version: 4.3.4
   resolution: "@vitejs/plugin-react@npm:4.3.4"
@@ -5838,86 +6406,182 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@vitest/expect@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/expect@npm:3.2.4"
+"@vitest/expect@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/expect@npm:4.0.3"
   dependencies:
+    "@standard-schema/spec": "npm:^1.0.0"
     "@types/chai": "npm:^5.2.2"
-    "@vitest/spy": "npm:3.2.4"
-    "@vitest/utils": "npm:3.2.4"
-    chai: "npm:^5.2.0"
-    tinyrainbow: "npm:^2.0.0"
-  checksum: 10c0/7586104e3fd31dbe1e6ecaafb9a70131e4197dce2940f727b6a84131eee3decac7b10f9c7c72fa5edbdb68b6f854353bd4c0fa84779e274207fb7379563b10db
+    "@vitest/spy": "npm:4.0.3"
+    "@vitest/utils": "npm:4.0.3"
+    chai: "npm:^6.0.1"
+    tinyrainbow: "npm:^3.0.3"
+  checksum: 10c0/36a9ff769387f4475fea273ec3ee39553ed7607bda620eea3a3632cd88a1e8c97173abcce7bc4440c84bf55b8e752edacb519a64f02d7ad5b47df7770cb56883
   languageName: node
   linkType: hard
 
-"@vitest/mocker@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/mocker@npm:3.2.4"
+"@vitest/mocker@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/mocker@npm:4.0.3"
   dependencies:
-    "@vitest/spy": "npm:3.2.4"
+    "@vitest/spy": "npm:4.0.3"
     estree-walker: "npm:^3.0.3"
-    magic-string: "npm:^0.30.17"
+    magic-string: "npm:^0.30.19"
   peerDependencies:
     msw: ^2.4.9
-    vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
+    vite: ^6.0.0 || ^7.0.0-0
   peerDependenciesMeta:
     msw:
       optional: true
     vite:
       optional: true
-  checksum: 10c0/f7a4aea19bbbf8f15905847ee9143b6298b2c110f8b64789224cb0ffdc2e96f9802876aa2ca83f1ec1b6e1ff45e822abb34f0054c24d57b29ab18add06536ccd
+  checksum: 10c0/16c9ef064a55b0fd3e0d7adaddfeef5c41d569d8181c40d8fed75464b43445305b83c017b50c5ea88f49355bef64e32f75cfd35db0682e0a8f5bbcc3acbde264
   languageName: node
   linkType: hard
 
-"@vitest/pretty-format@npm:3.2.4, @vitest/pretty-format@npm:^3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/pretty-format@npm:3.2.4"
+"@vitest/pretty-format@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/pretty-format@npm:4.0.3"
   dependencies:
-    tinyrainbow: "npm:^2.0.0"
-  checksum: 10c0/5ad7d4278e067390d7d633e307fee8103958806a419ca380aec0e33fae71b44a64415f7a9b4bc11635d3c13d4a9186111c581d3cef9c65cc317e68f077456887
+    tinyrainbow: "npm:^3.0.3"
+  checksum: 10c0/031080fbcb16b42c511ef7553a0cdabcb78d0bf9a2bb960a03403ff4553ce05d15e13af4abe7f22bd187f369d3bfa1c59714a0b4d9db33313d7583346511f236
   languageName: node
   linkType: hard
 
-"@vitest/runner@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/runner@npm:3.2.4"
+"@vitest/runner@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/runner@npm:4.0.3"
   dependencies:
-    "@vitest/utils": "npm:3.2.4"
+    "@vitest/utils": "npm:4.0.3"
     pathe: "npm:^2.0.3"
-    strip-literal: "npm:^3.0.0"
-  checksum: 10c0/e8be51666c72b3668ae3ea348b0196656a4a5adb836cb5e270720885d9517421815b0d6c98bfdf1795ed02b994b7bfb2b21566ee356a40021f5bf4f6ed4e418a
+  checksum: 10c0/77a4c76890d652115baded6004beb13f5f84e98d0a5175c38b3908f03875d6c02df998430e43b21bf324de9e1499069a54cf773854447607602cab5d9fe8cd60
   languageName: node
   linkType: hard
 
-"@vitest/snapshot@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/snapshot@npm:3.2.4"
+"@vitest/snapshot@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/snapshot@npm:4.0.3"
   dependencies:
-    "@vitest/pretty-format": "npm:3.2.4"
-    magic-string: "npm:^0.30.17"
+    "@vitest/pretty-format": "npm:4.0.3"
+    magic-string: "npm:^0.30.19"
     pathe: "npm:^2.0.3"
-  checksum: 10c0/f8301a3d7d1559fd3d59ed51176dd52e1ed5c2d23aa6d8d6aa18787ef46e295056bc726a021698d8454c16ed825ecba163362f42fa90258bb4a98cfd2c9424fc
+  checksum: 10c0/69e6a3ebdf3852cb949237989aa88c73ead9e6a1debd2227d130e0ec3c33a0bc07ab2d16538a247b8eea0c105f0c9f62419700bbc9230edc99d1df8083bf7b0a
   languageName: node
   linkType: hard
 
-"@vitest/spy@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/spy@npm:3.2.4"
-  dependencies:
-    tinyspy: "npm:^4.0.3"
-  checksum: 10c0/6ebf0b4697dc238476d6b6a60c76ba9eb1dd8167a307e30f08f64149612fd50227682b876420e4c2e09a76334e73f72e3ebf0e350714dc22474258292e202024
+"@vitest/spy@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/spy@npm:4.0.3"
+  checksum: 10c0/185fc2621c44c974fe2d89523cc8e20db46b4213fb7f153b63c4091c744b14e1e2c79f6160a3db0aab3e91775c6974214499c643032a02c2261cc68692b4cad8
   languageName: node
   linkType: hard
 
-"@vitest/utils@npm:3.2.4":
-  version: 3.2.4
-  resolution: "@vitest/utils@npm:3.2.4"
+"@vitest/utils@npm:4.0.3":
+  version: 4.0.3
+  resolution: "@vitest/utils@npm:4.0.3"
   dependencies:
-    "@vitest/pretty-format": "npm:3.2.4"
-    loupe: "npm:^3.1.4"
-    tinyrainbow: "npm:^2.0.0"
-  checksum: 10c0/024a9b8c8bcc12cf40183c246c244b52ecff861c6deb3477cbf487ac8781ad44c68a9c5fd69f8c1361878e55b97c10d99d511f2597f1f7244b5e5101d028ba64
+    "@vitest/pretty-format": "npm:4.0.3"
+    tinyrainbow: "npm:^3.0.3"
+  checksum: 10c0/b773bb0133307176762a932bab0480e77c9b378406eb92c82f37a16d214b1d873a0378e4c567c4b05bf4628073bc7fc18b519a7c0bdaf75e18311545ca00c5ba
+  languageName: node
+  linkType: hard
+
+"@vitest/web-worker@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "@vitest/web-worker@npm:4.0.2"
+  dependencies:
+    debug: "npm:^4.4.3"
+  peerDependencies:
+    vitest: 4.0.2
+  checksum: 10c0/d30b32b8c7e4df28fbe099125e62f3fc3d0e48a852b3749cbb47963e33070a4c04b3f55bfaf1f90109eacd6bc4d13b4b8028be984033edda532a8372a5abed86
+  languageName: node
+  linkType: hard
+
+"@volar/language-core@npm:2.4.23, @volar/language-core@npm:~2.4.11":
+  version: 2.4.23
+  resolution: "@volar/language-core@npm:2.4.23"
+  dependencies:
+    "@volar/source-map": "npm:2.4.23"
+  checksum: 10c0/1b8d60c7c0faa29ef5ec46dd2b673227592d0697753767e4df088f7c2d93843828116fe59472bb9d604ba653400be32a538e985730844b1af4f42a7075e62049
+  languageName: node
+  linkType: hard
+
+"@volar/source-map@npm:2.4.23":
+  version: 2.4.23
+  resolution: "@volar/source-map@npm:2.4.23"
+  checksum: 10c0/08af690093b811d0a37bdd8d306755b4e7f1535b67625c26f6fa6eb9ae081e24c55dabc8231ce8856aa1b731a5ac137b3f0449b34c093923c3545afdbe462c7a
+  languageName: node
+  linkType: hard
+
+"@volar/typescript@npm:^2.4.11":
+  version: 2.4.23
+  resolution: "@volar/typescript@npm:2.4.23"
+  dependencies:
+    "@volar/language-core": "npm:2.4.23"
+    path-browserify: "npm:^1.0.1"
+    vscode-uri: "npm:^3.0.8"
+  checksum: 10c0/dbb449b66e627a75f8f6df98b3210c32edff62747a12d1e6237a6dc2a75f26432833d4d3646d6fbd60ed21fa52d7e342437377973b80cf4bbeacee1980ffd0cb
+  languageName: node
+  linkType: hard
+
+"@vue/compiler-core@npm:3.5.24":
+  version: 3.5.24
+  resolution: "@vue/compiler-core@npm:3.5.24"
+  dependencies:
+    "@babel/parser": "npm:^7.28.5"
+    "@vue/shared": "npm:3.5.24"
+    entities: "npm:^4.5.0"
+    estree-walker: "npm:^2.0.2"
+    source-map-js: "npm:^1.2.1"
+  checksum: 10c0/d5b1421c0c0cfdff6b6ae2ef3d59b5901f0fec8ad2fa153f5ae1ec8487b898c92766353c661f68b892580ab0eacbc493632c946af8141045d6e76d67797b8a84
+  languageName: node
+  linkType: hard
+
+"@vue/compiler-dom@npm:^3.5.0":
+  version: 3.5.24
+  resolution: "@vue/compiler-dom@npm:3.5.24"
+  dependencies:
+    "@vue/compiler-core": "npm:3.5.24"
+    "@vue/shared": "npm:3.5.24"
+  checksum: 10c0/d49cb715f2e1cb2272ede2e41901282fb3f6fbdf489c8aa737e60c68e21216e07b72942695a80430fee8f11e5933e36fc90615b146b189cac925bf32f2727c95
+  languageName: node
+  linkType: hard
+
+"@vue/compiler-vue2@npm:^2.7.16":
+  version: 2.7.16
+  resolution: "@vue/compiler-vue2@npm:2.7.16"
+  dependencies:
+    de-indent: "npm:^1.0.2"
+    he: "npm:^1.2.0"
+  checksum: 10c0/c76c3fad770b9a7da40b314116cc9da173da20e5fd68785c8ed8dd8a87d02f239545fa296e16552e040ec86b47bfb18283b39447b250c2e76e479bd6ae475bb3
+  languageName: node
+  linkType: hard
+
+"@vue/language-core@npm:2.2.0":
+  version: 2.2.0
+  resolution: "@vue/language-core@npm:2.2.0"
+  dependencies:
+    "@volar/language-core": "npm:~2.4.11"
+    "@vue/compiler-dom": "npm:^3.5.0"
+    "@vue/compiler-vue2": "npm:^2.7.16"
+    "@vue/shared": "npm:^3.5.0"
+    alien-signals: "npm:^0.4.9"
+    minimatch: "npm:^9.0.3"
+    muggle-string: "npm:^0.4.1"
+    path-browserify: "npm:^1.0.1"
+  peerDependencies:
+    typescript: "*"
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: 10c0/1c44cc4067266bbc825af358a867aed455963a08c160cd9df9a47571fd917a87d9de9bdea6149877e0c8309a6cf39f263e7cf2fbadeceba47a5a158f392151b2
+  languageName: node
+  linkType: hard
+
+"@vue/shared@npm:3.5.24, @vue/shared@npm:^3.5.0":
+  version: 3.5.24
+  resolution: "@vue/shared@npm:3.5.24"
+  checksum: 10c0/4fd5665539fa5be3d12280c1921a8db3a707115fef54d22d83ce347ea06e3b1089dfe07292e0c46bbebf23553c7c1ec98010972ebccf10532db82422801288ff
   languageName: node
   linkType: hard
 
@@ -6026,6 +6690,32 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ajv-draft-04@npm:~1.0.0":
+  version: 1.0.0
+  resolution: "ajv-draft-04@npm:1.0.0"
+  peerDependencies:
+    ajv: ^8.5.0
+  peerDependenciesMeta:
+    ajv:
+      optional: true
+  checksum: 10c0/6044310bd38c17d77549fd326bd40ce1506fa10b0794540aa130180808bf94117fac8c9b448c621512bea60e4a947278f6a978e87f10d342950c15b33ddd9271
+  languageName: node
+  linkType: hard
+
+"ajv-formats@npm:~3.0.1":
+  version: 3.0.1
+  resolution: "ajv-formats@npm:3.0.1"
+  dependencies:
+    ajv: "npm:^8.0.0"
+  peerDependencies:
+    ajv: ^8.0.0
+  peerDependenciesMeta:
+    ajv:
+      optional: true
+  checksum: 10c0/168d6bca1ea9f163b41c8147bae537e67bd963357a5488a1eaf3abe8baa8eec806d4e45f15b10767e6020679315c7e1e5e6803088dfb84efa2b4e9353b83dd0a
+  languageName: node
+  linkType: hard
+
 "ajv-keywords@npm:^3.5.2":
   version: 3.5.2
   resolution: "ajv-keywords@npm:3.5.2"
@@ -6047,6 +6737,49 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ajv@npm:^8.0.0":
+  version: 8.17.1
+  resolution: "ajv@npm:8.17.1"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.3"
+    fast-uri: "npm:^3.0.1"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+  checksum: 10c0/ec3ba10a573c6b60f94639ffc53526275917a2df6810e4ab5a6b959d87459f9ef3f00d5e7865b82677cb7d21590355b34da14d1d0b9c32d75f95a187e76fff35
+  languageName: node
+  linkType: hard
+
+"ajv@npm:~8.12.0":
+  version: 8.12.0
+  resolution: "ajv@npm:8.12.0"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.1"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+    uri-js: "npm:^4.2.2"
+  checksum: 10c0/ac4f72adf727ee425e049bc9d8b31d4a57e1c90da8d28bcd23d60781b12fcd6fc3d68db5df16994c57b78b94eed7988f5a6b482fd376dc5b084125e20a0a622e
+  languageName: node
+  linkType: hard
+
+"ajv@npm:~8.13.0":
+  version: 8.13.0
+  resolution: "ajv@npm:8.13.0"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.3"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+    uri-js: "npm:^4.4.1"
+  checksum: 10c0/14c6497b6f72843986d7344175a1aa0e2c35b1e7f7475e55bc582cddb765fca7e6bf950f465dc7846f817776d9541b706f4b5b3fbedd8dfdeb5fce6f22864264
+  languageName: node
+  linkType: hard
+
+"alien-signals@npm:^0.4.9":
+  version: 0.4.14
+  resolution: "alien-signals@npm:0.4.14"
+  checksum: 10c0/5abb3377bcaf6b3819e950084b3ebd022ad90210105afb450c89dc347e80e28da441bf34858a57ea122abe7603e552ddbad80dc597c8f02a0a5206c5fb9c20cb
+  languageName: node
+  linkType: hard
+
 "all-package-names@npm:^2.0.2":
   version: 2.0.897
   resolution: "all-package-names@npm:2.0.897"
@@ -6215,7 +6948,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"argparse@npm:^1.0.7":
+"argparse@npm:^1.0.7, argparse@npm:~1.0.9":
   version: 1.0.10
   resolution: "argparse@npm:1.0.10"
   dependencies:
@@ -6421,13 +7154,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"assertion-error@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "assertion-error@npm:2.0.1"
-  checksum: 10c0/bbbcb117ac6480138f8c93cf7f535614282dea9dc828f540cdece85e3c665e8f78958b96afac52f29ff883c72638e6a87d469ecc9fe5bc902df03ed24a55dba8
-  languageName: node
-  linkType: hard
-
 "ast-types-flow@npm:^0.0.8":
   version: 0.0.8
   resolution: "ast-types-flow@npm:0.0.8"
@@ -6950,9 +7676,9 @@ __metadata:
   linkType: hard
 
 "caniuse-lite@npm:^1.0.30001688":
-  version: 1.0.30001712
-  resolution: "caniuse-lite@npm:1.0.30001712"
-  checksum: 10c0/b3df8bdcc3335969380c2e47acb36c89bfc7f8fb4ef7ee2a5380e30ba46aa69e9d411654bc29894a06c201a1d60d490ab9b92787f3b66d7a7a38d71360e68215
+  version: 1.0.30001751
+  resolution: "caniuse-lite@npm:1.0.30001751"
+  checksum: 10c0/c3f2d448f3569004ace160fd9379ea0def8e7a7bc6e65611baadb57d24e1f418258647a6210e46732419f5663e2356c22aa841f92449dd3849eb6471bb7ad592
   languageName: node
   linkType: hard
 
@@ -6968,16 +7694,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chai@npm:^5.2.0":
-  version: 5.2.1
-  resolution: "chai@npm:5.2.1"
-  dependencies:
-    assertion-error: "npm:^2.0.1"
-    check-error: "npm:^2.1.1"
-    deep-eql: "npm:^5.0.1"
-    loupe: "npm:^3.1.0"
-    pathval: "npm:^2.0.0"
-  checksum: 10c0/58209c03ae9b2fd97cfa1cb0fbe372b1906e6091311b9ba1b0468cc4923b0766a50a1050a164df3ccefb9464944c9216b632f1477c9e429068013bdbb57220f6
+"chai@npm:^6.0.1":
+  version: 6.2.0
+  resolution: "chai@npm:6.2.0"
+  checksum: 10c0/a4b7d7f5907187e09f1847afa838d6d1608adc7d822031b7900813c4ed5d9702911ac2468bf290676f22fddb3d727b1be90b57c1d0a69b902534ee29cdc6ff8a
   languageName: node
   linkType: hard
 
@@ -7048,13 +7768,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"check-error@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "check-error@npm:2.1.1"
-  checksum: 10c0/979f13eccab306cf1785fa10941a590b4e7ea9916ea2a4f8c87f0316fc3eab07eabefb6e587424ef0f88cbcd3805791f172ea739863ca3d7ce2afc54641c7f0e
-  languageName: node
-  linkType: hard
-
 "chownr@npm:^2.0.0":
   version: 2.0.0
   resolution: "chownr@npm:2.0.0"
@@ -7390,6 +8103,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"compare-versions@npm:^6.1.1":
+  version: 6.1.1
+  resolution: "compare-versions@npm:6.1.1"
+  checksum: 10c0/415205c7627f9e4f358f571266422980c9fe2d99086be0c9a48008ef7c771f32b0fbe8e97a441ffedc3910872f917a0675fe0fe3c3b6d331cda6d8690be06338
+  languageName: node
+  linkType: hard
+
 "concat-map@npm:0.0.1":
   version: 0.0.1
   resolution: "concat-map@npm:0.0.1"
@@ -7397,6 +8117,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"confbox@npm:^0.1.8":
+  version: 0.1.8
+  resolution: "confbox@npm:0.1.8"
+  checksum: 10c0/fc2c68d97cb54d885b10b63e45bd8da83a8a71459d3ecf1825143dd4c7f9f1b696b3283e07d9d12a144c1301c2ebc7842380bdf0014e55acc4ae1c9550102418
+  languageName: node
+  linkType: hard
+
+"confbox@npm:^0.2.2":
+  version: 0.2.2
+  resolution: "confbox@npm:0.2.2"
+  checksum: 10c0/7c246588d533d31e8cdf66cb4701dff6de60f9be77ab54c0d0338e7988750ac56863cc0aca1b3f2046f45ff223a765d3e5d4977a7674485afcd37b6edf3fd129
+  languageName: node
+  linkType: hard
+
 "config-chain@npm:^1.1.11":
   version: 1.1.13
   resolution: "config-chain@npm:1.1.13"
@@ -7617,6 +8351,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"css-what@npm:^6.1.0":
+  version: 6.2.2
+  resolution: "css-what@npm:6.2.2"
+  checksum: 10c0/91e24c26fb977b4ccef30d7007d2668c1c10ac0154cc3f42f7304410e9594fb772aea4f30c832d2993b132ca8d99338050866476210316345ec2e7d47b248a56
+  languageName: node
+  linkType: hard
+
 "css.escape@npm:^1.5.1":
   version: 1.5.1
   resolution: "css.escape@npm:1.5.1"
@@ -7650,7 +8391,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"csstype@npm:^3.0.2":
+"csstype@npm:^3.0.2, csstype@npm:^3.0.7":
   version: 3.1.3
   resolution: "csstype@npm:3.1.3"
   checksum: 10c0/80c089d6f7e0c5b2bd83cf0539ab41474198579584fa10d86d0cafe0642202343cbc119e076a0b1aece191989477081415d66c9fefbf3c957fc2fc4b7009f248
@@ -7728,6 +8469,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"de-indent@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "de-indent@npm:1.0.2"
+  checksum: 10c0/7058ce58abd6dfc123dd204e36be3797abd419b59482a634605420f47ae97639d0c183ec5d1b904f308a01033f473673897afc2bd59bc620ebf1658763ef4291
+  languageName: node
+  linkType: hard
+
 "debug@npm:4, debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4":
   version: 4.4.0
   resolution: "debug@npm:4.4.0"
@@ -7749,6 +8497,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"debug@npm:^4.4.0, debug@npm:^4.4.3":
+  version: 4.4.3
+  resolution: "debug@npm:4.4.3"
+  dependencies:
+    ms: "npm:^2.1.3"
+  peerDependenciesMeta:
+    supports-color:
+      optional: true
+  checksum: 10c0/d79136ec6c83ecbefd0f6a5593da6a9c91ec4d7ddc4b54c883d6e71ec9accb5f67a1a5e96d00a328196b5b5c86d365e98d8a3a70856aaf16b4e7b1985e67f5a6
+  languageName: node
+  linkType: hard
+
 "debug@npm:^4.4.1":
   version: 4.4.1
   resolution: "debug@npm:4.4.1"
@@ -7815,10 +8575,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"deep-eql@npm:^5.0.1":
-  version: 5.0.2
-  resolution: "deep-eql@npm:5.0.2"
-  checksum: 10c0/7102cf3b7bb719c6b9c0db2e19bf0aa9318d141581befe8c7ce8ccd39af9eaa4346e5e05adef7f9bd7015da0f13a3a25dcfe306ef79dc8668aedbecb658dd247
+"dedent@npm:^1.5.3":
+  version: 1.7.0
+  resolution: "dedent@npm:1.7.0"
+  peerDependencies:
+    babel-plugin-macros: ^3.1.0
+  peerDependenciesMeta:
+    babel-plugin-macros:
+      optional: true
+  checksum: 10c0/c5e8a8beb5072bd5e520cb64b27a82d7ec3c2a63ee5ce47dbc2a05d5b7700cefd77a992a752cd0a8b1d979c1db06b14fb9486e805f3ad6088eda6e07cd9bf2d5
   languageName: node
   linkType: hard
 
@@ -7862,6 +8627,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"deep-object-diff@npm:^1.1.9":
+  version: 1.1.9
+  resolution: "deep-object-diff@npm:1.1.9"
+  checksum: 10c0/12cfd1b000d16c9192fc649923c972f8aac2ddca4f71a292f8f2c1e2d5cf3c9c16c85e73ab3e7d8a89a5ec6918d6460677d0b05bd160f7bd50bb4816d496dc24
+  languageName: node
+  linkType: hard
+
+"deepmerge@npm:^4.2.2":
+  version: 4.3.1
+  resolution: "deepmerge@npm:4.3.1"
+  checksum: 10c0/e53481aaf1aa2c4082b5342be6b6d8ad9dfe387bc92ce197a66dea08bd4265904a087e75e464f14d1347cf2ac8afe1e4c16b266e0561cc5df29382d3c5f80044
+  languageName: node
+  linkType: hard
+
 "default-browser-id@npm:^3.0.0":
   version: 3.0.0
   resolution: "default-browser-id@npm:3.0.0"
@@ -8050,6 +8829,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"diff@npm:~8.0.2":
+  version: 8.0.2
+  resolution: "diff@npm:8.0.2"
+  checksum: 10c0/abfb387f033e089df3ec3be960205d17b54df8abf0924d982a7ced3a94c557a4e6cbff2e78b121f216b85f466b3d8d041673a386177c311aaea41459286cc9bc
+  languageName: node
+  linkType: hard
+
 "dir-glob@npm:^3.0.0, dir-glob@npm:^3.0.1":
   version: 3.0.1
   resolution: "dir-glob@npm:3.0.1"
@@ -8729,6 +9515,95 @@ __metadata:
   languageName: node
   linkType: hard
 
+"esbuild@npm:esbuild@>=0.17.6 <0.26.0":
+  version: 0.25.12
+  resolution: "esbuild@npm:0.25.12"
+  dependencies:
+    "@esbuild/aix-ppc64": "npm:0.25.12"
+    "@esbuild/android-arm": "npm:0.25.12"
+    "@esbuild/android-arm64": "npm:0.25.12"
+    "@esbuild/android-x64": "npm:0.25.12"
+    "@esbuild/darwin-arm64": "npm:0.25.12"
+    "@esbuild/darwin-x64": "npm:0.25.12"
+    "@esbuild/freebsd-arm64": "npm:0.25.12"
+    "@esbuild/freebsd-x64": "npm:0.25.12"
+    "@esbuild/linux-arm": "npm:0.25.12"
+    "@esbuild/linux-arm64": "npm:0.25.12"
+    "@esbuild/linux-ia32": "npm:0.25.12"
+    "@esbuild/linux-loong64": "npm:0.25.12"
+    "@esbuild/linux-mips64el": "npm:0.25.12"
+    "@esbuild/linux-ppc64": "npm:0.25.12"
+    "@esbuild/linux-riscv64": "npm:0.25.12"
+    "@esbuild/linux-s390x": "npm:0.25.12"
+    "@esbuild/linux-x64": "npm:0.25.12"
+    "@esbuild/netbsd-arm64": "npm:0.25.12"
+    "@esbuild/netbsd-x64": "npm:0.25.12"
+    "@esbuild/openbsd-arm64": "npm:0.25.12"
+    "@esbuild/openbsd-x64": "npm:0.25.12"
+    "@esbuild/openharmony-arm64": "npm:0.25.12"
+    "@esbuild/sunos-x64": "npm:0.25.12"
+    "@esbuild/win32-arm64": "npm:0.25.12"
+    "@esbuild/win32-ia32": "npm:0.25.12"
+    "@esbuild/win32-x64": "npm:0.25.12"
+  dependenciesMeta:
+    "@esbuild/aix-ppc64":
+      optional: true
+    "@esbuild/android-arm":
+      optional: true
+    "@esbuild/android-arm64":
+      optional: true
+    "@esbuild/android-x64":
+      optional: true
+    "@esbuild/darwin-arm64":
+      optional: true
+    "@esbuild/darwin-x64":
+      optional: true
+    "@esbuild/freebsd-arm64":
+      optional: true
+    "@esbuild/freebsd-x64":
+      optional: true
+    "@esbuild/linux-arm":
+      optional: true
+    "@esbuild/linux-arm64":
+      optional: true
+    "@esbuild/linux-ia32":
+      optional: true
+    "@esbuild/linux-loong64":
+      optional: true
+    "@esbuild/linux-mips64el":
+      optional: true
+    "@esbuild/linux-ppc64":
+      optional: true
+    "@esbuild/linux-riscv64":
+      optional: true
+    "@esbuild/linux-s390x":
+      optional: true
+    "@esbuild/linux-x64":
+      optional: true
+    "@esbuild/netbsd-arm64":
+      optional: true
+    "@esbuild/netbsd-x64":
+      optional: true
+    "@esbuild/openbsd-arm64":
+      optional: true
+    "@esbuild/openbsd-x64":
+      optional: true
+    "@esbuild/openharmony-arm64":
+      optional: true
+    "@esbuild/sunos-x64":
+      optional: true
+    "@esbuild/win32-arm64":
+      optional: true
+    "@esbuild/win32-ia32":
+      optional: true
+    "@esbuild/win32-x64":
+      optional: true
+  bin:
+    esbuild: bin/esbuild
+  checksum: 10c0/c205357531423220a9de8e1e6c6514242bc9b1666e762cd67ccdf8fdfdc3f1d0bd76f8d9383958b97ad4c953efdb7b6e8c1f9ca5951cd2b7c5235e8755b34a6b
+  languageName: node
+  linkType: hard
+
 "escalade@npm:^3.1.1, escalade@npm:^3.2.0":
   version: 3.2.0
   resolution: "escalade@npm:3.2.0"
@@ -9073,14 +9948,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"estree-walker@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "estree-walker@npm:1.0.1"
-  checksum: 10c0/fa9e5f8c1bbe8d01e314c0f03067b64a4f22d4c58410fc5237060d0c15b81e58c23921c41acc60abbdab490f1fdfcbd6408ede2d03ca704454272e0244d61a55
-  languageName: node
-  linkType: hard
-
-"estree-walker@npm:^2.0.1, estree-walker@npm:^2.0.2":
+"estree-walker@npm:^2.0.2":
   version: 2.0.2
   resolution: "estree-walker@npm:2.0.2"
   checksum: 10c0/53a6c54e2019b8c914dc395890153ffdc2322781acf4bd7d1a32d7aedc1710807bdcd866ac133903d5629ec601fbb50abe8c2e5553c7f5a0afdd9b6af6c945af
@@ -9103,6 +9971,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"eval@npm:0.1.8":
+  version: 0.1.8
+  resolution: "eval@npm:0.1.8"
+  dependencies:
+    "@types/node": "npm:*"
+    require-like: "npm:>= 0.1.1"
+  checksum: 10c0/258e700bff09e3ce3344273d5b6691b8ec5b043538d84f738f14d8b0aded33d64c00c15b380de725b1401b15f428ab35a9e7ca19a7d25f162c4f877c71586be9
+  languageName: node
+  linkType: hard
+
 "execa@npm:^1.0.0":
   version: 1.0.0
   resolution: "execa@npm:1.0.0"
@@ -9193,7 +10071,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"expect-type@npm:^1.2.1":
+"expect-type@npm:^1.2.2":
   version: 1.2.2
   resolution: "expect-type@npm:1.2.2"
   checksum: 10c0/6019019566063bbc7a690d9281d920b1a91284a4a093c2d55d71ffade5ac890cf37a51e1da4602546c4b56569d2ad2fc175a2ccee77d1ae06cb3af91ef84f44b
@@ -9220,6 +10098,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"exsolve@npm:^1.0.7":
+  version: 1.0.8
+  resolution: "exsolve@npm:1.0.8"
+  checksum: 10c0/65e44ae05bd4a4a5d87cfdbbd6b8f24389282cf9f85fa5feb17ca87ad3f354877e6af4cd99e02fc29044174891f82d1d68c77f69234410eb8f163530e6278c67
+  languageName: node
+  linkType: hard
+
 "external-editor@npm:^3.0.3, external-editor@npm:^3.1.0":
   version: 3.1.0
   resolution: "external-editor@npm:3.1.0"
@@ -9265,6 +10150,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-uri@npm:^3.0.1":
+  version: 3.1.0
+  resolution: "fast-uri@npm:3.1.0"
+  checksum: 10c0/44364adca566f70f40d1e9b772c923138d47efeac2ae9732a872baafd77061f26b097ba2f68f0892885ad177becd065520412b8ffeec34b16c99433c5b9e2de7
+  languageName: node
+  linkType: hard
+
 "fastest-levenshtein@npm:^1.0.12":
   version: 1.0.16
   resolution: "fastest-levenshtein@npm:1.0.16"
@@ -9293,7 +10185,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fdir@npm:^6.4.4, fdir@npm:^6.4.6":
+"fdir@npm:^6.4.4":
   version: 6.4.6
   resolution: "fdir@npm:6.4.6"
   peerDependencies:
@@ -9305,6 +10197,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fdir@npm:^6.5.0":
+  version: 6.5.0
+  resolution: "fdir@npm:6.5.0"
+  peerDependencies:
+    picomatch: ^3 || ^4
+  peerDependenciesMeta:
+    picomatch:
+      optional: true
+  checksum: 10c0/e345083c4306b3aed6cb8ec551e26c36bab5c511e99ea4576a16750ddc8d3240e63826cc624f5ae17ad4dc82e68a253213b60d556c11bfad064b7607847ed07f
+  languageName: node
+  linkType: hard
+
 "figures@npm:^1.7.0":
   version: 1.7.0
   resolution: "figures@npm:1.7.0"
@@ -9358,7 +10262,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"find-cache-dir@npm:^3.3.1, find-cache-dir@npm:^3.3.2":
+"find-cache-dir@npm:^3.3.1":
   version: 3.3.2
   resolution: "find-cache-dir@npm:3.3.2"
   dependencies:
@@ -9520,17 +10424,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^10.0.0":
-  version: 10.1.0
-  resolution: "fs-extra@npm:10.1.0"
-  dependencies:
-    graceful-fs: "npm:^4.2.0"
-    jsonfile: "npm:^6.0.1"
-    universalify: "npm:^2.0.0"
-  checksum: 10c0/5f579466e7109719d162a9249abbeffe7f426eb133ea486e020b89bc6d67a741134076bf439983f2eb79276ceaf6bd7b7c1e43c3fd67fe889863e69072fb0a5e
-  languageName: node
-  linkType: hard
-
 "fs-extra@npm:^11.0.0":
   version: 11.3.0
   resolution: "fs-extra@npm:11.3.0"
@@ -9554,6 +10447,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fs-extra@npm:~11.3.0":
+  version: 11.3.2
+  resolution: "fs-extra@npm:11.3.2"
+  dependencies:
+    graceful-fs: "npm:^4.2.0"
+    jsonfile: "npm:^6.0.1"
+    universalify: "npm:^2.0.0"
+  checksum: 10c0/f5d629e1bb646d5dedb4d8b24c5aad3deb8cc1d5438979d6f237146cd10e113b49a949ae1b54212c2fbc98e2d0995f38009a9a1d0520f0287943335e65fe919b
+  languageName: node
+  linkType: hard
+
 "fs-minipass@npm:^2.0.0, fs-minipass@npm:^2.1.0":
   version: 2.1.0
   resolution: "fs-minipass@npm:2.1.0"
@@ -10107,6 +11011,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"he@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "he@npm:1.2.0"
+  bin:
+    he: bin/he
+  checksum: 10c0/a27d478befe3c8192f006cdd0639a66798979dfa6e2125c6ac582a19a5ebfec62ad83e8382e6036170d873f46e4536a7e795bf8b95bf7c247f4cc0825ccc8c17
+  languageName: node
+  linkType: hard
+
 "headers-polyfill@npm:^4.0.2":
   version: 4.0.3
   resolution: "headers-polyfill@npm:4.0.3"
@@ -10384,7 +11297,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"import-lazy@npm:^4.0.0":
+"import-lazy@npm:^4.0.0, import-lazy@npm:~4.0.0":
   version: 4.0.0
   resolution: "import-lazy@npm:4.0.0"
   checksum: 10c0/a3520313e2c31f25c0b06aa66d167f329832b68a4f957d7c9daf6e0fa41822b6e84948191648b9b9d8ca82f94740cdf15eecf2401a5b42cd1c33fd84f2225cca
@@ -11301,6 +12214,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"javascript-stringify@npm:^2.0.1":
+  version: 2.1.0
+  resolution: "javascript-stringify@npm:2.1.0"
+  checksum: 10c0/374e74ebff29b94de78da39daa6e530999c58a145aeb293dc21180c4584459b14d9e5721d9bc6ed4eba319c437ef0145c157c946b70ecddcff6668682a002bcc
+  languageName: node
+  linkType: hard
+
 "jest-canvas-mock@npm:~2.5.2":
   version: 2.5.2
   resolution: "jest-canvas-mock@npm:2.5.2"
@@ -11419,6 +12339,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"jju@npm:~1.4.0":
+  version: 1.4.0
+  resolution: "jju@npm:1.4.0"
+  checksum: 10c0/f3f444557e4364cfc06b1abf8331bf3778b26c0c8552ca54429bc0092652172fdea26cbffe33e1017b303d5aa506f7ede8571857400efe459cb7439180e2acad
+  languageName: node
+  linkType: hard
+
 "js-tokens@npm:^3.0.0 || ^4.0.0, js-tokens@npm:^4.0.0":
   version: 4.0.0
   resolution: "js-tokens@npm:4.0.0"
@@ -11550,6 +12477,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-schema-traverse@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "json-schema-traverse@npm:1.0.0"
+  checksum: 10c0/71e30015d7f3d6dc1c316d6298047c8ef98a06d31ad064919976583eb61e1018a60a0067338f0f79cabc00d84af3fcc489bd48ce8a46ea165d9541ba17fb30c6
+  languageName: node
+  linkType: hard
+
 "json-stable-stringify-without-jsonify@npm:^1.0.1":
   version: 1.0.1
   resolution: "json-stable-stringify-without-jsonify@npm:1.0.1"
@@ -11682,6 +12616,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"kolorist@npm:^1.8.0":
+  version: 1.8.0
+  resolution: "kolorist@npm:1.8.0"
+  checksum: 10c0/73075db44a692bf6c34a649f3b4b3aea4993b84f6b754cbf7a8577e7c7db44c0bad87752bd23b0ce533f49de2244ce2ce03b7b1b667a85ae170a94782cc50f9b
+  languageName: node
+  linkType: hard
+
 "language-subtag-registry@npm:^0.3.20":
   version: 0.3.23
   resolution: "language-subtag-registry@npm:0.3.23"
@@ -12023,6 +12964,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"local-pkg@npm:^1.0.0":
+  version: 1.1.2
+  resolution: "local-pkg@npm:1.1.2"
+  dependencies:
+    mlly: "npm:^1.7.4"
+    pkg-types: "npm:^2.3.0"
+    quansync: "npm:^0.2.11"
+  checksum: 10c0/1bcfcc5528dea95cba3caa478126a348d3985aad9f69ecf7802c13efef90897e1c5ff7851974332c5e6d4a4698efe610fef758a068c8bc3feb5322aeb35d5993
+  languageName: node
+  linkType: hard
+
 "locate-path@npm:^2.0.0":
   version: 2.0.0
   resolution: "locate-path@npm:2.0.0"
@@ -12130,7 +13082,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.17.12, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.17.21, lodash@npm:^4.17.4":
+"lodash@npm:^4.17.12, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.17.21, lodash@npm:^4.17.4, lodash@npm:~4.17.15":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
   checksum: 10c0/d8cbea072bb08655bb4c989da418994b073a608dffa608b09ac04b43a791b12aeae7cd7ad919aa4c925f33b48490b5cfe6c1f71d827956071dae2e7bb3a6b74c
@@ -12209,13 +13161,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"loupe@npm:^3.1.0, loupe@npm:^3.1.4":
-  version: 3.2.0
-  resolution: "loupe@npm:3.2.0"
-  checksum: 10c0/f572fd9e38db8d36ae9eede305480686e310d69bc40394b6842838ebc6c3860a0e35ab30182f33606ab2d8a685d9ff6436649269f8218a1c3385ca329973cb2c
-  languageName: node
-  linkType: hard
-
 "lowercase-keys@npm:^2.0.0":
   version: 2.0.0
   resolution: "lowercase-keys@npm:2.0.0"
@@ -12289,6 +13234,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"magic-string@npm:^0.30.19":
+  version: 0.30.21
+  resolution: "magic-string@npm:0.30.21"
+  dependencies:
+    "@jridgewell/sourcemap-codec": "npm:^1.5.5"
+  checksum: 10c0/299378e38f9a270069fc62358522ddfb44e94244baa0d6a8980ab2a9b2490a1d03b236b447eee309e17eb3bddfa482c61259d47960eb018a904f0ded52780c4a
+  languageName: node
+  linkType: hard
+
 "magicast@npm:^0.3.5":
   version: 0.3.5
   resolution: "magicast@npm:0.3.5"
@@ -12414,6 +13368,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"media-query-parser@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "media-query-parser@npm:2.0.2"
+  dependencies:
+    "@babel/runtime": "npm:^7.12.5"
+  checksum: 10c0/91a987e9f6620f5c7d0fcf22bd0a106bbaccdef96aba62c461656ee656e141dd2b60f2f1d99411799183c2ea993bd177ca92c26c08bf321fbc0c846ab391d79c
+  languageName: node
+  linkType: hard
+
 "memoizerific@npm:^1.11.3":
   version: 1.11.3
   resolution: "memoizerific@npm:1.11.3"
@@ -12547,6 +13510,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minimatch@npm:10.0.3":
+  version: 10.0.3
+  resolution: "minimatch@npm:10.0.3"
+  dependencies:
+    "@isaacs/brace-expansion": "npm:^5.0.0"
+  checksum: 10c0/e43e4a905c5d70ac4cec8530ceaeccb9c544b1ba8ac45238e2a78121a01c17ff0c373346472d221872563204eabe929ad02669bb575cb1f0cc30facab369f70f
+  languageName: node
+  linkType: hard
+
 "minimatch@npm:^3.1.1, minimatch@npm:^3.1.2":
   version: 3.1.2
   resolution: "minimatch@npm:3.1.2"
@@ -12565,7 +13537,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:^9.0.0, minimatch@npm:^9.0.4":
+"minimatch@npm:^9.0.0, minimatch@npm:^9.0.3, minimatch@npm:^9.0.4":
   version: 9.0.5
   resolution: "minimatch@npm:9.0.5"
   dependencies:
@@ -12748,6 +13720,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mlly@npm:^1.4.2, mlly@npm:^1.7.4":
+  version: 1.8.0
+  resolution: "mlly@npm:1.8.0"
+  dependencies:
+    acorn: "npm:^8.15.0"
+    pathe: "npm:^2.0.3"
+    pkg-types: "npm:^1.3.1"
+    ufo: "npm:^1.6.1"
+  checksum: 10c0/f174b844ae066c71e9b128046677868e2e28694f0bbeeffbe760b2a9d8ff24de0748d0fde6fabe706700c1d2e11d3c0d7a53071b5ea99671592fac03364604ab
+  languageName: node
+  linkType: hard
+
+"modern-ahocorasick@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "modern-ahocorasick@npm:1.1.0"
+  checksum: 10c0/63fda0dab6f39886970550f5e37c4ea41cfe0c69573a7371ebc3b2db5993ed5cf4aef3e2e454e6d730992cbd4482ed9d641509c038f2ca661ccb939d822cb3ad
+  languageName: node
+  linkType: hard
+
 "modify-values@npm:^1.0.0":
   version: 1.0.1
   resolution: "modify-values@npm:1.0.1"
@@ -12820,6 +13811,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"muggle-string@npm:^0.4.1":
+  version: 0.4.1
+  resolution: "muggle-string@npm:0.4.1"
+  checksum: 10c0/e914b63e24cd23f97e18376ec47e4ba3aa24365e4776212b666add2e47bb158003212980d732c49abf3719568900af7861873844a6e2d3a7ca7e86952c0e99e9
+  languageName: node
+  linkType: hard
+
 "mute-stream@npm:0.0.7":
   version: 0.0.7
   resolution: "mute-stream@npm:0.0.7"
@@ -14012,6 +15010,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"path-browserify@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "path-browserify@npm:1.0.1"
+  checksum: 10c0/8b8c3fd5c66bd340272180590ae4ff139769e9ab79522e2eb82e3d571a89b8117c04147f65ad066dccfb42fcad902e5b7d794b3d35e0fd840491a8ddbedf8c66
+  languageName: node
+  linkType: hard
+
 "path-exists@npm:^3.0.0":
   version: 3.0.0
   resolution: "path-exists@npm:3.0.0"
@@ -14092,20 +15097,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pathe@npm:^2.0.3":
+"pathe@npm:^2.0.1, pathe@npm:^2.0.3":
   version: 2.0.3
   resolution: "pathe@npm:2.0.3"
   checksum: 10c0/c118dc5a8b5c4166011b2b70608762e260085180bb9e33e80a50dcdb1e78c010b1624f4280c492c92b05fc276715a4c357d1f9edc570f8f1b3d90b6839ebaca1
   languageName: node
   linkType: hard
 
-"pathval@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "pathval@npm:2.0.1"
-  checksum: 10c0/460f4709479fbf2c45903a65655fc8f0a5f6d808f989173aeef5fdea4ff4f303dc13f7870303999add60ec49d4c14733895c0a869392e9866f1091fa64fd7581
-  languageName: node
-  linkType: hard
-
 "picocolors@npm:1.1.1, picocolors@npm:^1.0.0, picocolors@npm:^1.1.1":
   version: 1.1.1
   resolution: "picocolors@npm:1.1.1"
@@ -14113,7 +15111,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"picomatch@npm:^2.2.2, picomatch@npm:^2.2.3, picomatch@npm:^2.3.1":
+"picomatch@npm:^2.2.3, picomatch@npm:^2.3.1":
   version: 2.3.1
   resolution: "picomatch@npm:2.3.1"
   checksum: 10c0/26c02b8d06f03206fc2ab8d16f19960f2ff9e81a658f831ecb656d8f17d9edc799e8364b1f4a7873e89d9702dff96204be0fa26fe4181f6843f040f819dac4be
@@ -14178,6 +15176,28 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pkg-types@npm:^1.3.1":
+  version: 1.3.1
+  resolution: "pkg-types@npm:1.3.1"
+  dependencies:
+    confbox: "npm:^0.1.8"
+    mlly: "npm:^1.7.4"
+    pathe: "npm:^2.0.1"
+  checksum: 10c0/19e6cb8b66dcc66c89f2344aecfa47f2431c988cfa3366bdfdcfb1dd6695f87dcce37fbd90fe9d1605e2f4440b77f391e83c23255347c35cf84e7fd774d7fcea
+  languageName: node
+  linkType: hard
+
+"pkg-types@npm:^2.3.0":
+  version: 2.3.0
+  resolution: "pkg-types@npm:2.3.0"
+  dependencies:
+    confbox: "npm:^0.2.2"
+    exsolve: "npm:^1.0.7"
+    pathe: "npm:^2.0.3"
+  checksum: 10c0/d2bbddc5b81bd4741e1529c08ef4c5f1542bbdcf63498b73b8e1d84cff71806d1b8b1577800549bb569cb7aa20056257677b979bff48c97967cba7e64f72ae12
+  languageName: node
+  linkType: hard
+
 "please-upgrade-node@npm:^3.1.1, please-upgrade-node@npm:^3.2.0":
   version: 3.2.0
   resolution: "please-upgrade-node@npm:3.2.0"
@@ -14242,7 +15262,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prettier@npm:^3.3.3, prettier@npm:^3.5.3":
+"prettier@npm:^3.5.3":
   version: 3.5.3
   resolution: "prettier@npm:3.5.3"
   bin:
@@ -14251,6 +15271,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"prettier@npm:^3.6.2":
+  version: 3.6.2
+  resolution: "prettier@npm:3.6.2"
+  bin:
+    prettier: bin/prettier.cjs
+  checksum: 10c0/488cb2f2b99ec13da1e50074912870217c11edaddedeadc649b1244c749d15ba94e846423d062e2c4c9ae683e2d65f754de28889ba06e697ac4f988d44f45812
+  languageName: node
+  linkType: hard
+
 "pretty-format@npm:^27.0.0, pretty-format@npm:^27.0.2, pretty-format@npm:^27.5.1":
   version: 27.5.1
   resolution: "pretty-format@npm:27.5.1"
@@ -14417,6 +15446,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"quansync@npm:^0.2.11":
+  version: 0.2.11
+  resolution: "quansync@npm:0.2.11"
+  checksum: 10c0/cb9a1f8ebce074069f2f6a78578873ffedd9de9f6aa212039b44c0870955c04a71c3b1311b5d97f8ac2f2ec476de202d0a5c01160cb12bc0a11b7ef36d22ef56
+  languageName: node
+  linkType: hard
+
 "query-string@npm:^6.9.0":
   version: 6.14.1
   resolution: "query-string@npm:6.14.1"
@@ -15037,6 +16073,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"require-from-string@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "require-from-string@npm:2.0.2"
+  checksum: 10c0/aaa267e0c5b022fc5fd4eef49d8285086b15f2a1c54b28240fdf03599cbd9c26049fee3eab894f2e1f6ca65e513b030a7c264201e3f005601e80c49fb2937ce2
+  languageName: node
+  linkType: hard
+
+"require-like@npm:>= 0.1.1":
+  version: 0.1.2
+  resolution: "require-like@npm:0.1.2"
+  checksum: 10c0/9035ff6c4000a56ede6fc51dd5c56541fafa5a7dddc9b1c3a5f9148d95ee21c603c9bf5c6e37b19fc7de13d9294260842d8590b2ffd6c7c773e78603d1af8050
+  languageName: node
+  linkType: hard
+
 "requires-port@npm:^1.0.0":
   version: 1.0.0
   resolution: "requires-port@npm:1.0.0"
@@ -15114,6 +16164,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"resolve@npm:~1.22.1, resolve@npm:~1.22.2":
+  version: 1.22.11
+  resolution: "resolve@npm:1.22.11"
+  dependencies:
+    is-core-module: "npm:^2.16.1"
+    path-parse: "npm:^1.0.7"
+    supports-preserve-symlinks-flag: "npm:^1.0.0"
+  bin:
+    resolve: bin/resolve
+  checksum: 10c0/f657191507530f2cbecb5815b1ee99b20741ea6ee02a59c57028e9ec4c2c8d7681afcc35febbd554ac0ded459db6f2d8153382c53a2f266cee2575e512674409
+  languageName: node
+  linkType: hard
+
 "resolve@patch:resolve@npm%3A^1.10.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.14.2#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.1#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.4#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.8#optional!builtin<compat/resolve>":
   version: 1.22.10
   resolution: "resolve@patch:resolve@npm%3A1.22.10#optional!builtin<compat/resolve>::version=1.22.10&hash=c3c19d"
@@ -15140,6 +16203,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"resolve@patch:resolve@npm%3A~1.22.1#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A~1.22.2#optional!builtin<compat/resolve>":
+  version: 1.22.11
+  resolution: "resolve@patch:resolve@npm%3A1.22.11#optional!builtin<compat/resolve>::version=1.22.11&hash=c3c19d"
+  dependencies:
+    is-core-module: "npm:^2.16.1"
+    path-parse: "npm:^1.0.7"
+    supports-preserve-symlinks-flag: "npm:^1.0.0"
+  bin:
+    resolve: bin/resolve
+  checksum: 10c0/ee5b182f2e37cb1165465e58c6abc797fec0a80b5ba3231607beb4677db0c9291ac010c47cf092b6daa2b7f518d69a0e21888e7e2b633f68d501a874212a8c63
+  languageName: node
+  linkType: hard
+
 "responselike@npm:^2.0.0":
   version: 2.0.1
   resolution: "responselike@npm:2.0.1"
@@ -15221,36 +16297,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rollup-plugin-typescript2@npm:^0.36.0":
-  version: 0.36.0
-  resolution: "rollup-plugin-typescript2@npm:0.36.0"
-  dependencies:
-    "@rollup/pluginutils": "npm:^4.1.2"
-    find-cache-dir: "npm:^3.3.2"
-    fs-extra: "npm:^10.0.0"
-    semver: "npm:^7.5.4"
-    tslib: "npm:^2.6.2"
-  peerDependencies:
-    rollup: ">=1.26.3"
-    typescript: ">=2.4.0"
-  checksum: 10c0/3c8d17cd852ded36eaad2759caf170f90e091d8f86ff7b016d1823bc8b507b8f689156bcccda348fc88471681dc79cc9eb13ddb09a4dfcf0d07ac9a249e2d79b
-  languageName: node
-  linkType: hard
-
-"rollup@npm:^2.70.1":
-  version: 2.79.2
-  resolution: "rollup@npm:2.79.2"
-  dependencies:
-    fsevents: "npm:~2.3.2"
-  dependenciesMeta:
-    fsevents:
-      optional: true
-  bin:
-    rollup: dist/bin/rollup
-  checksum: 10c0/bc3746c988d903c2211266ddc539379d53d92689b9cc5c2b4e3ae161689de9af491957a567c629b6cc81f48d0928a7591fc4c383fba68a48d2966c9fb8a2bce9
-  languageName: node
-  linkType: hard
-
 "rollup@npm:^4.20.0":
   version: 4.39.0
   resolution: "rollup@npm:4.39.0"
@@ -15326,30 +16372,32 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rollup@npm:^4.40.0":
-  version: 4.46.1
-  resolution: "rollup@npm:4.46.1"
+"rollup@npm:^4.43.0":
+  version: 4.52.5
+  resolution: "rollup@npm:4.52.5"
   dependencies:
-    "@rollup/rollup-android-arm-eabi": "npm:4.46.1"
-    "@rollup/rollup-android-arm64": "npm:4.46.1"
-    "@rollup/rollup-darwin-arm64": "npm:4.46.1"
-    "@rollup/rollup-darwin-x64": "npm:4.46.1"
-    "@rollup/rollup-freebsd-arm64": "npm:4.46.1"
-    "@rollup/rollup-freebsd-x64": "npm:4.46.1"
-    "@rollup/rollup-linux-arm-gnueabihf": "npm:4.46.1"
-    "@rollup/rollup-linux-arm-musleabihf": "npm:4.46.1"
-    "@rollup/rollup-linux-arm64-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-arm64-musl": "npm:4.46.1"
-    "@rollup/rollup-linux-loongarch64-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-ppc64-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-riscv64-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-riscv64-musl": "npm:4.46.1"
-    "@rollup/rollup-linux-s390x-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-x64-gnu": "npm:4.46.1"
-    "@rollup/rollup-linux-x64-musl": "npm:4.46.1"
-    "@rollup/rollup-win32-arm64-msvc": "npm:4.46.1"
-    "@rollup/rollup-win32-ia32-msvc": "npm:4.46.1"
-    "@rollup/rollup-win32-x64-msvc": "npm:4.46.1"
+    "@rollup/rollup-android-arm-eabi": "npm:4.52.5"
+    "@rollup/rollup-android-arm64": "npm:4.52.5"
+    "@rollup/rollup-darwin-arm64": "npm:4.52.5"
+    "@rollup/rollup-darwin-x64": "npm:4.52.5"
+    "@rollup/rollup-freebsd-arm64": "npm:4.52.5"
+    "@rollup/rollup-freebsd-x64": "npm:4.52.5"
+    "@rollup/rollup-linux-arm-gnueabihf": "npm:4.52.5"
+    "@rollup/rollup-linux-arm-musleabihf": "npm:4.52.5"
+    "@rollup/rollup-linux-arm64-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-arm64-musl": "npm:4.52.5"
+    "@rollup/rollup-linux-loong64-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-ppc64-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-riscv64-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-riscv64-musl": "npm:4.52.5"
+    "@rollup/rollup-linux-s390x-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-x64-gnu": "npm:4.52.5"
+    "@rollup/rollup-linux-x64-musl": "npm:4.52.5"
+    "@rollup/rollup-openharmony-arm64": "npm:4.52.5"
+    "@rollup/rollup-win32-arm64-msvc": "npm:4.52.5"
+    "@rollup/rollup-win32-ia32-msvc": "npm:4.52.5"
+    "@rollup/rollup-win32-x64-gnu": "npm:4.52.5"
+    "@rollup/rollup-win32-x64-msvc": "npm:4.52.5"
     "@types/estree": "npm:1.0.8"
     fsevents: "npm:~2.3.2"
   dependenciesMeta:
@@ -15373,7 +16421,7 @@ __metadata:
       optional: true
     "@rollup/rollup-linux-arm64-musl":
       optional: true
-    "@rollup/rollup-linux-loongarch64-gnu":
+    "@rollup/rollup-linux-loong64-gnu":
       optional: true
     "@rollup/rollup-linux-ppc64-gnu":
       optional: true
@@ -15387,17 +16435,21 @@ __metadata:
       optional: true
     "@rollup/rollup-linux-x64-musl":
       optional: true
+    "@rollup/rollup-openharmony-arm64":
+      optional: true
     "@rollup/rollup-win32-arm64-msvc":
       optional: true
     "@rollup/rollup-win32-ia32-msvc":
       optional: true
+    "@rollup/rollup-win32-x64-gnu":
+      optional: true
     "@rollup/rollup-win32-x64-msvc":
       optional: true
     fsevents:
       optional: true
   bin:
     rollup: dist/bin/rollup
-  checksum: 10c0/84297d63a97bf8fc131039d0f600787ada8baaa38b744820f7d29da601bce9f70a14aa12da80843b2b49eb8660718576f441ee9952954efa16009d7ccebf0000
+  checksum: 10c0/faf1697b305d13a149bb64a2bb7378344becc7c8580f56225c4c00adbf493d82480a44b3e3b1cc82a3ac5d1d4cab6dfc89e6635443895a2dc488969075f5b94d
   languageName: node
   linkType: hard
 
@@ -15660,7 +16712,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:^7.0.0, semver@npm:^7.1.1, semver@npm:^7.1.2, semver@npm:^7.3.2, semver@npm:^7.3.4, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.5.1, semver@npm:^7.5.3, semver@npm:^7.5.4, semver@npm:^7.6.0, semver@npm:^7.6.2, semver@npm:^7.7.1":
+"semver@npm:^7.0.0, semver@npm:^7.1.1, semver@npm:^7.1.2, semver@npm:^7.3.2, semver@npm:^7.3.4, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.5.1, semver@npm:^7.5.3, semver@npm:^7.6.0, semver@npm:^7.6.2, semver@npm:^7.7.1":
   version: 7.7.1
   resolution: "semver@npm:7.7.1"
   bin:
@@ -15669,6 +16721,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"semver@npm:~7.5.4":
+  version: 7.5.4
+  resolution: "semver@npm:7.5.4"
+  dependencies:
+    lru-cache: "npm:^6.0.0"
+  bin:
+    semver: bin/semver.js
+  checksum: 10c0/5160b06975a38b11c1ab55950cb5b8a23db78df88275d3d8a42ccf1f29e55112ac995b3a26a522c36e3b5f76b0445f1eef70d696b8c7862a2b4303d7b0e7609e
+  languageName: node
+  linkType: hard
+
 "set-blocking@npm:^2.0.0":
   version: 2.0.0
   resolution: "set-blocking@npm:2.0.0"
@@ -16157,7 +17220,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string-argv@npm:^0.3.0, string-argv@npm:^0.3.1":
+"string-argv@npm:^0.3.0, string-argv@npm:^0.3.1, string-argv@npm:~0.3.1":
   version: 0.3.2
   resolution: "string-argv@npm:0.3.2"
   checksum: 10c0/75c02a83759ad1722e040b86823909d9a2fc75d15dd71ec4b537c3560746e33b5f5a07f7332d1e3f88319909f82190843aa2f0a0d8c8d591ec08e93d5b8dec82
@@ -16407,7 +17470,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-json-comments@npm:^3.1.1":
+"strip-json-comments@npm:^3.1.1, strip-json-comments@npm:~3.1.1":
   version: 3.1.1
   resolution: "strip-json-comments@npm:3.1.1"
   checksum: 10c0/9681a6257b925a7fa0f285851c0e613cc934a50661fa7bb41ca9cbbff89686bb4a0ee366e6ecedc4daafd01e83eee0720111ab294366fe7c185e935475ebcecd
@@ -16421,15 +17484,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-literal@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "strip-literal@npm:3.0.0"
-  dependencies:
-    js-tokens: "npm:^9.0.1"
-  checksum: 10c0/d81657f84aba42d4bbaf2a677f7e7f34c1f3de5a6726db8bc1797f9c0b303ba54d4660383a74bde43df401cf37cce1dff2c842c55b077a4ceee11f9e31fba828
-  languageName: node
-  linkType: hard
-
 "supports-color@npm:^2.0.0":
   version: 2.0.0
   resolution: "supports-color@npm:2.0.0"
@@ -16455,6 +17509,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"supports-color@npm:~8.1.1":
+  version: 8.1.1
+  resolution: "supports-color@npm:8.1.1"
+  dependencies:
+    has-flag: "npm:^4.0.0"
+  checksum: 10c0/ea1d3c275dd604c974670f63943ed9bd83623edc102430c05adb8efc56ba492746b6e95386e7831b872ec3807fd89dd8eb43f735195f37b5ec343e4234cc7e89
+  languageName: node
+  linkType: hard
+
 "supports-hyperlinks@npm:^2.2.0, supports-hyperlinks@npm:^2.3.0":
   version: 2.3.0
   resolution: "supports-hyperlinks@npm:2.3.0"
@@ -16676,10 +17739,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tinypool@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "tinypool@npm:1.1.1"
-  checksum: 10c0/bf26727d01443061b04fa863f571016950888ea994ba0cd8cba3a1c51e2458d84574341ab8dbc3664f1c3ab20885c8cf9ff1cc4b18201f04c2cde7d317fff69b
+"tinyglobby@npm:^0.2.15":
+  version: 0.2.15
+  resolution: "tinyglobby@npm:0.2.15"
+  dependencies:
+    fdir: "npm:^6.5.0"
+    picomatch: "npm:^4.0.3"
+  checksum: 10c0/869c31490d0d88eedb8305d178d4c75e7463e820df5a9b9d388291daf93e8b1eb5de1dad1c1e139767e4269fe75f3b10d5009b2cc14db96ff98986920a186844
   languageName: node
   linkType: hard
 
@@ -16690,10 +17756,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tinyspy@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "tinyspy@npm:4.0.3"
-  checksum: 10c0/0a92a18b5350945cc8a1da3a22c9ad9f4e2945df80aaa0c43e1b3a3cfb64d8501e607ebf0305e048e3c3d3e0e7f8eb10cea27dc17c21effb73e66c4a3be36373
+"tinyrainbow@npm:^3.0.3":
+  version: 3.0.3
+  resolution: "tinyrainbow@npm:3.0.3"
+  checksum: 10c0/1e799d35cd23cabe02e22550985a3051dc88814a979be02dc632a159c393a998628eacfc558e4c746b3006606d54b00bcdea0c39301133956d10a27aa27e988c
   languageName: node
   linkType: hard
 
@@ -16755,11 +17821,13 @@ __metadata:
   resolution: "traefik-proxy-dashboard@workspace:."
   dependencies:
     "@eslint/js": "npm:^9.32.0"
+    "@noble/ed25519": "npm:^3.0.0"
+    "@noble/hashes": "npm:^2.0.1"
     "@testing-library/dom": "npm:^10.4.1"
     "@testing-library/jest-dom": "npm:^6.4.2"
     "@testing-library/react": "npm:^14.2.1"
     "@testing-library/user-event": "npm:^14.5.2"
-    "@traefiklabs/faency": "npm:11.1.4"
+    "@traefiklabs/faency": "npm:12.0.4"
     "@types/lodash": "npm:^4.17.16"
     "@types/node": "npm:^22.15.18"
     "@types/react": "npm:^18.2.0"
@@ -16768,6 +17836,7 @@ __metadata:
     "@typescript-eslint/parser": "npm:^8.38.0"
     "@vitejs/plugin-react": "npm:^4.7.0"
     "@vitest/coverage-v8": "npm:^3.2.4"
+    "@vitest/web-worker": "npm:^4.0.2"
     chart.js: "npm:^4.4.1"
     eslint: "npm:^9.32.0"
     eslint-config-prettier: "npm:^10.1.8"
@@ -16800,7 +17869,7 @@ __metadata:
     usehooks-ts: "npm:^2.14.0"
     vite: "npm:^5.4.19"
     vite-tsconfig-paths: "npm:^5.1.4"
-    vitest: "npm:^3.2.4"
+    vitest: "npm:^4.0.3"
     vitest-canvas-mock: "npm:^0.3.3"
   languageName: unknown
   linkType: soft
@@ -16886,7 +17955,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tslib@npm:^2.0.0, tslib@npm:^2.0.1, tslib@npm:^2.1.0, tslib@npm:^2.4.0, tslib@npm:^2.6.2":
+"tslib@npm:^2.0.0, tslib@npm:^2.0.1, tslib@npm:^2.1.0, tslib@npm:^2.4.0":
   version: 2.8.1
   resolution: "tslib@npm:2.8.1"
   checksum: 10c0/9c4759110a19c53f992d9aae23aac5ced636e99887b51b9e61def52611732872ff7668757d4e4c61f19691e36f4da981cd9485e869b4a7408d689f6bf1f14e62
@@ -17068,13 +18137,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"typescript@npm:5.4.5":
-  version: 5.4.5
-  resolution: "typescript@npm:5.4.5"
+"typescript@npm:5.8.2":
+  version: 5.8.2
+  resolution: "typescript@npm:5.8.2"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: 10c0/2954022ada340fd3d6a9e2b8e534f65d57c92d5f3989a263754a78aba549f7e6529acc1921913560a4b816c46dce7df4a4d29f9f11a3dc0d4213bb76d043251e
+  checksum: 10c0/5c4f6fbf1c6389b6928fe7b8fcd5dc73bb2d58cd4e3883f1d774ed5bd83b151cbac6b7ecf11723de56d4676daeba8713894b1e9af56174f2f9780ae7848ec3c6
   languageName: node
   linkType: hard
 
@@ -17088,13 +18157,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"typescript@patch:typescript@npm%3A5.4.5#optional!builtin<compat/typescript>":
-  version: 5.4.5
-  resolution: "typescript@patch:typescript@npm%3A5.4.5#optional!builtin<compat/typescript>::version=5.4.5&hash=5adc0c"
+"typescript@npm:^5.8.3":
+  version: 5.9.3
+  resolution: "typescript@npm:5.9.3"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: 10c0/db2ad2a16ca829f50427eeb1da155e7a45e598eec7b086d8b4e8ba44e5a235f758e606d681c66992230d3fc3b8995865e5fd0b22a2c95486d0b3200f83072ec9
+  checksum: 10c0/6bd7552ce39f97e711db5aa048f6f9995b53f1c52f7d8667c1abdc1700c68a76a308f579cd309ce6b53646deb4e9a1be7c813a93baaf0a28ccd536a30270e1c5
+  languageName: node
+  linkType: hard
+
+"typescript@patch:typescript@npm%3A5.8.2#optional!builtin<compat/typescript>":
+  version: 5.8.2
+  resolution: "typescript@patch:typescript@npm%3A5.8.2#optional!builtin<compat/typescript>::version=5.8.2&hash=5786d5"
+  bin:
+    tsc: bin/tsc
+    tsserver: bin/tsserver
+  checksum: 10c0/5448a08e595cc558ab321e49d4cac64fb43d1fa106584f6ff9a8d8e592111b373a995a1d5c7f3046211c8a37201eb6d0f1566f15cdb7a62a5e3be01d087848e2
   languageName: node
   linkType: hard
 
@@ -17108,6 +18187,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"typescript@patch:typescript@npm%3A^5.8.3#optional!builtin<compat/typescript>":
+  version: 5.9.3
+  resolution: "typescript@patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>::version=5.9.3&hash=5786d5"
+  bin:
+    tsc: bin/tsc
+    tsserver: bin/tsserver
+  checksum: 10c0/ad09fdf7a756814dce65bc60c1657b40d44451346858eea230e10f2e95a289d9183b6e32e5c11e95acc0ccc214b4f36289dcad4bf1886b0adb84d711d336a430
+  languageName: node
+  linkType: hard
+
+"ufo@npm:^1.6.1":
+  version: 1.6.1
+  resolution: "ufo@npm:1.6.1"
+  checksum: 10c0/5a9f041e5945fba7c189d5410508cbcbefef80b253ed29aa2e1f8a2b86f4bd51af44ee18d4485e6d3468c92be9bf4a42e3a2b72dcaf27ce39ce947ec994f1e6b
+  languageName: node
+  linkType: hard
+
 "uglify-js@npm:^3.1.4":
   version: 3.19.3
   resolution: "uglify-js@npm:3.19.3"
@@ -17369,7 +18465,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uri-js@npm:^4.2.2":
+"uri-js@npm:^4.2.2, uri-js@npm:^4.4.1":
   version: 4.4.1
   resolution: "uri-js@npm:4.4.1"
   dependencies:
@@ -17519,7 +18615,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vite-node@npm:3.2.4":
+"vite-node@npm:^3.2.2":
   version: 3.2.4
   resolution: "vite-node@npm:3.2.4"
   dependencies:
@@ -17534,6 +18630,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"vite-plugin-dts@npm:^4.5.4":
+  version: 4.5.4
+  resolution: "vite-plugin-dts@npm:4.5.4"
+  dependencies:
+    "@microsoft/api-extractor": "npm:^7.50.1"
+    "@rollup/pluginutils": "npm:^5.1.4"
+    "@volar/typescript": "npm:^2.4.11"
+    "@vue/language-core": "npm:2.2.0"
+    compare-versions: "npm:^6.1.1"
+    debug: "npm:^4.4.0"
+    kolorist: "npm:^1.8.0"
+    local-pkg: "npm:^1.0.0"
+    magic-string: "npm:^0.30.17"
+  peerDependencies:
+    typescript: "*"
+    vite: "*"
+  peerDependenciesMeta:
+    vite:
+      optional: true
+  checksum: 10c0/5fcb7f3739d115f36195a692c0e9f9fca4e504bbbbabe29e71ee06630dd05ea2920169371e80e548eb4779d2eca14107277497838d7df588d53e1fadf84be861
+  languageName: node
+  linkType: hard
+
 "vite-tsconfig-paths@npm:^5.1.4":
   version: 5.1.4
   resolution: "vite-tsconfig-paths@npm:5.1.4"
@@ -17550,17 +18669,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0-0":
-  version: 7.0.6
-  resolution: "vite@npm:7.0.6"
+"vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0, vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0-0":
+  version: 7.2.2
+  resolution: "vite@npm:7.2.2"
   dependencies:
     esbuild: "npm:^0.25.0"
-    fdir: "npm:^6.4.6"
+    fdir: "npm:^6.5.0"
     fsevents: "npm:~2.3.3"
     picomatch: "npm:^4.0.3"
     postcss: "npm:^8.5.6"
-    rollup: "npm:^4.40.0"
-    tinyglobby: "npm:^0.2.14"
+    rollup: "npm:^4.43.0"
+    tinyglobby: "npm:^0.2.15"
   peerDependencies:
     "@types/node": ^20.19.0 || >=22.12.0
     jiti: ">=1.21.0"
@@ -17601,50 +18720,7 @@ __metadata:
       optional: true
   bin:
     vite: bin/vite.js
-  checksum: 10c0/3b14dfa661281b4843789884199ba2a9cca940a7666970036fe3fb1abff52b88e63e8be5ab419dd04d9f96c0415ee0f1e3ec8ebe357041648af7ccd8e348b6ad
-  languageName: node
-  linkType: hard
-
-"vite@npm:^5.1.5":
-  version: 5.4.17
-  resolution: "vite@npm:5.4.17"
-  dependencies:
-    esbuild: "npm:^0.21.3"
-    fsevents: "npm:~2.3.3"
-    postcss: "npm:^8.4.43"
-    rollup: "npm:^4.20.0"
-  peerDependencies:
-    "@types/node": ^18.0.0 || >=20.0.0
-    less: "*"
-    lightningcss: ^1.21.0
-    sass: "*"
-    sass-embedded: "*"
-    stylus: "*"
-    sugarss: "*"
-    terser: ^5.4.0
-  dependenciesMeta:
-    fsevents:
-      optional: true
-  peerDependenciesMeta:
-    "@types/node":
-      optional: true
-    less:
-      optional: true
-    lightningcss:
-      optional: true
-    sass:
-      optional: true
-    sass-embedded:
-      optional: true
-    stylus:
-      optional: true
-    sugarss:
-      optional: true
-    terser:
-      optional: true
-  bin:
-    vite: bin/vite.js
-  checksum: 10c0/3322bd6d8da30cbc87b1b24cd14fdbca75abb36de81217d1062c8b4c574a1a0d28d11dfe23a3eed08b3d179d2bdc1510e0d7b9f3e1b722a45bd7631c7cec72eb
+  checksum: 10c0/9c76ee441f8dbec645ddaecc28d1f9cf35670ffa91cff69af7b1d5081545331603f0b1289d437b2fa8dc43cdc77b4d96b5bd9c9aed66310f490cb1a06f9c814c
   languageName: node
   linkType: hard
 
@@ -17691,6 +18767,61 @@ __metadata:
   languageName: node
   linkType: hard
 
+"vite@npm:^6.0.0 || ^7.0.0":
+  version: 7.1.12
+  resolution: "vite@npm:7.1.12"
+  dependencies:
+    esbuild: "npm:^0.25.0"
+    fdir: "npm:^6.5.0"
+    fsevents: "npm:~2.3.3"
+    picomatch: "npm:^4.0.3"
+    postcss: "npm:^8.5.6"
+    rollup: "npm:^4.43.0"
+    tinyglobby: "npm:^0.2.15"
+  peerDependencies:
+    "@types/node": ^20.19.0 || >=22.12.0
+    jiti: ">=1.21.0"
+    less: ^4.0.0
+    lightningcss: ^1.21.0
+    sass: ^1.70.0
+    sass-embedded: ^1.70.0
+    stylus: ">=0.54.8"
+    sugarss: ^5.0.0
+    terser: ^5.16.0
+    tsx: ^4.8.1
+    yaml: ^2.4.2
+  dependenciesMeta:
+    fsevents:
+      optional: true
+  peerDependenciesMeta:
+    "@types/node":
+      optional: true
+    jiti:
+      optional: true
+    less:
+      optional: true
+    lightningcss:
+      optional: true
+    sass:
+      optional: true
+    sass-embedded:
+      optional: true
+    stylus:
+      optional: true
+    sugarss:
+      optional: true
+    terser:
+      optional: true
+    tsx:
+      optional: true
+    yaml:
+      optional: true
+  bin:
+    vite: bin/vite.js
+  checksum: 10c0/cef4d4b4a84e663e09b858964af36e916892ac8540068df42a05ced637ceeae5e9ef71c72d54f3cfc1f3c254af16634230e221b6e2327c2a66d794bb49203262
+  languageName: node
+  linkType: hard
+
 "vitest-canvas-mock@npm:^0.3.3":
   version: 0.3.3
   resolution: "vitest-canvas-mock@npm:0.3.3"
@@ -17702,39 +18833,38 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vitest@npm:^3.2.4":
-  version: 3.2.4
-  resolution: "vitest@npm:3.2.4"
+"vitest@npm:^4.0.3":
+  version: 4.0.3
+  resolution: "vitest@npm:4.0.3"
   dependencies:
-    "@types/chai": "npm:^5.2.2"
-    "@vitest/expect": "npm:3.2.4"
-    "@vitest/mocker": "npm:3.2.4"
-    "@vitest/pretty-format": "npm:^3.2.4"
-    "@vitest/runner": "npm:3.2.4"
-    "@vitest/snapshot": "npm:3.2.4"
-    "@vitest/spy": "npm:3.2.4"
-    "@vitest/utils": "npm:3.2.4"
-    chai: "npm:^5.2.0"
-    debug: "npm:^4.4.1"
-    expect-type: "npm:^1.2.1"
-    magic-string: "npm:^0.30.17"
+    "@vitest/expect": "npm:4.0.3"
+    "@vitest/mocker": "npm:4.0.3"
+    "@vitest/pretty-format": "npm:4.0.3"
+    "@vitest/runner": "npm:4.0.3"
+    "@vitest/snapshot": "npm:4.0.3"
+    "@vitest/spy": "npm:4.0.3"
+    "@vitest/utils": "npm:4.0.3"
+    debug: "npm:^4.4.3"
+    es-module-lexer: "npm:^1.7.0"
+    expect-type: "npm:^1.2.2"
+    magic-string: "npm:^0.30.19"
     pathe: "npm:^2.0.3"
-    picomatch: "npm:^4.0.2"
+    picomatch: "npm:^4.0.3"
     std-env: "npm:^3.9.0"
     tinybench: "npm:^2.9.0"
     tinyexec: "npm:^0.3.2"
-    tinyglobby: "npm:^0.2.14"
-    tinypool: "npm:^1.1.1"
-    tinyrainbow: "npm:^2.0.0"
-    vite: "npm:^5.0.0 || ^6.0.0 || ^7.0.0-0"
-    vite-node: "npm:3.2.4"
+    tinyglobby: "npm:^0.2.15"
+    tinyrainbow: "npm:^3.0.3"
+    vite: "npm:^6.0.0 || ^7.0.0"
     why-is-node-running: "npm:^2.3.0"
   peerDependencies:
     "@edge-runtime/vm": "*"
     "@types/debug": ^4.1.12
-    "@types/node": ^18.0.0 || ^20.0.0 || >=22.0.0
-    "@vitest/browser": 3.2.4
-    "@vitest/ui": 3.2.4
+    "@types/node": ^20.0.0 || ^22.0.0 || >=24.0.0
+    "@vitest/browser-playwright": 4.0.3
+    "@vitest/browser-preview": 4.0.3
+    "@vitest/browser-webdriverio": 4.0.3
+    "@vitest/ui": 4.0.3
     happy-dom: "*"
     jsdom: "*"
   peerDependenciesMeta:
@@ -17744,7 +18874,11 @@ __metadata:
       optional: true
     "@types/node":
       optional: true
-    "@vitest/browser":
+    "@vitest/browser-playwright":
+      optional: true
+    "@vitest/browser-preview":
+      optional: true
+    "@vitest/browser-webdriverio":
       optional: true
     "@vitest/ui":
       optional: true
@@ -17754,7 +18888,14 @@ __metadata:
       optional: true
   bin:
     vitest: vitest.mjs
-  checksum: 10c0/5bf53ede3ae6a0e08956d72dab279ae90503f6b5a05298a6a5e6ef47d2fd1ab386aaf48fafa61ed07a0ebfe9e371772f1ccbe5c258dd765206a8218bf2eb79eb
+  checksum: 10c0/3462e797fc3100d6adae9d5beaa4784a109d4fe5fc1403fb251ebdf7ca95988c1f1447bbaeac3f0046aae555a611f1dcb9da0bcb9d30af7ee99ac5392427fd2b
+  languageName: node
+  linkType: hard
+
+"vscode-uri@npm:^3.0.8":
+  version: 3.1.0
+  resolution: "vscode-uri@npm:3.1.0"
+  checksum: 10c0/5f6c9c10fd9b1664d71fab4e9fbbae6be93c7f75bb3a1d9d74399a88ab8649e99691223fd7cef4644376cac6e94fa2c086d802521b9a8e31c5af3e60f0f35624
   languageName: node
   linkType: hard